WinXP SP2 and Digitallly Signing your .exe

[Fost]

With Windows XP service Pack 2, if you download an exe file, then run it, you get an authenticode (http://www.verisign.com/resources/gd/authenticode/index.html) message. screenshot (http://www.moonpod.com/board/images/misc/XPSP2DigitalID.gif)

Looks like they are taking digital code signing up to the next level. So, my question is: does anyone have any reccomendations on where to obtain a digital id? Prices seem to vary wildy, some are based on a year's subscription, whereas others don't even say (Verisign comes in at a hefty $400).

[Jack Norton]

Looks like they are taking digital code signing up to the next level.
it looks to me that they're just trying to get more money from us developers :D
anyway that's bad, many potential buyers could be scared by that message and never try the games... bah it's crap! :(

[Valen]

The Internet lacks the subtle information provided by packaging, shelf space, shrink wrap, and the like. Without an assurance of the software's integrity, and without knowing who published the software, it's difficult for customers to know how much to trust software.

Wait so according to that, the only software that's safe to install is the one you buy at a store? Who the hell has the authority to decide this for the customer??? Not only that, the uselessness of their certificates makes this even worse. Even if you DO have one of those things, instead of seeing a warning about an unsigned EXE, the user is asked if they want to run a program published by "So and So" still not saying that it's safe to run it. They make the user decide if they "trust" that company.

I think it's time for another anti-trust suit (no pun intended). :)

[Linusson]

Hopefully people will get so used to this question that they just click it away and say something stupid about a certain company.

[DavidRM]

I doubt it will matter much.

When was the last time you ever noticed, or had a user ask about, this message that comes up when you click on a download link:


Some files can harm your computer. If the file below looks suspicious, or you do not fully trust the source, do not open or save this file.

Or have you *ever* read it? ;)

-David

[BantamCityGames]

I think this is only one of the problems we are going to see in SP2. Alot of companies are treating SP2 as an entirely new OS because of the many differences. I read an article recently that said Microsoft admitted that there would be many programs that would no longer run, but I believe they were talking about legacy type stuff. I haven't yet upgraded the computers at work because we run alot of older software and I'm affraid of the repercussions.

[Valen]

When was the last time you ever noticed, or had a user ask about, this message that comes up when you click on a download link:


This is when you run the program though, not download it. There's also a difference between "some files might harm your computer" and "this file will probably harm your computer." :) But yeah looking at it again, it does seem like another one of those things that will just end up being ignored by users after they get used to it. Now that I think about it, wasn't this originally part of XP? Did they just leave it off by default at first and now turned it on by default?

[cliffski]

well if it wasnt for the script kiddie morons writing their lame viruses we wouldn't have to put up with this crap. bah!
To be honest, do you think many home users are going to bother upgrading to SP2? I know I won't because:
1) my PC works fine as it is, and an OS upgrade can be a dodgy prospect
2) I have antivirus and a firewall. why should i bother?
3) I have better things to do.
I think this isn't going to be a big issue.

[Mark Fassett]

I think many home users will do it, not knowing what they are doing. They changed windows update, and made it real difficult to not install sp2.

[Hamumu]

Yes, I have to decline to install it everytime I boot my computer... it's gonna spread a lot faster than any script kiddie's virus!

[Sillysoft]

I think that Thawte has digital signatures significantly less than verisign. I don't think that I will bother though. If non-signed apps ever become the minority then I will look into getting one.

[Peter Wayne]

I was told by one of my expect PC friends to not go near SP2 with a ten foot pole! It has many bugs. Most programs will either not work or they will stuff up. There was a list of over 200 programs that "may" not work with SP2. It's just to risky at this point.

Here's two recent articles that point out that SP2 failure rate is pretty high. I wouldn't risk it to be honest.

http://blogs.pcworld.com/staffblog/archives/000167.html
http://www.eweek.com/article2/0,1759,1635083,00.asp

[Dingo Games]

I just read that eweek.com article. Apparently there is now a windows firewall that is enabled by default. That could be a pain if you program "phones home". Or even when your program tries to get to your websites order page. I know that Zone Alarm often pops up when programs are trying to get their order page.. but I haven't installed SP2, so I don't know if it will do the same kind of thing.

[MiCo Games]

http://www.gamasutra.com/features/20040603/pournelle_01.shtml

[GameStudioD]

I installed SP2 on my laptop and I have had no problems. It just nags me everytime I boot the machine to turn on automatic updates.

It does have a firewall. However, I read somewhere that a program can turn it off if it chooses to. So, if your game phones home, you can turn off windows firewall, and turn it back on again when you are done. Kinda makes the firewall useless.

Having a message box for non-signed exes is just dumb. Users will just become numb to them and click the button that allows them to do what they want (run the program). Like the crash dialog in windows, I have seen that thing so many times. I never read it, I see 'Dont Send' and always click that.

From the reviews I have read, SP2 really doesnt do much for security. Its more hype than security.

[MattInglot]

I just read that eweek.com article. Apparently there is now a windows firewall that is enabled by default. That could be a pain if you program "phones home". Or even when your program tries to get to your websites order page. I know that Zone Alarm often pops up when programs are trying to get their order page.. but I haven't installed SP2, so I don't know if it will do the same kind of thing.

I'm really glad that the firewall exists and it's one of the SP2 changes that I don't think is too drastic. Poeple have been using personal firewall products for years now so applications should already be taking this into account. I also don't see a reason to feel sorry for applications that no longer can use the internet without the user knowing.

[Andy]

I suppose the theme of this thread is very important for all indies. Don't know why it appears in Game development than it probably should be in the Business section.

Anyway, guys, look on your opinions. All of them are just guesses. Guesses from the developers. The question is how our prospects will react on that new alert dialogs. And that's really where I'd like to know more concrete data. How to collect them? - that's most important issue for us on current stage. And I don't see the future in such a rainbow colors like some of guys from here - SP2 would be installed everywhere, peoples will be reading that alerts - what would be their reaction (I don't install most ActiveX components when alerted - for example) and what to do?

