Ask HN: Code Signing or No Installer?

As to Code signing, if you have a Dunn and Bradstreet number for you business, its fairly straight forward getting a coding signing cert and there's different types which you can buy for your app, but it just means you have passed an identity check, the reports I've seen of the hurdles you have to go through are reduced the more you pay, ie Digicert is purportedly less time consuming than cheaper code signing CA's.

Considering things like GDPR and other data protection legislation around the world, I'm not aware how these CA's can verify identification documents because the companies or entities that make the documentation used for identification purposes cant give out your data, ergo they cant confirm or deny if the identification document is genuine or not.

And even if you did codesign your app, the end user company would probably hash your app and restrict its ability to use certain things on the computer in much the same way sandboxes do for web browsers.

Group Policy is one of the ways to lock an app's abilities down, but that's a job in itself if special GPO templates are not purchased to save on time.

eg https://learn.microsoft.com/en-us/windows-server/identity/so...

If you want the appearance of being genuine, I'd probably get a code signing cert, at the very least your users wont get the orange UAC prompt, especially if your app uses certain api's which required UAC elevation and/or also depending on your manifest file.

I have not been close to it either. At my employer we have a "software center" that people use it install supported applications.

I know people who work at some big banks in NYC where all software has to be approved and they managed to get approval to use a Python library I wrote that I think they install with pip.