Open File Security Warning - Digital Signature 1

[KarenLloyd]

I forgot to mention - this is on applications developed in VFP6 and the computers are mostly XP.

I've also just found this page which gives a method I can try at one location

http://www.intelliadmin.com/index.php/2006/10/why-some-shortcuts-say-publisher-cannot-be-verified/,

but on a larger network and in some other circumstances it may not be the solution.

Any ideas on signing the application instead please?

Karen

 

[clipper01]

Karen , the link u quoted is your best bet , it clears the message 100% . I had the same prob and bought a security certificate off Comodo ( big song/dance about proving who I was etc + 100$ a year or so ) , but all it does is to change the warning message to a more benign "Do you want to run this file" and a Yellow rather than Red warning Icon. Far as I know , this is the best you can do with certs , at a reasonable cost , thanks again M$Soft . The trusted site method is a pain for large networks , but to be honest , very few users will complain about the first warning anyhow , they see it all the time

 

[Mike Lewis]

Clipper,

Sorry to disagree. The article Karen quoted shows how to solve the issue on your own network. Karen's problem (if I've understood it right) is that she wants to market the software to the world at large. She won't have any control over the network settings or IE options on her customers' systems, nor can she reasonably ask her customers to change those settings themselves.

As far as I know, the only satisfactory solution is to cough up for a security certificate, and then obtain a utility to sign your executables.

I've got clients who are in the same situation, so if anyone knows any other options, I'd be glad to hear about them too.

Mike



__________________________________
Mike Lewis (Edinburgh, Scotland)

Visual FoxPro articles, tips, training, consultancy

 

[clipper01]

Mike , yeah missed the bit about selling to the public. My experience with the Comodo cert was that it just changed the warning as above , and as far as I know there is nothing else you can do , unless you buy some megabucks "primary" certificate
Sean M

 

[clipper01]

fyi also , I used this to do the signing ( after buying the cert seperately from Comodo ) , or you can figure out the command line methods ;

http://flyawaysimulation.com/news/1824/catiii-software-announces-code-signer-pro/

 

[Mike Lewis]

Come to think of it, I believe there's a code-signing tool that comes with Visual Studio. The last time I looked into it, I was put off by the fact that it was a gigantic download just to get a relatively simple utility. But at least it was free.

But that doesn't solve the problem of the cost of the certificate.

Mike

__________________________________
Mike Lewis (Edinburgh, Scotland)

Visual FoxPro articles, tips, training, consultancy

 

[KarenLloyd]

Hi Clipper01

I read somewhere about Comodo earlier, before posting on here, but the prices were something like $500/year.

If I had to, I would take these costs into consideration, because I generally charge a yearly support & maintenance contract on my software. I want to continue to do this in as a professional manner as possible, and as someone else said on the web, this means I would rather not have clients starting up software with an "unknown publisher" message every day.

However, take a look at the text highlighted I have below with my reply to Mike.

Best wishes

Karen

~~~

Hi Mike

I haven't looked at the whole Visual Studio package for a long time. I was hoping I could find some more information from Microsoft this evening and after checking your replies I have had another look only to find this on

http://support.microsoft.com/kb/843594

Because security is an important consideration for many developers, signing executable files to validate their authenticity is becoming a general practice. Unfortunately, when an executable file is made with a version of Microsoft Visual FoxPro that is earlier than Visual FoxPro 8 and then that executable file is signed, the executable file no longer runs correctly.

It makes me wonder sometimes if "Microsoft" will be reclassified as a swear word (I know people who consider it to be one already).

~~~

Thank you both for your replies.

I will take the IE approach with the smaller setup and hope that future installations have the "Always ask..." tick box option...

Best wishes

Karen

 

[KarenLloyd]

...As I completed the last message, this link

http://www.globalsign.co.uk/code-signing

came up on tek-tips. But even at £199/year, if the VFP6 EXE won't run, whats the point?!

 

[clipper01]

just to add to this , all my stuff is in vfp9 , and the code-signing DOES work but only converts the big RED warning to a slightly less threatening YELLOW one and less severe message . But on an aside , u would prob save a huge amount of time by going to vfp9 ( u can still get it on ebay for maybe 60 usd) , just make sure to also download SP2 and the up-todate help file on codeplex . That will set u up to build vfp apps well past 2014 . The single biggest thing u get from vfp6 onwards is read-write cursors , if like me , u use sql a lot in grids this saves enormous amounts of time

 

[KarenLloyd]

Hi Clipper01

I hadn't given any thought to upgrading from VFP6 but like everything else I guess it will eventually need to be done.

Thanks for the tips on VFP9

Karen