- This topic has 16 replies, 1 voice, and was last updated 3 hours, 39 minutes ago by
.
-
Posts
-
[@TK]
There is actually a reason why downloaded software that is not signed is more safe and that is this: Windows smartscreen trusts downloads that are digitally signed, it flags all downloads that are not known and not signed. So software publishers who do not sign have to submit all their files to microsoft to get it whitelisted in smartscreen. Each time I publish a new file I have to get it scanned by ms so smartscreen doesn’t block it. So that means that all user downloads of files that have not been signed and are getting through smartscreen can be considered save because they are whitelisted meaning they have been analysed by ms and considered safe.
On the other hand digitally signed files that get through smartscreen are not guaranteed to be safe at all. Something I noticed many years ago when I downloaded the famous signed installer of CCleaner that was infected.You are entirely incorrect, smartscreen does NOT just check for a valid digital signature! Smartscreen has been about long before default windows 11 requirement for executables to be signed. There are cloud reputation as well checking file names\URLs and hashes… But just like all other retrospective solutions infected installers have to be out there a while before they are detected as bad and detections put in place. NO anti-malware system can be guaranteed to be safe! The only pre-emptive smartscreen protection is the warning this file is not commonly downloaded so may not be safe… and the vast majority of those are false positives. Sign your executables with DUAL hashes and IF the signatures validate OK and the thumbprints are the same as when you created the signatures then it is practically 100% certain the software is no more dangerous than when you built it and no one else has modified it. If you do not sign it with a widely accepted CA service there are zero assurances the file is as you built it since you don’t even publish SHA256/SHA1/MD-5 HASHES to prove it’s unadulterated. I note you also use the scammer and spammers friend LetsEncrypt to provide your 3 month freebie SSL/TLS certificates for your website. They are loved by criminals because they don’t validate the applicants identity as you know and they refuse point blank to revoke any certificate used by criminal website owners. I personally with LetsEncrypt root certificate was revoked because they enable criminal activity over SSL websites and give them an air of legitimacy until you spot the certificate came from LetsEncrypt! The fact is you are not taking your dev work seriously if you use LetsEncrypt and refuse to digitally sign your executables. You are behaving like a bedroom amateur developer… many free open sourced products digitally sign their releases simply because that IS current best-practice no matter how you try to twist the facts with fake information.Famous last quote “downloaded software that is not signed is more safe” delusional! It’s blindly trusting anything that is the big risk… you got caught out by a badly signed CCLeaner that was probably only SHA-1 signed and so concluded the solution to THAT problem was to dual HASH sign and publish your own thumbprint and to check signatures manually as windows of a certain age does not enforce blocking the running of user space programs with an invalid signature! It does check the signatures of core windows components but not that of user space exes… I believe windows 11 can do the user space exe signature check and block if invalid in any way! I don’t outsource my security entirely. I engage brain before running an executable, I advise you to do at least the same!
[@TK] Again a lot of nonsense.
My website doesn’t even need https because at no point any user information is either send or received from my website. I simply sends people to paypal to do all the sensitive stuff. It would do just fine on normal http, the only reason it uses https is because google seems to like that.
And no CCLeaner was not badly signed by someone, it was the company itself that was hacked and infected. Something that in this age of AI could easily happen anywhere. God knows how many companies are signing their infected software and you trust it. It is for sure happening, I hear mossad is very active implanting spyware everywhere, for sure Russia and China are also doing that. Even Windows used to have a back door not long ago.
The reality is that if virustotal doesn’t recognise a new type of male ware then there is not much a normal user can do, it could be anywhere and big companies are more likely being targeted than small companies.
Yes you are right, use your brain before running an executable and scan it on virustotal.
