Hello everyone, I'm new to this forum.
I'm a software application developer at Extreme Telematics. I want some advice on software processes that will help our customers avoid false positives on applications we develop when they install them. We typically deploy our applications using Click Once. We don't sign our applications.
We've recently had a customer get blocked due to the Ws.Reputation.1. I want to know what our options are to avoid getting our applications blocked at download/install time. especially on new versions. I want to avoid getting blocked by any anti-virus programs and corporate firewalls.
A first obvious step would be to purchase a code signing certificate and start signing our code with it. I want to set the expectations with management here about what improvements to expect. Do we still have to wait some for our reputation to build with our new certificate for instance? Will we still get blocked by firewalls? What will happen when we need to get a new certificate when the old one expires, i.e. does our trust level drop to zero again?
Will it be necessary to upload our application on every released version to get it whitelisted. Are there other steps we can take to avoid this step and associated delay.
Are there any automated processes to check if a new build will get blocked by any Symantec products? We would like to know before our customers see a problem. For instance, can we upload an application anywhere to run a firewall and antivirus scan? The only other alternative would be to create a bunch of virtual machines with various anti virus products and install them as part of a unit test. That sounds complicated and expensive (i.e. license costs).
Thanks for reading. I'm open to any suggestions here from Symantec or other software developers that feel the same pain.