Timeline for How to handle "Try my application" answer
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 18, 2015 at 13:26 | comment | added | thims | knowe2, "No one is going to pay that kind of money just to give something away" =) This is exactly what we do: giving away more than 100 free utils, all VeriSign-signed. No ads. | |
| Feb 17, 2015 at 14:59 | comment | added | krowe2 | @thims Your question entirely misses the point. I have seen applications which I would consider to be malware with a signature. They are typically those borderline applications which are known as "Ad Supported". The thing you are missing is that it costs about $750/yr to get a Verisign cert for your app. No one is going to pay that kind of money just to give something away. You need to get away from Verisign if you ever hope to make a meaningful statement concerning the best way to distribute free software as an unknown vendor. Also, "Ad Supported" means that it isn't free at all. | |
| Feb 17, 2015 at 9:39 | comment | added | thims | @krowe2, have you ever seen any single malware signed with VeriSign!? | |
| Feb 16, 2015 at 17:02 | comment | added | krowe2 | @thims I wasn't aware that you spoke for the group. Digital signing doesn't tell us anything about the content of the binary. So you're saying that you are expecting for people to give away free binaries which are signed using 'for pay' certs? Is someone going to bankroll this or are we expecting the authors to not only give us free software but to also pay for us to use it? In the end, it still does very little unless you first trust both the issuer of the cert and the owner of the cert (which is why ONLY pay certs would do at all). | |
| Feb 16, 2015 at 16:15 | comment | added | thims | @krowe2 For example, the compiled binary can be signed. With trusted Symantec/VeriSign code signing certificate, for instance. We're not paranoids here =) | |
| Feb 11, 2015 at 22:52 | comment | added | krowe2 | @Nikolay If the source is there then it is at least possible to know what's going on. It is actually fairly easy to scan over much more code than 5k lines fairly quickly as well. OTOH, there really is no way to reliably tell weather compiled code is malware (unless you are mythically good at reading ASM code). Who's to say that a perfectly fine compiled app won't turn into malware one day (eg Blackworm, Kama Sutra Worm)? If the code is garbage, then you want the source even more; because you'll probably need to fix it. | |
| Feb 11, 2015 at 21:45 | comment | added | VL-80 |
@krowe2, Show us the source, be MS or Apple or IBM, or GFY. Make sense. But who will be studying these sources? What if there are 3000 rows of code or 5000. What if code is a pure sh*t and horrible to follow? I think if we are going to let such answers to stay, then there should be warning added - download and use at your own risk.
|
|
| Feb 11, 2015 at 21:14 | comment | added | krowe2 | The fact is that AV scanners will fail to find most malware when it's been recompiled with a different compiler. An AV scanner has about zero chance of catching a zero day virus. We're talking about a trojan here and that has an even lower chance of being detected than a zero day virus because those do perfectly normal things that will never be detected using heuristics, they are zero day if they were posted here, and they were purposely installed. Show us the source, be MS or Apple or IBM, or GFY IMHO. | |
| Feb 11, 2015 at 20:43 | comment | added | Sun | I think Blatant Self Promotion (BSP) is okay if the software is free of malware, states cost even if free, and actually does what it says. | |
| Feb 10, 2015 at 23:40 | comment | added | Journeyman Geek Mod | No, but I wouldn't consider a link to bespoke software automatically to be malicious. I'd flag based on the totality of the answer. I've at least once improved an answer cause it was crap, but the software it recommended was pretty uniquely useful. | |
| Feb 10, 2015 at 16:58 | comment | added | Excellll | Is there an obligation for reviewers to actually check out the linked application? For instance, if I'm reviewing first answers and come across this, should I skip the review if I'm unwilling or unable to test the link? Or is it okay for me to click "Looks Good" if I think everything else looks okay? | |
| Feb 10, 2015 at 15:06 | comment | added | Journeyman Geek Mod | I wouldn't run it until I ran it past virustotal | |
| Feb 10, 2015 at 15:06 | comment | added | Jon |
linux box is awesome for that. except when it only runs on windows
|
|
| Feb 10, 2015 at 14:04 | vote | accept | VL-80 | ||
| Feb 10, 2015 at 2:08 | history | answered | Journeyman GeekMod | CC BY-SA 3.0 |