Being a trusted publisher

[merrillmck]

I'm currently building a website with an app that will install on the client's computer using Microsoft's ClickOnce technology. When someone clicks the button to run the app, all of the standard warnings pop up saying "Do you trust this website/source?"

A wary web surfer might get turned away and not want to put their computer at risk for a trojan.

My question is how can you persuade anyone surfing your website that the app they are going to install is safe and not something containing a trojan? Is there an independent website you submit your site/app to so that they can test it and allow you to put their certificate of approval on your website (sort of like a business that is on the Better Business Bureau)?

Thanks ...

[misson]

"Configuring ClickOnce Trusted Publishers". Basically, you need to get your app certificate signed by a trusted certificate authority (e.g. Verisign, Comodo). Google directory has a list of CAs.

[Twinkie]

You would have to pay a chunk of change for that, so only if you really need it should you buy a certificate.

[nirajkum]

Is it paid ?? If I have bought ClickOnce liecense than they should not charge me for this ?

[farscapeone]

ClickOnce enables the user to install and run a Windows application by clicking a link in a web page. The core principle of ClickOnce is to bring the ease of deployment of web applications to the Windows user

You have bought a slightly advanced installer. That doesn't mean that your software is not a malware. You have to buy a certificate form a trusted certificate authority like Verisign for people to be 100% sure your software is clean.

[xav0989]

The best you can do, if you don't want to pay for a certificate, is to tell your user that you don't have the money to pay for a certificate, therefore the application is listed as untrusted. Next tell them that they can donate money to you so that you can continue development and buy a certificate.

[merrillmck]

Thanks for the early feedback. As I delve deeper into this I'll post any experiences that go beyond what has already been said.

One thing about ClickOnce is it doesn't require Administrator privileges to run which limits the type of damage it can do to a computer. But it'll still pop up warnings and if I personally wasn't confident in the website/author I probably wouldn't let it install on my machine.

[xav0989]

Try self signing it, with a PGP key... maybe it'll work.

[merrillmck]

You would have to pay a chunk of change for that, so only if you really need it should you buy a certificate.

At first glance at Verisign's products, it appears the cheapest 1-year certificate comes in at $399.

Looks like I'll be self-signing my certificate ...


Edit:

Is it paid ?? If I have bought ClickOnce liecense than they should not charge me for this ?

Just elaborating on Leviathon's response ...

ClickOnce isn't a license. It is a feature in Microsoft Visual Studio 2005 (and later) that allows you to write a non-web application in C# or Visual Basic and deploy it on the web. When you publish it, it will show up as a generic .htm page with a single button. When the user clicks the button, it will prompt them whether or not they want to install the application and if they choose to install it then it will run on the client side rather than server side. They do not need Administrator privileges to do this (so your application won't be changing registry settings or anything of that sort).

At first glance it seemed like an easy way for a C++ programmer like me to create web applications. Of course, the security prompts are going to scare off most would-be users. No free lunch here ... it's still a pretty cool technology though.

[taha116]

As long as you have enough positive feedback on your forums a carefull user would have checked em out atlest once to see wat kind of feedback people gave on it and wat they rated it.

As long as all thats good youll not have much trouble