Thanks for reading,
And thanks for your opinions,

[Nemesis]

As mentioned earlier by David, the dialog is on the same lines as the "Some files could hard your computer...". Microsoft have gone one step further (for the sake of security) by integrating a software certificate service.

As I see it, getting the certificate gives an indie the opportunity to bypass the distracting dialog or at least reassure the customer that the software is truly safe. Obviously we all know that no system is 100% safe and many developers will be loath to purchase certification.

Anyway, this shows that you can never please everyone: more security == less convenience.

I'd say don't bother too much with it. If you can afford certification, go get it and that's it. I like to think that most computer users have a working organ between their ears, called a brain, that will let them decide what is safe and what's not.

[Air]

I doubt it will matter much.

When was the last time you ever noticed, or had a user ask about, this message that comes up when you click on a download link:

"Some files can harm your computer. If the file below looks suspicious, or you do not fully trust the source, do not open or save this file."

For the record, a handful my computer-illiterate relatives & friends-relatives have called me numerous times to do just that-- ask me if it was ok to download/install some program/driver/etc. :) My dad gets it a lot with his job to (computer warranty repair). Amusingly the same people will readily adhere to the "instructions" to safe-guard their computers that they recieve via pop-ups and Windows Messaging (the thing in Win2k intended for business lans that was removed in XP). Sort of ironic eh?

But on a side note, most of them (as I have mentioned before) are chronic game players and have spent perhaps a couple hunded a piece of game and other internet softwares. So when I look at them I see a very active customer base with high potential.

- Air

[Fost]

So, back to my original question: does anyone have any recomendations for digital certificate vendors? Cheapest code signing cert I've found so far is £66 (UK pounds)

[Nutter2000]

So, back to my original question: does anyone have any recomendations for digital certificate vendors? Cheapest code signing cert I've found so far is £66 (UK pounds)
which one is that?

[princec]

Hey Fost, who does certs. for that price? I've got to get my Java stuff signed (we've had to put up with scary security cert warnings for years in Javaland).

To all the moaners in here - just get your code signed, grin and bear it. It shows you're serious and considerably more trustworthy. You wouldn't want some dodgy site to hack your Plimware wrapped game and have it divert all the money to their account now would you? This is no more or less sensible than SSL for http communications. It's about trust. Don't complain.

Cas :)

[Nutter2000]

To all the moaners in here - just get your code signed, grin and bear it. It shows you're serious and considerably more trustworthy. You wouldn't want some dodgy site to hack your Plimware wrapped game and have it divert all the money to their account now would you? This is no more or less sensible than SSL for http communications. It's about trust. Don't complain.
I agree with Cas here, it's simply something that will benefit all of us in the long run anyway.

However, most people here appear to be using shareware-specific payment processors/online publishers surely this is a service you should be lobbying them for?

[tentons]

It's a little uncanny that this thread (http://forums.indiegamer.com/showthread.php?t=391) just started, also. Is this a hint of bigger things to come in the future in terms of who controls your computer--and, by extension, your business? It's "harmless" and "sensible" now, but it's also conditioning for what's coming.

Viruses/malware are the Terrorism of computing. Think before you take the leap.

[Coyote]

Hey Fost, who does certs. for that price? I've got to get my Java stuff signed (we've had to put up with scary security cert warnings for years in Javaland).

Do you get a discount for re-signing it each time you release an update?

[Valen]

Viruses/malware are the Terrorism of computing.
It would be nice if terrorism could be wiped out with an Anti-Virus program. :) Seems to me like the real solution is to ship auto updating anti-virus software with Windows, rather than try to control what people run. Of course, that's not nearly as profitable as charging developers for useless certificates. :rolleyes:

[Greg Squire]

Do you get a discount for re-signing it each time you release an update?

(Someone correct me if I'm wrong here) My understanding is that you can package as many files as you want with your digital ID/certificate, using the tools they provide. I don't believe you have to buy a certificate for each file. Thus the $400 dollars can be spread across multiple products and updates.

[Fost]

Apologies to everyone, I should have posted the place I saw Authenticode certificates for £66 (for one year) or $99 (which is actually cheaper than £66 with the current awful exchange rate :( ). This was InstantSSL.com (http://www.instantssl.com/code-signing/code-signing.html?currency=GBP&region=United%20Kingdom&country=GB)

They don't seem to offer any java signing though for those who need it. (Might be wrong, but couldn't see it).

Wonder if they would do a bulk discount for a few of us....

[Mike Wiering]

(Someone correct me if I'm wrong here) My understanding is that you can package as many files as you want with your digital ID/certificate, using the tools they provide. I don't believe you have to buy a certificate for each file. Thus the $400 dollars can be spread across multiple products and updates. But after a year your certificate expires and you have to buy a new one, right?

[Greg Squire]

But after a year your certificate expires and you have to buy a new one, right?

Yes, there usually is an expiration date on them, usually one or two years. I'm not sure what the time period is on Verisign certificates.

[Nutter2000]

Apologies to everyone, I should have posted the place I saw Authenticode certificates for £66 (for one year) or $99 (which is actually cheaper than £66 with the current awful exchange rate :( ). This was InstantSSL.com (http://www.instantssl.com/code-signing/code-signing.html?currency=GBP&region=United%20Kingdom&country=GB)
cheers Fost


Wonder if they would do a bulk discount for a few of us....
That's not a bad idea actually, if need be we could probably organise an IndieGamer (or IndieGamerUK, IndieGamerUS, etc) certificate that can be sold cheaply to people on this board who match a certain criteria
I'm not trying to make it an elitist thing but such a scheme would certainly require some safeguards to stop virus writers, spammers, or possibly simply games we don't feel are quality enough to use the certificate.

on the other hand that goes back to what I was saying earlier, perhaps this is something that the online publishers should be lobbied to provide

[Redclaw]

Great... So if there's an old version of your game on the net somewhere and someone tries to install it, they'll get a WARNING - THE LICENSE HAS EXPIRED!! DO NOT TRUST THIS SOFTWARE!!! IT WILL KILL YOUR WHOLE FAMILY WHILE YOU SLEEP!!! type message.

Nice.

These licenses are themselves a fucking license to print money.

[Nutter2000]

Great... So if there's an old version of your game on the net somewhere and someone tries to install it, they'll get a WARNING - THE LICENSE HAS EXPIRED!! DO NOT TRUST THIS SOFTWARE!!! IT WILL KILL YOUR WHOLE FAMILY WHILE YOU SLEEP!!! type message.
Nice.
These licenses are themselves a fucking license to print money.
good point

Agreed, a license to print money (damn, now where can I get one of those!;) )

On the other hand, I would guess that the crypto key stays the same so long as you keep updating the license, which you probably would if you want to remain selling your software.

However, like DavidRM said, how quickly will the consumer become used to the warning and totally blase about it?
I suspect that, given human nature and the time it will take for software companies to get all their software digitally signed especially the smaller ones like us, not to mention all the software that's already out their and unsigned, that there will be a slight initial panic but people will very quickly become used to ignoring it.

[princec]

It is likely to eventually become the case that the default configuration of the OS will not allow users to run unsigned or broken or expired software. Hurrah for me with Webstart of course coz it's always 100% up to date ;) But I can see that the days of traditional downloadable .exes may be numbered.

M$ of course are pushing the same model as Webstart, with clientside .NET looming on the horizon to be the preferred deployment format on Win32 in the next decade.

Buy into it folks, it's not going to go away!

Cas :)

[cliffski]

I would NEVER buy an O/S that refused to le tme run unsigned exes. If they insist on that, ill stick with XP forever.
This is my PC, I own it, ill run anything I damn like on it as long as im not affceting others.
Anyone wanting $100 from me to verify I am not a virus writer can Fck Off!

[princec]

Keep your hair on! That's not what I said was going to happen. The default configuration will probably eventually be to automatically disallow unsigned code. It will have to be overrideable otherwise developers are going to have a pretty hard time writing code on their own machines aren't they?

Cas :)

[wazoo]

Hey our company (ie. day job) buys them from GeoTrust.

www.geotrust.com

On average they're cheaper than the cost of Verisign..

hth,

[fusionlab]

Nice scare tactics Microsoft - let's play on the fears of everyone who risks downloading a virus thanks to your leaky operating system. Hey, why fix the holes when you can make more money out of them!

This is majorly bad news. Gamers with little technical knowledge are going to hit the "no" button every time. If your target audience is mostly non-technical (eg mothers - sorry mum!) and/or you don't want to lose casual gamers then - reluctantly - I have to say this certificate is a must.

As others have pointed out, at least it means that these same customers will be less likely to download cracked versions of our games because they won't carry any certification.

And I'm sure you're right about future OS's, princec. Microsoft have seen how they can monopolise development on their Xbox console through encryption (no one can produce any unauthorised third party software for it). I guess they want to tighten the iron grip they already have on the PC and generate another lucrative revenue stream.

The future's bright (for Microsoft)...the future's digital rights.

[SyneRyder]

I think some people need to do more research before posting here. Your signing licence may expire each year, but the EXEs that you sign do not expire. There is no problem with old exes files expiring.

The point of the code signing is to verify the identity of the publisher and the integrity of the download. It's like PGP and MD5 for software. If the file download is tampered or altered, the customer will be notified. If you get a certificate, your downloads will show your company name, and any unsigned cracks of your software out there will show "Unknown Publisher". If you've ever had problems with customers who didn't realize they were running a crack, you'll see how this can be beneficial.

I'm with Cas, I think it's a good way to show you're trustworthy and it's best to get in on this early. Depending where you get your certificate from it's only $99 annually (I think Thawte is $200, Verisign $400) and you should be able to write it off as a business expense on your taxes.

PS Some of the top download sites are seeing an extremely rapid takeup of SP2. It's worth joining the ASP to learn the exact percentages just over the last two weeks. They've been talking about code signing in their newsgroups for some weeks too.

[tentons]

This article (http://www.gnu.org/philosophy/can-you-trust.html) is about TCPA, but it potentially affects anyone publishing software. Digitally signing is, in most cases, good for developers. But with added security, you're going to lose freedom.

The question is how much you're willing to tolerate and how far they will push, little by little. Before you know it you don't have control of your software or business anymore unless you pay what they want you to pay and use their software for deployment and deploy only at their authorized locations and follow their rules about content, etc etc etc.

Where does it stop? That's the bigger issue, IMHO.

[Hamumu]

Wow, it's like a cross between the digital mafia demanding protection money, and John Ashcroft selling off your freedoms for supposed security and a nice colorful chart. Only with Microsoft shoved in there somewhere to crank the evil quotient up about 90%. I'm getting so tired of being in a business that is intimately intertwined with the biggest corporations on Earth. But I have no energy to fight matters like this when there's so much else going on. I'm pretty sure that was a large part of the plan. Hmm.

[Valen]

I would NEVER buy an O/S that refused to le tme run unsigned exes. If they insist on that, ill stick with XP forever.

That's highly unlikely, and even if it happens it'll be something you can turn off as Cas said. Personally, I'm still using Windows 2000 because I can't think of any good reasons to install XP (I actually have an XP CD lying around). A few years ago I told a friend that the next OS I'll be upgrading to will probably be a flavor of Linux. With the way things are going, I will probably end up with Linux as my main OS and Windows for compiling, testing, and playing some games. :) A lot of the programs I use right now are Linux based anyway (Mozilla, Open Office, Gaim). Still, I don't see Windows 2000 becoming obsolete for many years as far as software compatibility goes.

[GameStudioD]

Will digital signatures kill freeware and open source development projects? A freeware author wont want to spend 100-400 $ on a digital sig. Its just not worth it. And if the sigs were to come down in price, they would become meaningless.

This really means, people will find work arounds to render this system useless.

[Mark Sheeky]

More importantly, how long before sig's are hacked and viruses look perfectly friendly and good software looks viral. Give it a week? or just a few hours? The clock is ticking... I'm sure some hacker in some dark corner somewhere is working on a sig-crack right this minute.

