windows protect computers from springlobby

[triton]

This windows msg pop when you try to install springlobby...
WINDOWS PROTECTED YOUR COMPUTER
Windows Defendeur Smartscreen prevented a unknow program to start, executing this could dmg your computer.
Why is editor : unlknow?
Why windows says this crap?
Plz fix

[Silentwings]

Have you just switched to Windows 10, or did this message appear when you upgraded SL? Or neither?

[ThinkSome]

Oh the horror of software internationalization.

"editeur" in this context probably means publisher and not editor as in a text editor. And it means SpringLobby should register as a publisher at Microsoft.Get a code signing certificate and start signing.

Given that downloads are neither over TLS nor digitally signed and engine downloads within SL are insecure as well, it could actually damage your computer or worse. Like just recently Turkey has been found adding malware to programs while they were beeing transferred. Windows is absolutely correct here.

[triton]

So, any solution?
It's not my msg, it's the msg that popped for the 2 last people I've talk about the game, one from France and one from Belgium. I can't imagine how many people just stop their "springrts"'s experience here.

[Silentwings]

For the immediate future, the solution is that they should agree to press the "I'll take the risk" button if they want to use SL.

https://github.com/springlobby/springlobby/issues is the SL issue tracker.

[abma]

do you live in a country where malware is inserted to downloads?

https://citizenlab.ca/2018/03/bad-traff ... key-syria/

sadly springlobby.info still hasn't https enabled

[abma]

@triton:

whats the md5sum of Springlobby-0.264.exe?

it should lead to the same result as here:

https://www.virustotal.com/#/file/4a4fa ... /detection

(if its really just signing, then https://sourceforge.net/projects/osslsigncode/ very likely has to be used...)

[ThinkSome]

It is unlikely that windows knows whether the exe was downloaded via TLS or not, but it is much easier to check than getting a code signing certificate.

[abma]

https://springlobby.info supports https, thanks koshi!

(will take a bit until all stuff is switched to use https)

[PtaQ]

McAffe Web Advisor plugin still blocks the download (https didn't help). Other web security plugins will prolly do the same. Something should really be done, before googlebot finds out about "risky" links.

[PicassoCT]

Oh, yes- imagine they found out SРRING ЕNСRYPTED MY НАRDDRIVЕ AND DЕМАNDЕD RАNSОМ FОR SОМЕ ОРEN SОURСЕ РRОJЕСT.

We should solve it the open source way, the good way, the lazy way. Spammers, who do not want there posts found by google, use the russian alphabet, to obfuscate there messages and make the unsearchable.

[abma]

To sign the executables a "code signing certificate" is needed.

The certificate costs ~200EUR / year, i don't see me or anyone paying for this.

Also the certificate doesn't increase security: a lot of malware with valid certificates where already found. It just increases complexity.

Basicly the warning you see should be shown for all executables downloaded from the internet: it doesn't matter if signed or not.

Don't use snake-oil!

[Silentwings]

Seems like this is just one of those things you turn off in windows.

[PicassoCT]

Windows now has both- it behaves like a sneaky linux distro with a big brotherly admin. So you can push all the buttons- its forgotten at the next update anyway. Group policys- haha.

[ThinkSome]

One other option would be to distribute via some third-party package manager for windows.