The conversation

jclayHNSource author
Lessons learnedExperience excerpt · English

I thought the macOS notarization process was annoying until we started shipping Windows releases

I thought the macOS notarization process was annoying until we started shipping Windows releases. It’s basically pay to play to get in the good graces of Windows Defender. I think all-in it was over $1k upfront to get the various certs. The cert company has to do a pretty invasive verification process for both you and your company. Then — you are required to use a hardware token to sign the releases. This effectively means we have one team member who can publish a release currently. The cert company can lock your key as well for arbitrary reasons which prevents you from being able to make a release! Scary if the release you’re putting out is a security patch. I’ll take the macOS ecosystem any day of the week.

Original discussionThe Anatomy of a macOS App95 source comments · at import
6

What was this responding to?

Parent context · original excerpt

MI
mitchellhHN

> while that shown in blue is the stapled notarisation ticket (optional) This is correct, but practically speaking non-notarized apps are pretty terrible to use for a user enough so that this isn't optional and you're going to pay your $99/yr Apple tax. (This only applies to distributed software, if you are only building and running apps for your own personal use, its not bad because macOS lets you do that without the scary warnings) For users who aren't aware of notarization, your app looks straight up broken. See screenshots in the Apple support site here: https://support.apple.com/en-us/102445 For users who are aware, you used to be able to right click and "run" apps and nowadays you need to actually go all the way into system settings to allow it: https://developer.apple.com/news/?id=saqachfa I'm generally a fan of what Apple does for security but I think notarization specifically …

Full original

Community replies 0

No community replies yet. Add your perspective.

Replies from the source 6

Direct replies available in this import. Original-language excerpts.

DE
deltaknightHN

The EV cert system is truly terrible on Windows. Worst of all, getting an EV cert isn’t even enough to remove the scary warnings popping up for users! For that you still need to convince windows defender that you’re not a bad actor by getting installs on a large number of devices, which of course is a chicken-and-egg problem for software with a small number of users. At least paying your dues to Apple guarantees a smooth user experience.

Full original
DC
dceddiaHN

The situation on Windows got remarkably better and cheaper recently-ish with the addition of Azure code signing. Instead of hundreds or thousands for a cert it’s $10/month, if you meet the requirements (I think the business must have existed for some number of years first, and some other things). If you go this route I highly recommend this article, because navigating through Azure to actually set it up is like getting through a maze. https://melatonin.dev/blog/code-signing-on-windows-with-azur...

Full original
TO
TobbenTMHN

You certainly don't need a hardware token, you can store it in any FIPS 140 Level 2+ stores. This includes stuff like Azure KeyVault and AWS KMS. Azure Trusted Signing is 100% the best choice, but if for whatever reason you cannot use it, you can still use your own cloud store and hook in the signing tools. I wrote an article on using AWS KMS earlier this year: https://moonbase.sh/articles/signing-windows-binaries-using-... TLDR: Doing this yourself requires a ~400-500$/year EV cert and miniscule cloud costs

Full original
JE
jezek2HN

I solved it by putting a "How to install.rtf" file alongside the program. Another alternative would be to bundle this app: https://github.com/alienator88/Sentinel It allows to easily unlock it by drag'n'drop.

Full original
KL
KlonoarHN

I have been trying to get people to realize that this is the same or worse for like a year now. It’s unfortunate it’s come to this but Apple is hardly the worst of the two now.

Full original
RX
rxliuliHN

That's right, there's a similar comparison between the iOS App Store and Android Play Store. Although the annual $99 fee is indeed expensive, the Play Store requires every app to find 12 users for 14 days of internal testing before submission for review, which is utterly incomprehensible, not to mention the constant warnings about inactive accounts potentially being disabled.

Full original
Continue on Hacker News

Respect different perspectives. Share concrete experiences.

Sign in to post, reply, repost, and quote.