How does Verisign distinguish between a hacker and a genuine user, or a geniune user that eventually becomes a hacker? What if the signature tool or whatever it is gets stolen or something? Perhaps I don't understand the process but if it's possible to sign genuine software then it's possible to sign software that causes damage, right?

Anyone got a Microsoft email address we can bombard/lobby until they remove this feature?

Mark

[Andy]

I'm sure some hacker in some dark corner somewhere is working on a sig-crack right this minute.Mark

Sure... They are in a partnership with Microsoft in this business really. :mad:
... to grab our money... (was so :mad: - forgot to finish the message)

[EpicBoy]

With the way things are going, I will probably end up with Linux as my main OS and Windows for compiling, testing, and playing some games.
I'm confused as to how Linux would be your main OS then. :)

[Valen]

Will digital signatures kill freeware and open source development projects? A freeware author wont want to spend 100-400 $ on a digital sig. Its just not worth it.

Since the only thing that scares the shit out of Microsoft is open source and free software, it's quite plausible that this is another attempt by MS to destroy them.


I'm confused as to how Linux would be your main OS then. :)

Well the only things I'd need Windows for would be to compile my game and test it, and to play games. I can do all the development in Linux because I use SDL, and other than that I only use cross platform LGPL libraries. I also use PHP and MySQL for web development. Microsoft hates people like me. :) Other than games, there's nothing I'd need for which an alternative doesn't exist in the Linux world. For now though I'm fine with Win2K.

[EpicBoy]

Microsoft hates people like me.
Not really. You DO have a copy of Windows. Heh...

[Fost]

It is obviously a worry in many respects because of the potential power that could be wielded. You can already elect not to run any unsigned activex and .net downloads in XP SP2 and I suspect exes will be next, but it is not the default setting.

I'm sure certificates will come down in price, but this does not undervalue them - at least no more than they already are. Some people seem to think that having a certificate is a way to validate that you a trustworthy company - it isn't. A certificate is there to validate who you are, and that the download you are providing has not been tampered with by any third party.

Remember, people like the GATOR corporation already have a certificate (how many times have you been to a website and a popup has asked if you want to trust the GATOR corporation? - that's certificates in action.) - all it does is let you know that the download has come from them and that no one else has tampered with it. The fact that it will install spyware all over your machine is irrelevant.

I agree that it's stupid; only because 99% of users don't have a clue what any of it is or how it can help them, how should they know whether to trust Moonpod or GATOR? We'll just have to live with it though.

[Raptisoft]

This really means, people will find work arounds to render this system useless.

Well, now that everyone *has* to have a certificate, I think you'll find that a lot of certificate startups will come out. There's money to be made there, which means competiton, which is good.

Look forward to $25 certificates in the next couple years. :)

The only reason Verisign etc can charge so much is that not many people want them.

[Valkilos]

I was originally going to make an absurdly long-winded post about how much I hate this. Instead, I'll summarize:

BLAAARGABRBLE!!!!

Windows Pop-up: "This program was written by someone who has not given us money. It will therefore devour your soul, physically remove any reproductive organs you may have, and then proceed to destroy everything and everyone you hold dear. Have a nice day."

I mean, I understand that there will be barriers to entry in any given field when you're trying to start up a business - it's to be expected. But as it stands right now, they're essentially making it difficult for anyone to write commercially available software for their OS without giving them money (well, without giving money to someone who gives them money, anyway). Add in the fact that this could theoretically give them the power to deny authentication to companies for whatever reason and... I mean, really, if I wanted to put up with this, I'd have been developing for consoles.

To re-iterate: BLAAARGABRBLE!!!!

[oNyx]

>Look forward to $25 certificates in the next couple years. :)

Once upon a time there were $20 certs. They were good enough for signing applets for example.

However, they don't exist anymore. They ceased to exist about 4-5 years ago, because everyone and his dog just used the cheap certs... :rolleyes:

[Nutter2000]

I'll summarize:
BLAAARGABRBLE!!!!
Indeed


Windows Pop-up: "This program was written by someone who has not given us money. It will therefore devour your soul, physically remove any reproductive organs you may have, and then proceed to destroy everything and everyone you hold dear. Have a nice day."I thought most of that was in the standard Microsoft EULA? :D


I mean, I understand that there will be barriers to entry in any given field when you're trying to start up a business - it's to be expected. But as it stands right now, they're essentially making it difficult for anyone to write commercially available software for their OS without giving them money (well, without giving money to someone who gives them money, anyway). Add in the fact that this could theoretically give them the power to deny authentication to companies for whatever reason and... I mean, really, if I wanted to put up with this, I'd have been developing for consoles.I suspect, not so much in my infinite wisdom but in my general experience of human nature, that it won't be too long before there is an acceptable, or at least half-finished ;), open source initiative as a good alternative. There's already PGP for mail security.

Plus if Microsoft tried to set itself up as judge and jury on acceptable programs using the certificates then they will be playing straight into the hands of the governments trying to break their monopoly, so I suspect they won't go that route, but I do agree it has reaching implications and it appears to give power over our software to Microsoft.

Personally, I'm not too bothered about it, people are already paranoid enough about downloading things off the Net and paying a small fee to digitally sign your app to ease their fears is well worth it in my opinion. That is so long the system remains secure and Microsoft don't abuse their position.


To re-iterate: BLAAARGABRBLE!!!!4 exclamation marks! surely the sign of an insane mind :p

[tentons]

...I do agree it has reaching implications and it appears to give power over our software to Microsoft.

Way more than that.

It will give power to governments over how your software behaves--and the way you use your software. Maybe I'm paranoid, but if you don't see how this eventually could lead to control over how you behave, it's right there just on the edge of the shadows staring back at you.

[Air]

Here's an analogy I don't think anyone has mentioned yet:

Maybe it'll just fly over about the same as that whole "digital signing" for your video&soundcard drivers, introduced in Windows 2000. A quick check of my system reveals that none of the drivers I'm using have an official digital signature. In fact I can hardly think of an driver I've ever installed that didn't give me a digital signature warning, outside the drivers that came with my Win2k CD. I've never used WinXP though-- is the digital sig warning when installing/updating drivers as visible and intrusive as it is in Win2k? If so, how many people have become completely jaded to even paying one bit of attention to that warning, computer literate and illiterate alike? And has it given power to Microsoft over what drivers people do and do not use?

