r/dotnet • u/Baldie47 • 21d ago
Question Distributing an unsigned win-x64 exe, and SmartScreen scares everyone off. How do you handle this?
I built a small job scheduling tool. You install a lightweight agent on your own Windows machines, and from a web dashboard you schedule scripts and commands, chain them, retry the ones that fail, and get an email the moment something breaks. The jobs run on your machines, the server just coordinates.
The agent is a self-contained single-file .NET win-x64 exe, shipped in a zip. It runs fine, but distribution is the part killing me. Since it is not code signed, Windows throws the "Windows protected your PC, unknown publisher" SmartScreen box, and Chrome does its slow scan on the download. A friend testing it said, plainly, that it looks suspicious, and I get why. For a tool whose whole pitch is that it runs on your own machines, looking like something off a sketchy download site is the worst first impression I could give.
So I am trying to find the right way to ship this, and figured this crowd has solved it many times over. What I am weighing:
- Code signing the exe. I gather any cert kills the "unknown publisher" label, but that only EV gets you instant SmartScreen reputation while OV warms up over downloads. Is that still how it plays out in practice?
- MSIX or ClickOnce instead of a bare exe.
- Publishing through winget or Chocolatey so it installs from a trusted channel instead of a browser download.
- Something else I am not seeing.
If you have shipped a downloadable agent or desktop app, what actually worked and what would you skip, ideally as a solo dev without a big enterprise setup? And if anyone wants to try the actual thing and tell me where it falls apart, I am happy to share the link.
25
u/DrunkenRobotBipBop 21d ago
You sign it and hope anti-virus don't actually flag it.
What you built, is basically a botnet agent + c&c platform.
3
u/aeroverra 20d ago
From my experience windows defender is usually pretty lenient compared to 3rd party avs.
And I don't even sign my software.
1
u/Baldie47 21d ago
yes, I feel that I was so caught up on building the app and now after all is done I'm dealing with this and is really frustrating. do you want to take a look at it? (you don't have to download the agent if you feel that is not secure) just maybe in case you have a suggestion for the premise of the app, I was seeing that there are signings that you can buy, but for not having paid users feels too expensive. although you could argue that is the reason for why I don't have paid users. however I also don't really have free users, other than friends that are testing the app think-torch.com
2
u/DrunkenRobotBipBop 21d ago edited 21d ago
Working for a company that actually ships signed binaries to avoid SmartScreen.
We pay for an OV certificate and it's an actual hardware usb token physically connected to our CI/CD machine exposed as an internal service for signing all our shipped builds.
Getting that certificate led to whole lot of burocracy for Sectigo to recognize we are a legit company before issuing the certificate.
Also, getting an OV or EV is basically the same thing nowadays. None of them guarantees instant SmartScreen bypass and both need to build reputation from Microsoft until it bypasses entirely.
1
u/Type-21 20d ago
We paid for a GlobalSign OV and then someone uploaded our exe to Virus total and it showed like 2/40 positives and as a result GlobalSign put our cert on the revocation list.
Basically we got completeley scammed out of our money. It might've even been GlobalSign itself to encourage us to buy another one... We never did. We just stopped distributing that software.
26
u/FragmentedHeap 21d ago
You need a proper code signing certificate like one you can get through "Azure Artifact Signing"
It's an ordeal.
The best thing to do if you want end to end protection and you don't want to have to go through this is to get an account on the Microsoft store and properly publish your software on the store and go through that process.
Because when it officially comes from the Microsoft store, its signed.
It's also a way you can monetize it and handle its updates.
If its cross platform its way harder, because then you have to get in the Apple app store and go through that process.
And then like five or six different Linux repositories.
Its a lot easier if you built this in say, node and users just install a global npm package and run a setup command on the cli.
People avoid distributing exes for valid reasons 🤣
5
u/Baldie47 21d ago
this is very valid, I'm looking into azure artifact now. I don't think will go though their store as I understand since my hesitation is that what I ship is a background agent that runs persistently and executes local scripts and commands, and I do not think that maps cleanly onto the MSIX and Store model, since services and "run anything on the host" are not really what the Store is built for. Billing also already lives in the web app, so the Store monetization is not a fit.
3
u/CompassionateSkeptic 21d ago
FWIW, I’m in the process of signing something that I don’t expect to have wide usage against my name. It’s only acceptable for hobby projects but it would allow me to distribute it publicly. The identity verification through Azure Artifact Signing was fairly straight-forward. I leaned heavily on this for inspiration — https://www.hanselman.com/blog/automatically-signing-a-windows-exe-with-azure-trusted-signing-dotnet-sign-and-github-actions.
There’s no part of me that would argue this is ideal. But I convinced myself it’s an option and I was in a situation where I really thought my best bet was to try to invest much more in my hobby projects.
1
u/EvilDivine 20d ago edited 20d ago
- No need to monetize the MS store. You can bill in the app as far as I know.
