Compatible with Windows 7

[admin]

Of course it is a tradeoff between the benefits and the ~$170 a year the certificate costs .

Where have you got that number? I see $499 a year at verisign:
http://www.verisign.de/code-signing/con ... index.html

[zer0]

Code: Select all

potential user != ideal user

Pardon the bluntness, but is XYplorer really targeted at people who are not intelligent enough to ask a question or are so prejudicial that they would blame the software without knowing the actual cause?

[admin]

Code: Select all

potential user != ideal user

Pardon the bluntness, but is XYplorer really targeted at people who are not intelligent enough to ask a question or are so prejudicial that they would blame the software without knowing the actual cause?

Maybe not targeted, but those folks can certainly be hit.

[j_c_hallgren]

The real problem is the next potential user who comes along looking for a file manager might not realize the cause and choose a different one because XY appears to be slow to start.

So maybe this issue should be listed in http://www.xyplorer.com/faq.htm which may make it a bit easier to find?

[Jibz]

Of course it is a tradeoff between the benefits and the ~$170 a year the certificate costs .

Where have you got that number? I see $499 a year at verisign:
http://www.verisign.de/code-signing/con ... index.html

VeriSign is very expensive.

As far as I can tell DO is using Thawte, which is a little cheaper, and TC uses Comodo which are around $180 (cheaper if you buy for more than one year at a time).

If you are interested you might also want to check out resellers like ksoftware who seem to be offering comodo certificates at around $100. I have no experience with them though.

[zer0]

...As far as I can tell DO is using Thawte, which is a little cheaper, and TC uses Comodo which are around $180 (cheaper if you buy for more than one year at a time).

If you are interested you might also want to check out resellers like ksoftware who seem to be offering comodo certificates at around $100. I have no experience with them though.

Code: Select all

1) Why does Microsoft “insist” on VeriSign certificates?

Microsoft Windows Quality Labs only recognizes files that are signed with a Verisign Class 3 Certificate of Authority (COA).

[Jibz]

Microsoft Windows Quality Labs only recognizes files that are signed with a Verisign Class 3 Certificate of Authority (COA).[/code]

To be more precise, you need a Verisign certificate to sign hardware drivers, and you apparently also need one at present for the windows certification program. The others work fine for getting rid of pesky prompts and anti-virus software.

[zer0]

To be more precise, you need a Verisign certificate to sign hardware drivers, and you apparently also need one at present for the windows certification program. The others work fine for getting rid of pesky prompts and anti-virus software.

One can create their own free certificates with OpenSSL -- as explained here: http://blog.didierstevens.com/2008/12/3 ... h-openssl/ -- but I am not certain if it would be good enough to warn off those "annoyances"

[admin]

Thanks for the discussion. I decided that this is not the way I want to go for the time being.

[kinook]

The XYPlorer program and installer EXEs really should be code signed. In addition to the concern about anti-virus software slowing startup, it would also avoid the scary "unknown publisher" message when running the installer and make the executables more trustworthy to know they haven't been tampered with. I'm surprised that Windows doesn't require this yet, but I'm sure it eventually will.

The comment at http://www.xyplorer.com/xyfc/viewtopic. ... 25#p133161 suggests that they are being signed, but not the versions I've used (16.10 official and beta builds).

You can purchase certs here for $95 or less per year: http://codesigning.ksoftware.net/

[admin]

Official releases are signed, beta releases are not.

[kinook]

Why not?

[admin]

You know the band "The Tony Williams Lifetime"? Replace "The Tony Williams" by "Donald's"...

[kinook]

If you have an automated build process (surely you do?), it wouldn't require any extra effort.

Also, you'll need to fix the SHA-1 digest on or before 1/1/2017:

http://social.technet.microsoft.com/wik ... mping.aspx

https://stackoverflow.com/questions/306 ... de-signing

And for best compatibility with older Windows releases, you may also want to dual sign with SHA1 and SHA2 certs.

https://stackoverflow.com/questions/206 ... -timestamp