There's other examples of this sort of behavior all over corporate america too, and not just in computers. That ADA label on the bottom side of your toothpaste-- you think Crest gets to stick that little label there for free? :)

The real shame of it is that desktop computers are becomming such a corporate device all-around. Eventually we'll all forget the neat hobbiest freedoms we once enjoyed, and the entire industry will be muddled in legalities, fees, and half-dozen other things that most of the end-users will be completely unaware of, because none of it serves any purpose other than to transfer sums of money from one person/place to another, and back again. The end user will pay a gretuitous sum of money for the product, at which point most of the money is transferred to a dozen "invested parties" who's only jobs are to ensure that people think they're important somehow-- and about 4% will go to the actual programmers and hardware manufacturers (who will all live in India).

Ah the consequences of progress.

[Mithril Studios]

but if you don't see how this eventually could lead to control over how you behave

Like being able to buy and sell anything?

Like what this company (http://www.adsx.com/news/adsxpressreleases.html) is making?

Like what Revelation 13:16-18 describes would happen?


Anthony

[Greg Squire]

Like being able to buy and sell anything?

Like what this company (http://www.adsx.com/news/adsxpressreleases.html) is making?

Like what Revelation 13:16-18 describes would happen?


Anthony

Yep, it sounds beastly. :D

[begin rant]
In a limited fashion this is happening with credit cards. Ever been in a store that wouldn't take checks? I have; they only accepted cash and credit cards. Also, some online businesses only accept credit cards as payment.

Again, our lives are increasingly being controlled by hands of a few. A trend that I don't care for, and wish would stop. Our freedoms are being slowly stripped away, all in the name of "security". Boy that makes me feel “secure”. [end rant]

[EpicBoy]

Not accepting checks has more to do with "not getting screwed" than "controlling customers".

[Greg Squire]

Not accepting checks has more to do with "not getting screwed" than "controlling customers".

I agree. Again, it's a security issue. The retailer feels safer (and maybe is safer), by not accepting checks at all.

[Bluecat]

Yep, it sounds beastly. :D

[begin rant]
In a limited fashion this is happening with credit cards. Ever been in a store that wouldn't take checks? I have; they only accepted cash and credit cards. Also, some online businesses only accept credit cards as payment.
...[end rant]
You Americans! :p Ever been in a store that doesn't accept cheques... I doubt if many stores in Australia accept cheques any more. It's all credit or cash. You can pay most of your bills electronically. As I understand it Australians are using cheques less and less, and from what I understand, don't particularly care.

cheers

[Valen]

Why would anyone want to use checks instead of a credit card?? Maybe it's just me, but if I could pay for everything with a credit card, I would. I pay half my bills with my credit card. I would pay them all if I could. It's a lot easier to just *click* and transfer the money from your checking account to the CC issuing bank, rather than write 100 checks. There's also more liability protection for you not just the vendor. I think eventually there won't be any paper money, and everything will be paid for using something resembling a credit card. I just hope I live to see that day. :)

[Mickey Crocker]

I think people are giving into this SP2 thing too easily and I don't see it as big of a concern as most people here seem to. After all we're Indies, no need to act as if this change is going to effect us by the millions just yet.

I believe (like some have already noted) that the general public will become numb to these little download warnings and begin to ignore them. I also believe instead of jumping on the bandwagon of forking over money to these corporate companies (like they want us to do), so they can tell our customers that we are trustworthy, why don't we show our customers ourselves?

Why not begin your own “Trusted Download” plan for your company? The rough idea I have come up with is to add "Trusted Download" image (icon) on your download page and have another page documenting your safe and secure company. This could give facts in point form that declare that the selected download does not contain any spyware, viruses, and has never been handled by a third-party. It may not seem like much, but it's a step in fighting back. You could have a standard "Trusted Download" image designed for your company. Place this image by the downloads of all of your software and when consumers click the image, you could have a list of why you can be trusted, why your download is trustworthy. Make your customers feel safe with your company, and they will be sure to make the download, and ignore Microsoft's little warning.

Just my two cents...

[Mark Sheeky]

I think people are giving into this SP2 thing too easily and I don't see it as big of a concern as most people here seem to.

I think you're right. I've been told that the warning only appears on the highest security setting in which case it's reasonable because if you want a high level of security then an 'are you sure' warning is understandable.

Mark

[Mike Boeh]

Here is what the user will see if the download is unsigned:
http://www.retro64.com/bf2222/warning.png

Here is what the user will see if it's signed:
http://www.retro64.com/bf2222/signed.png

MS isn't out there trying to make money with this- to my knowledge, they do not own any of the certificate providers. Effective or not, they are trying to make their OS safer for consumers. At 90$/year from comodo (2 years purchase), I think it's within any indie's reach to pay for it.

[Mike Boeh]

As a side note, if you do not have a phone number in the name of your business, thawte requires a notarized letter sent to them on your behalf.... Comodo doesn't have this requirement, and the user experience is identical. And Comodo is by far the least expensive. So if you do decide to code sign your executables, it kind of makes it an easy decision :)

[tentons]

I agree. Again, it's a security issue. The retailer feels safer (and maybe is safer), by not accepting checks at all.

It's only a security issue if you over-simplify it and choose not to look at the big picture--just what they hope you'll do. All of these changes are in the name of wealth under the guise of security. The problem is that this doesn't mean it will be used scrupulously or it will be limited to the initial intent. It's almost guaranteed to become abused.

The problem is that little by little we're being manipulated into being controlled by some very powerful entities that do not have the best interests of "the whole" on their minds. "It's just one little change." But then it's another, and another, and another, and another. "Group X in that industry has been doing it for years." And now this industry. And next that industry. And then all industries.

This is unprecedented in history, and it's not just a security issue. It could easily affect all of our businesses, and that will definitely impact our lives. I for one do not want to hand over my profits just because some gigantic corporation is selling a security feature that they claim will protect me from myself. It's been agreed that signing an exe proves nothing about the content of the exe other than that someone paid money to have it signed. What it does is of no concern to the "certifying authority" who took that money.