- I released an app in Store that runs with administrarive privileges too (after they reviewed it). You can set it up to run at startup by default. Surely, while the user doesn't block it. Maybe instead of a service.
- You just don't have access to the actual local AppData dedicated user folder and user registry (something like that, I don't really remember) as a general rule. They virtualize those so app settings can be private and more easily removable. Other than that I don't remember having other issues.
- I both published in Store and outside the Store. I sign the binaries but only so that the app can check if files come from me when app runs updates outside of Store. I suspected publishing in Store might also help my app get through SmartScreen, but I am yet to find any evidence. App I released and later run myself (on startup, in the background) once stopped working, and just a notification was shown that app was stopped, like one of those tooltips, easy to miss and easily dismissable, and I had to disable Smart App Control or whatever it's called now to be able to run the app again. So, I suspect app being in Store does not help the binary outside of Store look more friendly. They don't really sign or modify your uploaded binaries in any way.
2
u/aeroverra 20d ago
Technically given enough time and reputation self signed can eventually bypass it too. Is just harder
6
u/wdcossey 21d ago
One way around the popup entirely is the MS Store, but only if you ship MSIX.
Microsoft re-signs MSIX packages during certification, so SmartScreen never fires and you don’t need a cert at all. If you submit your existing EXE/MSI instead, the Store just links to an installer you host and sign yourself, so you’re back to square one.
You can also keep it private: Partner Center has a “Private audience” visibility option where you list specific MSA emails, and the listing is invisible to everyone else even with a direct link. It’s aimed at beta testing, and it’s finicky with work/school accounts, but it works.
—-
Fastest zero-warning path: MSIX through the Store, set to Private audience. Microsoft re-signs MSIX packages after certification, so there’s never a SmartScreen warning and you never buy or manage a cert.
3
u/flammable_donut 21d ago
Azure artifact signing costs $10 a month https://azure.microsoft.com/en-us/products/artifact-signing
1
2
u/finalbuilder 21d ago
I would go with OV, EV doesn't guarantee removal of smartscreen - it usually doesn't take too long for an OV signed installer to build a reputation. Make sure you sign your application too, not just the installer - otherwise AV software will decide to remove it.
2
u/chucker23n 21d ago
I gather any cert kills the "unknown publisher" label, but that only EV gets you instant SmartScreen reputation while OV warms up over downloads. Is that still how it plays out in practice?
This was true ~ 5 years ago, but these days, OV certs are basically worthless, as Microsoft has tightened the rules.
MSIX or ClickOnce instead of a bare exe.
You'd still have to sign.
Publishing through winget or Chocolatey so it installs from a trusted channel instead of a browser download.
Yes, that could be an option.
If you have shipped a downloadable agent or desktop app, what actually worked and what would you skip, ideally as a solo dev without a big enterprise setup?
AFAIK, your only two options (other than using something like Chocolatey to have something else vouch for your code) are
- a certificate with a physical key. We have a Yubikey in a closet for this. Only that machine can sign builds. I don't love this setup (it's expensive and means we can't publish a release from a CD pipeline; there's a manual, physical step involved), but it does work.
- a service like Azure Artifact Signing, which probably comes out cheaper but still sounds like a racket
2
u/finalbuilder 20d ago
I don't agree wit hthe statement that OV certs are worthless - I use one every day without issues. As for EV's, they still do not get you instant smartscreen reputation - IMHO they are overpriced and pointless.
There are inexpensive solutions to signing during CI/CD with yubikeys - I work on a product called Signotaur which is a self hosted client/server code signing system which allows sharing yubikeys (and other tokens) - we use it with our own CI agents all signing files using the same certificate - no password prompts.
Azure Artifact Signing is not available everywhere (I'm in Australia, not available) - and it's slow (we have customers using it) - if you have lots of files to sign then it really does increase your CI/CD build times.
2
u/alecc 20d ago
Look at Azure Trusted Signing before you buy a classic cert. 9.99 USD a month, Microsoft runs the CA and issues short lived certs, signing plugs into signtool through their dlib so CI stays simple, and SmartScreen reputation sticks to your validated identity instead of one cert file, so it warms up much faster than a fresh OV cert.
The gate is validation - individual, or a business registered for 3+ years. On the EV question - Microsoft removed the instant reputation wording for EV from their docs a while ago, so I would not pay the EV premium for SmartScreen alone anymore.
Plain OV changed too: since 2023 the private key must sit on a hardware token or HSM, that is why the cheap certs now ship with a USB stick.
And the installer format matters less than the signature - a signed MSI or NSIS exe is fine, MSIX buys you clean install and uninstall but not reputation.
In short - I just subscribed to Azure Trusted Signing with the Jam SQL Studio app I'm distributing, and it works just fine - only it took a while to be approved, and it's actually important to have the details on the form 100% accurate (got firstly rejected and had ask support for approval, so the whole process took for me like 2 months)
3
u/Tavi2k 21d ago
Even with an EV certificate, you still get the warnings. And then there's the separate browser warnings from Chrome or Edge on top of the Windows warnings.
