3/31/2026 at 4:27:37 PM
The heuristics powering this, as well as the Windows Defender whitelisting, are terrible.My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem. Users are not incentivized to use the program with the warning. But removing the warning requires many people to ignore the warning.
This is a big problem for anyone writing Windows software. An indie developer or small open source project is not going to do well with this.
by asveikau
3/31/2026 at 5:02:30 PM
>My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem.Given the recent npm axios compromise this sounds like a pretty smart move?
by gruez
3/31/2026 at 5:36:39 PM
How is it a smart move? Here, Microsoft is training users to ignore a security warning. If the same mechanism were added to NPM (that is, a warning that the package is suspicious and for the user to be extra sure they want it), users would have been trained to ignore any security warning issued for the compromised axios version (just like they had ignored it for all previous "clean" versions) and installed it anyway.by dqv
3/31/2026 at 7:30:03 PM
The relevant heuristic in NPM supply-chain compromises would be the age of the specific binary. i.e. a freshly released package is riskier than one that's been around for a few days. So perhaps the policy should be that NPM doesn't install new package versions unless they've been public for 24 hours, or there's a signed override from the package repository itself stating that the update fixes a security issue. Of course, that would also require the NPM team have a separate review process for signing urgent security fixes.by kmeisthax
3/31/2026 at 6:37:47 PM
This is also happening on linux for me.by whateverboat
3/31/2026 at 7:52:13 PM
Don't make statements like this without more explanation. In what way is this happening to you specifically? What distribution and platform are you using? Did you explicitly install something to warn you about 'side-loading' executables?by kencausey
3/31/2026 at 4:49:31 PM
Conveniently M$ lets you buy a signing certificate to fix this.https://stackoverflow.com/questions/48946680/how-to-avoid-th...
by Frotag
3/31/2026 at 5:17:14 PM
EV no longer skips smartscreen either nowadays. I understand that was abused, so it's treated as the same as OV. Having a certificate allows the cert itself to accumulate trust (rather than each binary independently doing so) and provides better UX and I suspect an initial small boost to trust signal, but doesn't bypass the initial distrust. There's no way to avoid that AFAICT and even if you're an established business you hit it at intervals because all these certificates expire and so the whole process resets every few years anyway. What a mess.by pimterry
3/31/2026 at 6:39:19 PM
> EV no longer skips smartscreen either nowadays. I understand that was abusedEV was always going to be abused. It started out promising to be a human verified, $10k cert that meant you were GUARANTEED to be who it said you were. Now I can get one for a couple hundred bucks.
The solution is to separate identity from encryption. They never should have been linked.
by burnte
3/31/2026 at 7:03:38 PM
> EV no longer skips smartscreen either nowadays.Not sure of the exact number, but the "nowadays" here is more than a decade.
by asveikau
3/31/2026 at 5:27:08 PM
>There's no way to avoid that AFAICT and even if you're an established business you hit it at intervals because all these certificates expire and so the whole process resets every few years anyway. What a mess.Maybe have overlapping sets of certificates and dual sign your binaries? That way there's always an "aged" certificate available.
by gruez
3/31/2026 at 4:51:52 PM
Last I checked they can still quarantine your binary if it's properly signed and they decided it hasn't gained traction.by asveikau