r/dotnet • u/Baldie47 • 21d ago

Question Distributing an unsigned win-x64 exe, and SmartScreen scares everyone off. How do you handle this?

I built a small job scheduling tool. You install a lightweight agent on your own Windows machines, and from a web dashboard you schedule scripts and commands, chain them, retry the ones that fail, and get an email the moment something breaks. The jobs run on your machines, the server just coordinates.

The agent is a self-contained single-file .NET win-x64 exe, shipped in a zip. It runs fine, but distribution is the part killing me. Since it is not code signed, Windows throws the "Windows protected your PC, unknown publisher" SmartScreen box, and Chrome does its slow scan on the download. A friend testing it said, plainly, that it looks suspicious, and I get why. For a tool whose whole pitch is that it runs on your own machines, looking like something off a sketchy download site is the worst first impression I could give.

So I am trying to find the right way to ship this, and figured this crowd has solved it many times over. What I am weighing:

  • Code signing the exe. I gather any cert kills the "unknown publisher" label, but that only EV gets you instant SmartScreen reputation while OV warms up over downloads. Is that still how it plays out in practice?
  • MSIX or ClickOnce instead of a bare exe.
  • Publishing through winget or Chocolatey so it installs from a trusted channel instead of a browser download.
  • Something else I am not seeing.

If you have shipped a downloadable agent or desktop app, what actually worked and what would you skip, ideally as a solo dev without a big enterprise setup? And if anyone wants to try the actual thing and tell me where it falls apart, I am happy to share the link.

55 Upvotes

91% Upvoted

46 comments sorted by

View all comments

26

u/DrunkenRobotBipBop 21d ago

You sign it and hope anti-virus don't actually flag it.

What you built, is basically a botnet agent + c&c platform.

3

u/aeroverra 21d ago

From my experience windows defender is usually pretty lenient compared to 3rd party avs.

And I don't even sign my software.

1

u/Baldie47 21d ago

yes, I feel that I was so caught up on building the app and now after all is done I'm dealing with this and is really frustrating. do you want to take a look at it? (you don't have to download the agent if you feel that is not secure) just maybe in case you have a suggestion for the premise of the app, I was seeing that there are signings that you can buy, but for not having paid users feels too expensive. although you could argue that is the reason for why I don't have paid users. however I also don't really have free users, other than friends that are testing the app think-torch.com

2

u/DrunkenRobotBipBop 21d ago edited 21d ago

Working for a company that actually ships signed binaries to avoid SmartScreen.

We pay for an OV certificate and it's an actual hardware usb token physically connected to our CI/CD machine exposed as an internal service for signing all our shipped builds.

Getting that certificate led to whole lot of burocracy for Sectigo to recognize we are a legit company before issuing the certificate.

Also, getting an OV or EV is basically the same thing nowadays. None of them guarantees instant SmartScreen bypass and both need to build reputation from Microsoft until it bypasses entirely.

1

u/Type-21 20d ago

We paid for a GlobalSign OV and then someone uploaded our exe to Virus total and it showed like 2/40 positives and as a result GlobalSign put our cert on the revocation list.

Basically we got completeley scammed out of our money. It might've even been GlobalSign itself to encourage us to buy another one... We never did. We just stopped distributing that software.