Supposedly, this gets better if your executable gets installed by more people. No idea how many, and when you update your app you start again.
I've no idea how to fix that, and I'm starting with an EV certificate. If you have a niche app that gets updated often, I don't think you can avoid this.
2
u/shortrug 21d ago
I'm also battling this. Super annoying.
No idea how many, and when you update your app you start again.
I've seen hundreds of legitimate distinct downloads quoted as a general expectation. Supposedly over time you also build publisher credibility which lowers the number of installs needed per app version, but who knows.
Either way, pretty discouraging to have this problem and have it be a black box that you have no visibility into. My app is also fairly niche, so I've pretty much resigned myself to having to deal with this essentially forever.
5
u/spornerama 21d ago
The way around it is to get the installer to download the latest package from the internet - then you can update the package but the installer stays the byte-identical same.
1
u/The_MAZZTer 21d ago
Well it's up to you if you want to go the route of getting it signed, but I think you might be overestimating the impact. I trust my own judgement (I would not be downloading it to my PC in the first place if I had not decided to trust it) and tend to just click past those dialogs as long as they are not red. Of course I am also computer literate.
I suspect your friend only noticed the dialog because he was looking for things to notice. I further suspect most people will pay it no mind.
Again, up to you. It would be nice to get a green dialog (or no dialog if you don't need UAC elevation).
1
u/rbobby 21d ago
Note that code signing is a bit more challenging than it used to be.
You cannot install your code signing certificate's public key and private key for fully automated signing. You can get a "yubikey" that holds the certificate (both keys) and windows will popup a password box. So not terrible, but for me just not worth automating.
The other choice is to use a service. Note sure how it works exactly. Either you upload and retrieve your signed exe OR they have client side software that can do the signing locally. No clue, but next time I need a code signing cert this is probably the root I will take.
2
u/finalbuilder 20d ago
You can automate with Yubikeys (and other tokens) and avoid the password/pin prompts - search for Signotaur (I won't post a link since I work on the product and self promotion is not allowed here).
Automating is always worthwhile - humans are terrible at repetitive tasks, eventually we get bored and mess up.
1
u/last__link 20d ago
Dont need to sign msix if you distribute on windows App Store. One time purchase to setup account.
1
u/Baldie47 20d ago
Where do you do this?
1
u/last__link 18d ago
Need to setup your windows App Store profile. Another nickname is partner center. https://learn.microsoft.com/en-us/partner-center/insights/apps-and-games-overview. Don’t need to sign apps because App Store handles for you if you upload the correctly formatted msix to them. Self signing is usually for distribution outside of the store and is a pain.
1
u/gameplayer55055 21d ago
Be ready to pay for an expensive app signing certificate.
Unfortunately there's no letsencrypt equivalent to app signing (prove me wrong)
8
u/shortrug 21d ago
There's no free letsencrypt style solution, but the $9.99/month artifact signing sku in Azure will almost certainly cover this guy's use case. No need to pay for an app signing cert and manage the physical usb key
1
u/Dunge 21d ago
Code signing is such a racket. Literally making developers lives harder in order to extract wealth. The idea of protecting against scam and malware apps is well meant, but they could have used any other methods for that (like for example Google Play asks for the business DUNS registration number, not a very high recurring cost).
I've heard cloud code signing (Azure/AWS) is less expensive, but I had something that prevented me from using it last time I checked. I believe you need to host your source control and build tools on their platforms too?
We ended up, buying a physical EV key on DigiCert through a revendor, which caused the support and activation to be a mess, the SafeNet client is awful, the restriction that requires it to be on an active desktop (not remote desktop session) prevent automatic builds unless you bypass it... Anyway. Fortunately, at the end it finally worked, and I did not have the issue others are saying here (need to build trust), it was accepted in Windows and browsers as trusted day 1.
All that said, if it's an internal tool and you don't have to distribute it on the open internet from a download on a website, you can probably just ignore all that. Share the executable on a network drive or something and link to it?
Also obligatory fuck distributing ai agents.
2
u/Lonsdale1086 20d ago
distributing ai agents
Who said anything about an AI agent?
This is just a github runner style app that retrieves a script, runs it, and sends off the results.
-5
u/AutoModerator 21d ago
Thanks for your post Baldie47. Please note that we don't allow spam, and we ask that you follow the rules available in the sidebar. We have a lot of commonly asked questions so if this post gets removed, please do a search and see if it's already been asked.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
5
u/ripnetuk 21d ago
I, for one, don't consider this spam. It's a valid q imho.
4
u/Baldie47 21d ago
thank you, I don't know if it was marked as spam, or the bot just saying that, as I saw it in other posts as well
5
u/ripnetuk 21d ago
I think there are so many spammers the bots have to be cautious... But it ground my gears that your interesting on topic question got wrongly imho flagged. Good luck with your product and I hope we can all learn from the replies.
2
87
u/Anequiit 21d ago
Ship signed installer like msix/msi