Codesign price Help me

[rootx]

Hi guys, I'm tired of having false positive problems, there is no life to free software without a digital signature, do you have a free method? I do not think you have it, I found this offer that you think of it, any suggestion is welcome. THX

<snip>

Edited February 14, 2017 by Melba23
Link removed

[iamtheky]

https://www.globalsign.com/en/code-signing-certificate/code-signing-tool/

 

you will still have false positives, especially if you packed with UPX.

Edited February 14, 2017 by iamtheky

[Melba23]

rootx,

You should know by now we do not accept links to payware.

M23

[rootx]

15 hours ago, Melba23 said:

rootx,

You should know by now we do not accept links to payware.

M23

Sorry

[rootx]

16 hours ago, iamtheky said:

https://www.globalsign.com/en/code-signing-certificate/code-signing-tool/

 

you will still have false positives, especially if you packed with UPX.

I tried without success.. can you explain how to use it

I have installed .net framework 4.6 and I have C:\Program Files (x86)\Windows Kits\10\bin\x64\signtool.exe but I recive this error

 

[iamtheky]

use the command line arguments provided in the instructions, and not whatever GUI that is?

but again, and this time with feeling; if you are trying to eliminate 'false positives' this is not the answer.  You will just have a self-signed exe that throws false positives, most likely because you just hit F7 and prayed real hard. 

Edited February 15, 2017 by iamtheky

[jguinch]

Then hackers can simply sign their programs do avoid an antivirus detection ?

[spudw2k]

I doubt it...that's be pretty naive to assume just because a program is signed it is not malicious.  Malware, to my greater knowledge, is based on file heuristics regardless if it is digitally signed or not.  

[rootx]

10 hours ago, spudw2k said:

I doubt it...that's be pretty naive to assume just because a program is signed it is not malicious.  Malware, to my greater knowledge, is based on file heuristics regardless if it is digitally signed or not.  

If the software is not signed, it is automatically seen as potentially dangerous, and if you had read the new Google policy regarding the no ssl web sites and software not signed would understand the issue better.

The programs should have a valid code signing issued and verified by a certificate authority presenting verifiable publisher information.

https://www.google.com/about/company/unwanted-software-policy.html

 

[spudw2k]

Well, I was talking about malware in general in response jguinch.  I don't see where Google was brought up in this thread until you just did.

[iamtheky]

wait, if you need a valid CA and you don't want to pay, you may want to go look at Let's Encrypt.

But these just say that you existed before, and someone gave you a sticker that says you existed, and they know for sure you exist now because they gave you a sticker.  Still not going to change your false positive rate.

Edited February 17, 2017 by iamtheky

[TheSaint]

Sometimes there is just no working around things, and Life isn't easy.

Are you, like iamtheky suggested, using UPX or another compressor/packer?
That can make it harder to scan your program, especially by slack AV or those who go over the top with protection.

I was recently asked why my programs get so few positives (about 99% success rate when submitted). And I couldn't really say. Except that it might be due to level of complexity or the older version of AutoIt (v3.3.0.0) and UPX that I use, my reputation (sic) and no password ... or all three four etc.

[TheDcoder]

You can upload your program to VirusTotal so that security experts can analyse your program, they may rarely fix the false positive in their Anti-Virus software.

[jguinch]

For my part, I manage the antivirus protection for my company's network. I make an exclusion rule for each compiled (based on the full path name) and I have zero false positive.
I asked the question to the support : can I avoid a false positive by signing the program. The answer is : "no. You have to submit your exe file to the false positive form on our web site". Same thing for each antivirus.

 

[rootx]

18 hours ago, jguinch said:

For my part, I manage the antivirus protection for my company's network. I make an exclusion rule for each compiled (based on the full path name) and I have zero false positive.
I asked the question to the support : can I avoid a false positive by signing the program. The answer is : "no. You have to submit your exe file to the false positive form on our web site". Same thing for each antivirus.

 

Same answer.....

A question might be, how do you certify applications with obfuscated code, the software company encrypts the source code even with passwords, I recommend everyone to read this article by a developer that everyone knows or almost!

http://blog.nirsoft.net/2009/05/17/antivirus-companies-cause-a-big-headache-to-small-developers/

[TheSaint]

Exclusion is certainly the way to go, if you have Admin Rights.

In fact, I exclude my Projects & Projects Backup drives, to speed up things and ensure nothing nasty happens. They are encrypted container files anyway and the drives don't exist when they are closed. But that's all at the other end of your story.

So, like has been said, you can't do much more than Exclude & Submit ... and the situation isn't likely to change anytime soon ... maybe even get worse, for we are at the whim of the AV companies.

Edited February 18, 2017 by TheSaint