I personally like the idea of paying with plastic for convenience (I use a bank card a lot), but there are some very grisly risks that are neither "paranoid" nor "science fiction" anymore. Caveat emptor, indeed.

[tentons]

Like what this company (http://www.adsx.com/news/adsxpressreleases.html) is making?

Like what Revelation 13:16-18 describes would happen?

I don't subscribe to any religion, but this isn't something to brush off as novelty or conspiracy.

It starts with pets (http://130.212.44.5/storys01.php?storyid=6627), then it's kids. Those kids' kids won't think twice about a chip. At that point, it's the whole population.

All in the name of what? Say it with me: Security! "My kid is safe because I can always find him if he's kidnapped." Yeah, and who else can always find him when he's just playing in his room? Don't count on these technologies being used in limited ways.

Similarly, signed exe's is just a beginning for software.

[Aldacron]

Why would anyone want to use checks instead of a credit card??

* some people don't own a credit card (for whatever reason)
* some people don't want to pay interest on everything they purchase
* some people don't charge beyond an arbitrary minimum per month
* some people still don't trust in the security of online transactions
* I could probably think of more if I try

I do not own a credit card. My circumstances make it very difficult to get one without jumping through hoops (long story short: I'm a US citizen working for a Korean company in Korea, non-US resident, no record of income for the past several years). My wife had six credit cards when we first got married five years ago. I'm still paying those off. Korean card companies have no minimum payments. You are expected to pay the full amount each month (though you can prorate a charge over several months at the time of purchase - but several of those together really adds up). Failure to pay the full amount each month causes interest to be added, and interest is rather steep. It's insane. And the Koreans are wondering why so many card companies are having financial troubles.

I can only shop online at shops which accept cashier's checks (since there's no such thing as a checking account in Korea). I can't enter any free trials for any sort of online subscription, since they all require a credit card. There have been several instances where I was ready to buy something, but a credit card was required. In most cases, I see it as a lost sale for the store and don't think twice about. But when it's something I'm really keen on having, then my blood boils and I send off a scathing email to remind the business that not everyone in the world owns a credit card. To no avail of course.

And even if I could easily get a card, I'm not sure if I would. I don't like paying extra for the convenience of having it.

[Rainer Deyke]

Er, why would would anybody not pay the full amount on their credit card each month? To me, that's just stupid. If I can't afford to pay for something, I can't afford to buy it.

Here in the US it's actually cheaper to pay with credit card than it is to pay with cash. Credit cards are usually free, sometimes give you cashback, and always allow you pay one month after your actual purchase, which means your money can accumulate interest on your savings account longer.

[Valen]

It's been agreed that signing an exe proves nothing about the content of the exe other than that someone paid money to have it signed. What it does is of no concern to the "certifying authority" who took that money.

To be fair, the certificate does prove one useful thing -- that the EXE hasn't been tampered with. It basically says "this EXE was made by Someone's Company Inc. and has not been messed with by anyone else. You can feel safe running it if you trust Someone's Company Inc." Though I do agree that this doesn't automatically make the software itself safe, it does at least gaurantee that the EXE won't have a trojan or virus attached to it if the certificate holder is trustworthy. Assuming that the user knows who Someone's Company Inc. is (most of the time it should be the site they downloaded it from), they should be able to decide if it's safe to run. Of course, if the EXE came right from the company's site it should be safe anyway, so I think this system is of limited usefulness. Considering that you can get a certificate for $100 a year though, it's not the end of the world.


* some people don't own a credit card (for whatever reason)
* some people don't want to pay interest on everything they purchase
* some people don't charge beyond an arbitrary minimum per month
* some people still don't trust in the security of online transactions
* I could probably think of more if I try

And even if I could easily get a card, I'm not sure if I would. I don't like paying extra for the convenience of having it.

I apologize for making such a broad reaching statement. My opinion is based purely on the way credit cards are handled in the US. Based on what you're saying, things are very different in Korea. Here in the US there's no charge for having a credit card (except for American Express which has a yearly fee). There's also no minimum amount you have to buy per month, you can have a $0 balance. You don't have to pay the full balance every month, but in the 5 years that I've had a credit card I've always paid it in full. Interest rates on credit cards here are probably not much lower than what you have in Korea though, they can range from 15% to 25%. I can see why it wouldn't be convenient for you, but for those people living in the US I don't see any good reasons not to use them.

[Nutter2000]

Way more than that.
It will give power to governments over how your software behaves--and the way you use your software. Maybe I'm paranoid, but if you don't see how this eventually could lead to control over how you behave, it's right there just on the edge of the shadows staring back at you.
To be quite honest with you mate, if you don't think that our governments don't already have that power and have already used it many times in the past then I think you must have seriously had your head in the sand.

The point I'm trying to make is that this an attempt by Microsoft to improve security over the internet. They have a vested interest making their product as user-friendly and above all SAFE for the average user, who I'm afraid to say, don't particularly know sh!t about computers.

We've all see pirated software, even some of our own games, and it annoys the hell out us because we can't do anything about it, we see spyware and trojan/virus embedded applications on the internet trying to catch the unwary, this is a good solution to the problem of content on the internet.

Our governments, certainly the UK and US, have finally woken up to the fact that there's a lot of dangerous stuff on the net that affects the average "voter" but, like most dinosaurs-like official bodies, once they're threatened they're liable to go on a rampage, the last thing any of us want is state content controlled internet like they have in China and I've certainly seen that suggested by various UK MPs/US Senators in the past!

This is a reasonable solution to a tricky problem, yes it could ultimately be abused by various entities in power but so can pretty much every law ever passed.
In my opinion, what we should do is become involved as best we can so that we have a recognised voice should the powers that be try and abuse the system.
Even better why don't we all band together and come up with a system, like that Trusted Download Plan idea, which is regulated by us as a community, if we can get it recognised as being trustworthy than those who feel MS approved certificates are a bad thing have an alternative.

