Running SQLiteStudio blocked by Windows Defender

[Wernfried]

I wanted to update by SQLiteStudio to latest version which was 3.1.1. When I try to start the installer, then I cannot run it, because it is blocked by Windows Defender:

I cannot use "Run anyway at your own risk", because it is disabled by company policy.

I also tried the portable version. But I get the same error when starting the application.

Workaround is to try older versions. Portable version 3.4.4 (and most likely any older than that) is working fine. But looks like I cannot upgrade to more recent versions.

I had the same problem already with a different tool, maybe see chris2511/xca#586 for possible solution.

[pawelsalawa]

Somebody (not me) already submitted SQLiteStudio to MS app store: https://apps.microsoft.com/detail/9n3v9zdw05t5?hl=pl-pl&gl=PL

I'm not sure which version is it though.

[Wernfried]

Somebody (not me) already submitted SQLiteStudio to MS app store: https://apps.microsoft.com/detail/9n3v9zdw05t5?hl=pl-pl&gl=PL

...and apparently trying to make money with YOUR tool!

[pawelsalawa]

Well, the app is GPL-licensed. The license is not broken.

[Wernfried]

That's crazy!
I just tried again to run the portable version. It is blocked when I start with double-click from Windows Explorer. But it works fine when I start it from cmd.exe command-line window.

[pawelsalawa]

That is weird indeed. At this moment I have no better idea.

Maybe some day I will have enough motivation to overcome my disgust regarding Microsoft/Apple certification policy and I will work on certifying binaries after all. But at the moment I'm still reluctant to do so ;) If you wonder why, I wrote more details at #3932 (comment)

[Wernfried]

Well, running it from cmd.exe is not really a suitable workaround, because I like to install the application across our company with a software distribution tool.

But I found a solution. I take the files from portable archive and create my own installer. There I sign the installer and your .exe binaries with my company code-signing certificate.

[pawelsalawa]

Won't there be later a problem that the installed application itself is not signed either?

[Wernfried]

I signed your application with my certificate:

With a code-signing certificate you can sign any application, no matter if you are the creator or not. You can even replace existing signature with your certificate without any problems.
But most likely it will fail when the user checks for a new version and tries to update by himself. But he is not supposed to do that anyway.

[pawelsalawa]

It's not that simple. For the certificate to be considered "secure" by Windows Defenender, the certificate must be trusted by Microsoft. For this it has to be issued by trusted entity - meaning the Microsoft. It requires MS account and whole setup. Then there is a fee to be paid, etc, etc. If I remember correctly, the fee is to be paid annually, but I may be wrong about that last thing.

In case of Apple it's far worse. Apart from setting up (annually paid) Apple Developer account, one needs to request trusted certificate from them, sign app, sign installer and then the application has to be provided for security review (several steps of it) and this has to be done for every new version.

The guy at https://virtualgl.org/DeveloperInfo/CodeSigningHell summed it up pretty well.

[Wernfried]

I don't know whether the certificate must be issued by Microsoft or any CA which is trusted in your certificate store - which can be an internal certificate from your IT Department. Would be like this

certmgr.exe -add good.cer -c -s -r localMachine TrustedPublisher

But who knows whether Windows Defender utilized it - I would expect it though. Our certificates are used to control the Endpoint Privilege Management - at least this is our plan, we are still in pilot phase.