Installation/Security Issue about soundswitch

[Belphemur]

I can sign the installer and the application.
The problem is, you'll have to install a certificate first before launching the installer. This certificate will be added into the trust list of Windows and then it will recognize the program and installer as trusted.

[robburrow]

Ok great, so how do I go about installing a certificate?

Thanks for your help.

Rob

--- Original Message ---

From: "Antoine Aflalo" [email protected]
Sent: August 23, 2015 8:34 AM
To: "Belphemur/SoundSwitch" [email protected]
Cc: "robburrow" [email protected]
Subject: Re: [SoundSwitch] Installation/Security Issue (#6)

I can sign the installer and the application.
The problem is, you'll have to install a certificate first before launching the installer. This certificate will be added into the trust list of Windows and then it will recognize the program and installer as trusted.

---

Reply to this email directly or view it on GitHub:
#6 (comment)

[Belphemur]

First download this: https://www.aaflalo.me/certs/AaflaloMeCertificates.zip and launcht the InstallCA.bat.
It will install my certificate into your system. Windows will then be able to recognize the installer and application.

Now download the last release of SoundSwitch 3.2.1 that is signed with that certificate.

[robburrow]

Hello again,

I think I managed to install the certificate ok, but now after I uninstalled the old version of Soundswitch and restart my computer I get a window asking me if I want to install this application. I click on install and just reinstalls the previous version. So I tried to run the installer for the new version again, and I just get the security warnings again??

Please help

Date: Sun, 23 Aug 2015 07:12:45 -0700
From: [email protected]
To: [email protected]
CC: [email protected]
Subject: Re: [SoundSwitch] Installation/Security Issue (#6)

First download this: https://www.aaflalo.me/certs/AaflaloMeCertificates.zip and launcht the InstallCA.bat.

It will install my certificate into your system. Windows will then be able to recognize the installer and application.

Now download the last release of SoundSwitch 3.2.1 that is signed with that certificate.

—
Reply to this email directly or view it on GitHub.

[Belphemur]

Okay in order you'll do this:

1. If my version is installed, uninstall it.
2. Launch the previous version of SoundSwitch
3. Uncheck run at startup
4. Exit the application and uninstall it
5. In the zip I gave you run as administrator the InstallCA.bat
6. Input à key to launch the installation
7. Run the installer of the last version of SoundSwitch

On 25 August 2015 00:39:24 EEST, robburrow [email protected] wrote:

Hello again,

I think I managed to install the certificate ok, but now after I
uninstalled the old version of Soundswitch and restart my computer I
get a window asking me if I want to install this application. I click
on install and just reinstalls the previous version. So I tried to run
the installer for the new version again, and I just get the security
warnings again??

Please help

Date: Sun, 23 Aug 2015 07:12:45 -0700
From: [email protected]
To: [email protected]
CC: [email protected]
Subject: Re: [SoundSwitch] Installation/Security Issue (#6)

First download this:
https://www.aaflalo.me/certs/AaflaloMeCertificates.zip and launcht the
InstallCA.bat.

It will install my certificate into your system. Windows will then be
able to recognize the installer and application.

Now download the last release of SoundSwitch 3.2.1 that is signed with
that certificate.

—
Reply to this email directly or view it on GitHub.

---

Reply to this email directly or view it on GitHub:
#6 (comment)

Best Regards,
Antoine Aflalo

[robburrow]

I did all the things you said but I still get error messages.

[Belphemur]

Please disable Norton, it's a clear false positive (like most of the time with this shitty anti-virus).

I used VirusTotal to scan the file: https://www.virustotal.com/fr/file/18a0a18f17b84971c502ffc1edbc1ac9c37c197db1f701a1afc76e6a18bc50dc/analysis/1440659137/

As you can see there is no virus or other malware in the installer, then really disable Norton it's doing more bad than good.

[robburrow]

That did the trick. I just disabled Norton whilst I installed Soundswitch and I had no problems. One of my favourite apps in now working properly again.

Thank you so much 👍

[NelsonMinar]

Is there a way you can have your certificate signed by a trusted authority so it is installed and trusted automatically and doesn't require manual installation? I imagine it will cost money and require you verify your identity to some certificate provider. If the money is the sticking point, I'd be willing to make a one time donation.

[FireEmerald]

Normally such certificates coast X € per year - so it isn't done with a one time payment... but that's only what i know and found so far. Perhaps there is still somewhere a provider which offers free certificates but in the mentioned thread kind of all cost now.

Code signing certificate for open-source projects

[Belphemur]

@NelsonMinar I'm still toying with the idea. The biggest issue would be to remember to keep the cert up to date (pay the 85 USD per year) and that old version of SoundSwitch could have issue updating since I make the program check for my certificate to be sure it's downloading a trusted installer.

The cheapest/easier provider I found is: http://codesigning.ksoftware.net/

[NelsonMinar]

Thanks for your answer and thoughtful research. I was motivated to write because the current user experience for SoundSwitch updates is pretty bad. I just randomly see a UAC popup (interrupting whatever I'm doing) with a request to approve an anonymous "installer.exe". You have to click through to "Details" to even see it's SoundSwitch. For now I've just disabled background updates, which actually is a fine enough solution, but a signed cert would be better.

I'm sorry I don't know anything about the Windows ecosystem and how signed binaries work, it's a shame Microsoft doesn't have a good solution. When I wrote my note I had in mind a one-time $100 donation, thinking maybe that'd fix the problem. I can understand your hesitance to get committed to ongoing expenses for a free software project.

[Belphemur]

@NelsonMinar, Well you'd still have the popup even with a trusted Microsoft certificate installed.

Anytime you launch an installer, Windows does that, the only change is you'd see the "Publisher: SoundSwitch".

In the newer version of the installer, the user has the choice to install my certificate to make your Windows recognize SoundSwitch as a trusted publisher. It's selected by default WHEN installed manually. When the auto-update does the install, the certificate doesn't get installed.

You could download the last version, install it manually and check the box about trusting the certificates. But as I said, you'll still get the UAC warning, just with "Publisher: SoundSwitch".

Because of all those annoyance, with @FireEmerald we decided that the default "Update action" is notify, letting the user go through the installer and removing the "surprise" linked with the UAC popup of Windows.