If we fight against this then what perception are our customers going to have? They'll mentally put us in the same group as virus writers, spyware makers, etc, and that we don't want.[/RANT]


I think you're right. I've been told that the warning only appears on the highest security setting in which case it's reasonable because if you want a high level of security then an 'are you sure' warning is understandable.
I'm on medium level and it's automatically set on mine.
Either way to be honest, SP2 sets it to warn as default so it's something that general populus won't realise they can't turn off.

[princec]

Apologies to everyone, I should have posted the place I saw Authenticode certificates for £66 (for one year) or $99 (which is actually cheaper than £66 with the current awful exchange rate :( ). This was InstantSSL.com (http://www.instantssl.com/code-signing/code-signing.html?currency=GBP&region=United%20Kingdom&country=GB)

They don't seem to offer any java signing though for those who need it. (Might be wrong, but couldn't see it).

Wonder if they would do a bulk discount for a few of us....

I just contacted them; the certs work for Java too. So I'll be signing my stuff today.

Cas :)

[EpicBoy]

Er, why would would anybody not pay the full amount on their credit card each month? To me, that's just stupid. If I can't afford to pay for something, I can't afford to buy it.
What about the crazy and totally unrealistic situation where you have to buy something like a plane ticket for something as ludicrous as say, a family emergency? You can't afford that ticket, but you have to buy it.

[Raptisoft]

Here's an advantage:

Hacker cracks your program.
Hacker posts it on the net.
WinSP2 says "Whoa there! This is an unsigned executable, it could contain trojans or viruses!"

That oughta be good to scare off a couple hundred thieves a year.

Certs are fairly cheap, but I think it *would* be good to set up Indie starter certificates. ASP or otherwise could probably set up a program. Until you make $5000, you can use the indie cert, after that you gotta buy your own, hm?

If we all get signed, eventually people will stop taking cracks and hacks because they're unsigned.

[Fost]

At 90$/year from comodo (2 years purchase), I think it's within any indie's reach to pay for it.
Do you have a link to where you can purchase their code signing certificates? I can only seem to find SSL certs on their site...

EDIT - scratch that, instantSSL who I already mentioned myself are resellers for Comodo at that price (missed the /year bit :rolleyes: )

[Valen]

Do you have a link to where you can purchase their code signing certificates? I can only seem to find SSL certs on their site...

Here's a direct link https://secure.comodo.net/products/CodeSigningSignup1a?SID=Gb0hhrC19S4HmyEk&product=8&days=

You can get there from instantssl.com which appears to be owned by Comodo.

[Mike Boeh]

I believe instantssl isn't a comodo reseller, but rather is comodo itself...

I signed all our games, but I am unable to find a timestamp url for comodo- which isn't a big deal, but it would be nice to have. They mention timestamping in their faq, has anyone found that url?

[Adrian Lopez]

This thread has inspired me to write about SP2's code-verification features. I'm just getting started, but here are the key points I'd like to discuss:

The digital signature infrastructure is controlled by the few corporations with the power to hand out valid code-signing certificates. This means a small group of companies have final say over certificate granting, renewal and revocation policies. The potential for abuse is significant, as it gives them indirect control over software distribution policies.
Digital signatures are expensive (as in yearly subscription fees), making Indie and Open-Source development more difficult (if you care about signatures).
Signatures do not provide security (trusted != trustworthy), they only provide for proof of identity and proof that the code wasn't tampered with after the publisher signed it (if the publisher doesn't know the code is infected with a virus he'll release an infected program with a perfectly valid signature). Signatures may also provide for some added degree of accountability by forcing publishers to identify themselves.
Requiring digital signatures may seem like a reasonable compromise for code which executes automatically, but it's better to have a platform that is truly secure in the first place. A platform is only secure if a program, once it's running, cannot do a whole lot of damage without the user taking steps to allow it. In this regard UNIX is a secure platform by design, but Windows is not. Likewise, Java is secure by design, but ActiveX is not.
Code verification in SP2 applies only to code downloaded from the internet. Code shared through CD-R's may be tampered with or infected with viruses, but Windows won't warn about that.
For code that is manually executed, the benefits are rather questionable:
The publisher's identity is usually known by the context of the download (assuming you're downloading from a well-known, trusted site).
In-transit tampering is rare.
Local tampering (a common vector for virus attacks) can be remedied through the use of unix-like permissions.
Social engineering attacks are still possible with SP2. The hacker may tell you to run the program from a floppy, or else he may tell you to run it through the command line interface. Neither of these methods will produce a warning in SP2.

Agree or disagree? Any ideas?

PS - Fost: May I use your screenshot of SP2's warning dialog in my article? I don't have SP2 so I need to use somebody else's screenshot.

[Fost]

The digital signature infrastructure is controlled by the few corporations with the power to hand out valid code-signing certificates. This means a small group of companies have final say over certificate granting, renewal and revocation policies. The potential for abuse is significant, as it gives them indirect control over software distribution policies.

That all sounds very 'big brother', and we aren't anywhere near that right now. Future Windows Os's might start to ramp this up to the point where all code has to be signed (to prove it's origin). It sounds awful, and fundamentally, I don't want people telling me what I can and can't run on my computer, but it's hard to think of legitimate cases where that would be a problem, except with legacy code that is unsigned.



Signatures do not provide security (trusted != trustworthy), they
This is a good point, and in fact this is the point of digitally signing an app - to prove who you are. I don't think most end users understand a thing a bout them though (in fact, let's face it, most of us developers don't!), and just see it as some seal of approval, or trust.


it's better to have a platform that is truly secure in the first place. A platform is only secure if a program, once it's running, cannot do a whole lot of damage without the user taking steps to allow it. In this regard UNIX is a secure platform by design, but Windows is not. Likewise, Java is secure by design, but ActiveX is not.
Yeah, but:fundamentally it's better to have a platform on which people are prepared to pay for your games in large quantities. That platform is not Linux (currently). It's easy to forget that your average user doesn't actually know what linux even is (and hasn't heard of Slashdot)


For code that is manually executed, the benefits are rather questionable:
The publisher's identity is usually known by the context of the download (assuming you're downloading from a well-known, trusted site).

