Hacker News Reader

I agree in general with what SmartScreen tries to do. There are a lot of non-technical folks clicking on stuff willy-nilly so adding barriers to prevent spyware / virus infections for totally unknown binaries is a good thing. A "Let's Encrypt" for code signing may be a good idea, but the cost of a certificate is itself a barrier for spyware distributors, so i'm conflicted on that... not sure what the right fix is.

View on HN

> but the cost of a certificate is itself a barrier for spyware distributors

Is it? If spyware and malware wasn't profitable, people wouldn't take the risks to create and distribute it. An up front cost of a few hundred dollars could be made back with a single successful ransomware attack, and the certificate would last years.

This "smart screen" thing, as well as Google's endless warnings when you try to install an app outside of their store on Android are not for protecting the user; they're there to prevent competition.

The barrier is actually bigger than just money: for an EV certificate you need to prove that you are a registered business. So there is a name and an address behind it, which is kind of a barrier for malware.

What’s that? An extra $50 in Delaware?

Reply on news.ycombinator.com