Unknown Publisher

[audiopro]

Is there a way to over ride the unknown publisher warning for a particular .exe on my computer. I have a simple .exe program which performs a task via task scheduler, on a computer without Foxpro. The .exe will not run until the run button is pressed manually.

Keith

http://www.studiosoft.co.uk

 

[Olaf Doschke]

That dialog offers more than YES Or NO options. On the lower left edge select More details, then you can set to trust this EXE or script every time from now on.
Either that or you buy a code signing certificate from eg Comodo, Thawte, or Verisign and sign your EXE or script.

Bye, Olaf.

 

[audiopro]

Hi Olaf
The Open File, dialog box offers 'Run' and 'Cancel' with an option of 'How can I decide what software to run'.
There is no option fo more details.


Keith

http://www.studiosoft.co.uk

 

[Olaf Doschke]

Do you have a screen shot? Because then we don't talk about the same UAC dialog. There are some asking for a login/elevation and Yes/No, Confirm/Cancel, Continue/Cancel or Cancel/Allow.

Bye, Olaf.

 

[audiopro]

Hi Olaf
There is a screenshot here like the one I get.

http://www.netwiz.com.au/appnotes/4644.htm

Keith

http://www.studiosoft.co.uk

 

[Olaf Doschke]

OK, the text there points to the reason, there is no signature in the exe, most certainly. In case there would be, that could be imported to the certifacte store of trusted publishers. It all boils down to either lower security settings (via that link "How can I deciude what software to run" you get to either an explanation or even the UAC settings) or sign the exe.

Bye, Olaf.

 

[audiopro]

I can turn off the option for all .exe's but I only want to allow this one. I have not seen an exception list anywhere.

Keith

http://www.studiosoft.co.uk

 

[Olaf Doschke]

I wasn't talking about any exception list. Trusting a vendor/publisher is just a choice, if an exe is signed. In yaur case it's not, as it's not signed at all, not even with a self generated certificate.

You may have another choice via setting up the scheduled task to let your exe run with elevated priviliges:

http://msmvps.com/blogs/martinzugec/archive/2008/05/16/ignore-uac-for-specific-programs.aspx

But actually that is rather a solution for EXEs needing elevation, not unsigned EXEs prompting for unknown vendor/publisher.

Bye, Olaf.

 

[foxmuldr3]

This might be an excellent idea for a new product ... If a device were constructed which sat between the keyboard cable and its connection port on the machine, with the device being able to receive data from a process which sends it commands, then that device could be signaled in advance of an elevated process request (which requires user acceptance to then issue the correct keystroke automatically) to send the appropriate response as a simulated keystroke sequence.

Such a solution would be a nifty way to programmatically bypass these annoying features on all of our own, known apps, while allowing the OS feature to always still exist for foreign apps.

A better solution is to switch to Linux.

Best regards,
Rick C. Hodgin

 

[audiopro]

In line with modern thinking, we have to supply a complex solution to what is a simple problem.
If I decide to run a .exe manually or via a scheduled task it is because I want to run it. We used to be offered the option of adding the software title to a list of accepted programs but logical, user friendly steps in software useage seems to have been replaced by pointless bells, whistles and noises designed for people who only surf the web on a screen the size of a postage stamp.

I appreciate that there are all kinds of nasties and viruses embedded in such files but the presence of a signed certificate is no guarrantee that the software is safe to run.


'A better solution is to switch to Linux'
A nice idea but people today are influenced by marketing and false promises rather than a product that actually works properly.


Keith

http://www.studiosoft.co.uk

 

[Olaf Doschke]

If you ask a security guy of a bigger corp, about a similar trust of some mailadress in regard of attachments, he would just smile. A virus spreading via mail will of course spread via known addresses, so a virus most probably comes from your most trusted customers or service providers and it doesn't make sense to allow an exception from that persective alone.

Yet, if some application is signed it really can't have been changed without being resigned. And to sign or resign you need the private part of a certificate only the signer has. So indeed signing an exe does provide a measurable assurance, that file is from the developer you expect it. And yes, nevertheless that software can crash your system or delete data, intended or unintended. But you know, who is liable from that signature. Especially, if it's not just a self-signed certificate.

Everything is complicated in comparson with needing to do nothing instead. But in fact a signing finally just is a call of signtool.exe sign /a your.exe

Also see thread184-1683220
Especially [URL unfurl="true"]http://www.wintellect.com/cs/blogs/jrobbins/archive/2007/12/21/code-signing-it-s-cheaper-and-easier-than-you-thought.aspx[/url]

Bye, Olaf.

 

[audiopro]

'Everything is complicated in comparson with needing to do nothing instead'

That is just the point, in this instance, I want to do nothing.
It is my code, generating my .exe and being distributed to my clients only. Most of my clients are not local to me so I want to send them files which they install and use, like it was in days of DOS where life was so simple.

There I go being all nostalgic.

Keith

http://www.studiosoft.co.uk

 

[Olaf Doschke]

Well, you can lower shields, use XP MOde, for example. Or turn off uac, if that ease of use is the main concern, it is the main concern.

Bye, Olaf.

 

[foxmuldr3]

'A better solution is to switch to Linux'

A nice idea but people today are influenced by marketing and false promises rather than a product that actually works properly.

/me cries. :-(

Best regards,
Rick C. Hodgin

 

[audiopro]

I appreciate the benefits of Linux, all we need to do now is convince the world.

Keith

http://www.studiosoft.co.uk

 

[Olaf Doschke]

If you trust any complex system to "work properly", you haven't understood some theorems about complexity:

http://www.anecdote.com.au/archives/2006/01/michael_crichto.html

It's just a matter of how wide an OS is distributed, if it is the aim of malware of any kind. Linux has a wide distribution as server system and there are root kits to gain root access to servers and their databases. I doubt Linux is so much more secure. For sure it won't stay that way, if everbody switched to it.

Bye, Olaf.

 

[foxmuldr3]

For sure it won't stay that way, if everbody switched to it.

That's why we need a truly free market and more than one main OS vendor. We need a host of options to alternate back and forth from all the time. It'll keep the malware people on their toes and eventually someone will hit upon a solution which is incapable of getting a computer virus (apart from the user deliberately installing one).

Best regards,
Rick C. Hodgin