Hacker News new | past | comments | ask | show | jobs | submit login

They didn't do that for the Windows version though:

> Because we object to paying Microsoft for the privilege of allowing you to more easily use our work, this application is unsigned (more information here).




We will likely start doing Windows notarization during the 8.x series. Our friends at Harrison, who make Mixbus (based on Ardour) already figured it all out a long time ago; it's a bit more complex than the macOS version of the process.


The message is a little confused--Microsoft never charged for code signing. You don't pay Microsoft. You have to get a code signing certificate from a third party CA; you choose your favorite. Microsoft themselves doesn't offer them.

This is different than notarization. Notarization is a process by which Apple centrally scans your binary and decides if it's ok, then stamps their approval on the binary if so. Code signing is a process by which you sign your own binary so that users (and, more importantly, Windows) know it's from you.

Microsoft doesn't do notarization, instead relying on the reputation of the certificate and their client-side malware scanner. The reputation from one executable you sign with the certificate carries over to other executables that you sign with the same certificate (e.g. newer versions of the same app). This impacts SmartScreen prompts. If you get an EV certificate you get the initial reputation for free and can skip SmartScreen prompts out of the gate.

source: have done it; my open source Windows app is signed with my Sectigo certificate




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: