search

ReconfigureIO / reco

A command line tool for interacting with Reconfigure.io services
Apache License 2.0
6 stars 3 forks source link

reco installer .exe unsigned causing scary Windows Defender popup #38

Closed rosieyohannan closed 6 years ago

rosieyohannan commented 6 years ago

The .exe needs to be signed to prevent this

pwaller commented 6 years ago

Code signing looks straightforward:

https://blogs.msdn.microsoft.com/ieinternals/2011/03/22/everything-you-need-to-know-about-authenticode-code-signing/

  1. Acquire code signing certificate.
  2. Sign it on a windows box using signtool.

It's unclear to me whether this will actually eliminate the dialog, or if it will simply make it say Publisher: Reconfigure.io. I think the dialog might be something you will get in general the first time you download something from the internet.

There is an additional thing to think about which is the key management. Where will the key live and how do we keep it safe? Ideally we might use a HSM so we don't have to worry about it.

With respect to prioritisation, I'm unclear on the current relative importance of this. Do we know how many windows users we are getting? In terms of the Go ecosystem, only 18% of users are on Windows, so the fraction of users inconvenienced by this might be fairly low compared to many other things we might work on.

screenshot from 2018-11-05 09-55-25

CampGareth commented 6 years ago

We have access monitoring on turned on for the S3 bucket with reco releases in it. That writes one file per access so we don't have overall stats for downloads per platform but could generate them. We also provide releases as artifacts on Github releases, querying their API shows 4 linux downloads and 0 for all other platforms.

pwaller commented 6 years ago

OK, I'm going to take a unilateral stance on this that it isn't worth the implementation effort at the moment.

I'm marking this as "Later", by which I mean, when we have hundreds of Windows users and a bit more manpower. I'm going to mark it closed to reduce our cognitive overhead when looking at the open issues list.