Replies: 5 comments
-
|
first of all, thank you for "blind trust is not enough", of course you can build software youselve eliminating that risk. please do. thank you, |
Beta Was this translation helpful? Give feedback.
-
|
I am not skilled enough to audit the code and build it myself. I trust developers do the great job, it's just the signature that's missing. There's a very affordable cloud-based code-signing certificate for open source developers for 49 EUR a year that would eliminate this issue altogether. It can be used throughout the entire university with the limitation of 5000 signs per month and that it will state "Firstname Lastname Open Source Developer", just like KeePass is signed. If this is not at all acceptable, then the standard certificate for open source software for 209 EUR a year is available also a good price, with discounts if you choose 2 or 3 year validity. Can also be used for the entire university. I hope the university can afford it and start signing the GitHub version. Thanks in advance! |
Beta Was this translation helpful? Give feedback.
-
|
I doubt that investing time and money into signing worth that. but you can learn it, test it and try to convince other follow your steps. |
Beta Was this translation helpful? Give feedback.
-
|
I can't believe what I'm reading 😂 Apparently not in this very case. Are you still living in 1990s? Or under a stone? Even individual open-source developers provide signed binaries for Windows. And it's mandatory for macOS and Android, too. Other VPN clients are signed as well. If this software is really university-backed as advertised, any decent university would have no problem spending 50 EUR for things like that. It's not even a rounding error in the spending balance. This just doesn't make any sense. I'm not going to take it further. You can close this if you want, my head just exploded. I'm going to get some longer walk to understand what I just witnessed. |
Beta Was this translation helpful? Give feedback.
-
|
miracle happens. please provide your own result in signing. otherwise it is marketing hallucination. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I am new to SoftEtherVPN. I tried to play with the developer version, but after staggering 32 detections of potential malware I've given up. I can understand 1, 2, maybe 3 false positives, but this amount is way too large. Also Firefox and Windows separately warning and flagging this - no, that's like saying "there's something grossly wrong with that".
If this software is backed by a University, the University should provide a certificate to sign the Windows executable. That would radically reduce the amount of flagging/false positives.
These days, in 2026, cybercriminals are very skilled and they break into everything they can, sneak into build pipelines or CI/CD processes. Therefore a blind trust is not enough. We need the evidence that software comes from a good source, and the digital signature embedded into the installer executable is a well-established practice to verify the source.
Please consider this. I'd like to use and spread the word about SoftEther, but now I'm very hesitant. I think no people is brave enough these days to install software that displays the following warnings.
Beta Was this translation helpful? Give feedback.
All reactions