Specifically in the case of shareware, many of the downloads come from shareware download sites. They may end up being downloaded directly from the publishers site still, but the initial download link is offsite and so could be to anywhere.


PS - Fost: May I use your screenshot of SP2's warning dialog in my article?
Of course!

[tentons]

That all sounds very 'big brother', and we aren't anywhere near that right now.

I won't get started on that rant, but my concern is that it just leads to more control. I'm not saying signing is bad or that in and of itself gives anybody too much control. But maybe it's paving the way for something more.

They told us that cameras on the highway were just for traffic, but now they want to use them with face recognition to look for terrorists and other criminals. What's next?

[Adrian Lopez]

I agree that the signature verification features in SP2 do not currently facilitate the kind of abuse I was hinting at (after all, users still have the option to run unsigned code if they want to), but my concern is more with the potential for abuse than what's actually happening at any particular point in time. The argument has more to do with code-signing as a concept than its particular implementation in SP2. The same code-signing infrastructure that is currently used to provide confidence could someday be used to gain control over code distribution by ensuring that only signed code is allowed to run.

[Mickey Crocker]

I have a few questions about indie businesses and digitally signing...

1) If I plan on selling software online, must I pay to start up a legit business in order to legally do this? (in Canada).

2) If I want to digitally sign my software, must I purchase a commercial ID Certificate? Or can I get an individual cert? (i've looked for answers on this, but couldn't find any.)

3) When you sign up for a ID Cert, can you use the same one for every game that you make? Or must you purchase unique IDs for each?

The reason I asked this is because I want to keep this "business" as close to being a hobbie as possible. I have a full time job that I plan to keep, and do this on the side. So, i'd like to make money from the work that I do, without the worry of my business going bankrupt, is this possible?

...I'll talk to a lawyer when the time comes on these subjects, but just looking for some of your insights. Thanks.

[keethrus]

I signed all our games, but I am unable to find a timestamp url for comodo- which isn't a big deal, but it would be nice to have. They mention timestamping in their faq, has anyone found that url?

http://timestamp.comodoca.com/authenticode

I just successfully signed and timestamped the installer of a commerical app I'm creating. It went really smoothly! I found a "Digital Signing Wizard", GUI not console, which did everything for me. I'd be happy to share the link to it on Microsoft if anyone wanted it.

- Jeremiah

[Mike Boeh]

Yeah, they hadn't rolled it out yet when I posted that. But after emailing them, I got the goods! :-) Unlike the experience of Cas, I was really impressed with their quick and helpful support too!

[princec]

Yeah, they were quick all right, just not competent enough to help out :(

Cas :)

[Mike Boeh]

Maybe they just hate Java! :D

[Sillysoft]

Maybe they just hate Java! :D It's entirely possible. I don't think thwarting java users is a great business move though.

I am not using any certificate at the moment. I will reconsider the situation in a little while from now and decide whether I should get one or not.

[keethrus]

Anybody know how to get WinXP SP2 to show your application's icon when it popups the download warning? I've gotten my installer signed and it works, but it shows the default application icon instead of the installer's icon. Any ideas?

- Jeremiah

[xelanoimis]

What about "free software" ?

Indie games include free games and people are creating those to be freely distributed to anyone.
It's not normal to be asked to pay 100$ or more (some people do not gain that much in a whole month) just for being able to offer your software for free.
Imposing such a signing mechanism is a move against free software.

What is the choice of a free game developer?

1. To pay 100$ out of his poket and sign his software,
if he realy wants his game to reach the people, like any other comercial product.

2. To not pay and not sign his game, reducing the number of people playing it.
Consider that in the future this number might hit absolute 0,
depending on the "security" measures of the future operating systems.

3. To totally give up creating free games.

Then you will be wondering why there are only crappy games to play, like most cases in the consoles market today. It will be because only good selling games will be published (to cover all those stupid additional costs). And good selling doesn't mean good gaming!
Why all the published adventure games reduced their number so much, being almost unexistent on consoles. Check the free game adventure comunities and see where they all went. ( http://www.adventuregamestudio.co.uk ).

So, I'm not saying that the idea of signing your software and the idea of security are bad things.
I just say that, in it's current form, it proves to be a move against free software.

The solution to this would be very simple:
SIGN FREE SOFTWARE FOR FREE !

... but I doubt any company like Microsoft would have such intentions.

Thanks!

[Fabio]

Well, to make it plain simple, Microsoft and the devil differ only by name.

Read this, for example:
http://www.windowsbbs.com/showthread.php?t=2519

[Savant]

Strap on those tinfoil hats kids, it's going to be a bumpy ride!

[Indiepath]

Yeah, they were quick all right, just not competent enough to help out :(

Cas :)
I had similar issues with thier support, they are not consistant and tend to go around in circles. Try asking them how do sign a .xpi file (that's a Firefox plugin), go on I dare you :)

[tentons]

Strap on those tinfoil hats kids, it's going to be a bumpy ride!
I guess you didn't hear about the domestic spying program in America. Not that there's a connection or it proves anything, just that a backdoor in Windows may not be reason to don the foil in light of current facts. It's healthy to be skeptical of multi-billion dollar corporations known to have ignored/invaded users' privacy in the past.

Related: http://news.com.com/Microsoft+Vista+wont+get+a+backdoor/2100-1016_3-6046016.html?tag=nefd.top

[Gary Preston]

Personally I see this been no different from signing emails with GPG to prove who it came from and that it hasn't been modified.

Many people also use GPG to sign software so that mirrors can host the installers whilst end users can still be certain the software hasn't been tampered with by any of the hosting mirrors (or that the website hasn't been cracked and the files replaced with modified version).

The only reason I think companies will choose certs over gpg is that with cert signing, the root certs are already a part of the various users machines. With gpg you need to build your own web of trust. Thats not to say you couldn't create signing authorities for gpg and have thier keys pre intstalled on users machines. But the moment you did, you'd have the same situation we have with ssl certs, the cost assosiated with running those few signing authorities.

I don't see anything wrong with signing bringing up warnings. So long as there is always the option to still install unsigned programs much as we have the option to still install unsigned activex controls or plugins.