Being a trusted publisher

[merrillmck]

I'm currently building a website with an app that will install on the client's computer using Microsoft's ClickOnce technology. When someone clicks the button to run the app, all of the standard warnings pop up saying "Do you trust this website/source?"

A wary web surfer might get turned away and not want to put their computer at risk for a trojan.

My question is how can you persuade anyone surfing your website that the app they are going to install is safe and not something containing a trojan? Is there an independent website you submit your site/app to so that they can test it and allow you to put their certificate of approval on your website (sort of like a business that is on the Better Business Bureau)?

Thanks ...

 

[misson]

"Configuring ClickOnce Trusted Publishers". Basically, you need to get your app certificate signed by a trusted certificate authority (e.g. Verisign, Comodo). Google directory has a list of CAs.

 

[Twinkie]

You would have to pay a chunk of change for that, so only if you really need it should you buy a certificate.

 

[nirajkum]

Is it paid ?? If I have bought ClickOnce liecense than they should not charge me for this ?

 

[farscapeone]

ClickOnce enables the user to install and run a Windows application by clicking a link in a web page. The core principle of ClickOnce is to bring the ease of deployment of web applications to the Windows user

You have bought a slightly advanced installer. That doesn't mean that your software is not a malware. You have to buy a certificate form a trusted certificate authority like Verisign for people to be 100% sure your software is clean.

 

[xav0989]

The best you can do, if you don't want to pay for a certificate, is to tell your user that you don't have the money to pay for a certificate, therefore the application is listed as untrusted. Next tell them that they can donate money to you so that you can continue development and buy a certificate.

 

[merrillmck]

Thanks for the early feedback. As I delve deeper into this I'll post any experiences that go beyond what has already been said.

One thing about ClickOnce is it doesn't require Administrator privileges to run which limits the type of damage it can do to a computer. But it'll still pop up warnings and if I personally wasn't confident in the website/author I probably wouldn't let it install on my machine.

 

[xav0989]

Try self signing it, with a PGP key... maybe it'll work.

 

[merrillmck]

You would have to pay a chunk of change for that, so only if you really need it should you buy a certificate.

At first glance at Verisign's products, it appears the cheapest 1-year certificate comes in at $399.

Looks like I'll be self-signing my certificate ...


Edit:

Is it paid ?? If I have bought ClickOnce liecense than they should not charge me for this ?

Just elaborating on Leviathon's response ...

ClickOnce isn't a license. It is a feature in Microsoft Visual Studio 2005 (and later) that allows you to write a non-web application in C# or Visual Basic and deploy it on the web. When you publish it, it will show up as a generic .htm page with a single button. When the user clicks the button, it will prompt them whether or not they want to install the application and if they choose to install it then it will run on the client side rather than server side. They do not need Administrator privileges to do this (so your application won't be changing registry settings or anything of that sort).

At first glance it seemed like an easy way for a C++ programmer like me to create web applications. Of course, the security prompts are going to scare off most would-be users. No free lunch here ... it's still a pretty cool technology though.

 

[taha116]

As long as you have enough positive feedback on your forums a carefull user would have checked em out atlest once to see wat kind of feedback people gave on it and wat they rated it.

As long as all thats good youll not have much trouble

 

[merrillmck]

As long as you have enough positive feedback on your forums a carefull user would have checked em out atlest once to see wat kind of feedback people gave on it and wat they rated it.

As long as all thats good youll not have much trouble

I don't even have a webpage or finished product much less feedback. This is all new to me. =)

 

[taha116]

no worries, as soon as you get started, just post on the forums request people to check out your product and rate, also ask them to post short reviews as well. That will start you off and get the trust of other people

 

[Hue Kares]

I agree with you merrillmck, it's not nice to have this apparently negative dialogbox popping up.

If you stick with installing using ClickOnce, you could provide a walkthrough of your installation procedure on your site, showing your users that this message will show. Pointing them to Wikipedia's ClickOnce page may help you, as the first image is this dialogbox. As an earlier poster said, tell your users why it's appearing, about the $399 annual fee, and about the fact that having this license still does not magically make your software 'safe', it just makes it licensed... which means more or less nothing.

ClickOnce is brilliant if you follow its rules. As a bonus, updating your application or installing the .Net Framework for a user just couldn't be easier.

A number of things put me off from using this technology however. Apart from the annoying dialogbox, and the fact that my few users were unsure about the unfamiliar procedure, the other issue I bumped into was trying to use some 3rd-party dll's (ie, some cool control from codePlex or codeProject, whatever). If the dll's are not signed by the publisher, they can not be used in your ClickOnce deployment. Your project may not be using any now, but do you know it won't in the future?

ClickOnce is not your only deployment option luckily. There are a number of open-source installers (free) out there. I would recommend NSIS as it allows you to create a completely familiar and professional installing procedure for your users. You'd have to learn a pretty simple scripting language to build your installer and create a class in your project that does the updating, but once over that hurdle, you'll be laughing. Firefox uses this installer technology FYI.

I'll be happy to write your first script for you, and show you my updating class if it helps. Don't worry if you don't want to know right now; I'll still be here for a while. Using ClickOnce forced me down this route in the end; this may happen to you too.

 

[merrillmck]

ClickOnce is brilliant if you follow its rules. As a bonus, updating your application or installing the .Net Framework for a user just couldn't be easier.

I saw .NET had their own Installer but I'm currently where I am because of one word - easy. ClickOnce seemed 50X easier than building my own Installer based upon .NET's Installer class. Even if I don't stay with it longterm, I'll be happy in the short-term to have something at least friends can access and run. Won't be much of a business but it'll be a nice stepping stone.

A number of things put me off from using this technology however. Apart from the annoying dialogbox, and the fact that my few users were unsure about the unfamiliar procedure, the other issue I bumped into was trying to use some 3rd-party dll's (ie, some cool control from codePlex or codeProject, whatever). If the dll's are not signed by the publisher, they can not be used in your ClickOnce deployment. Your project may not be using any now, but do you know it won't in the future?

I've actually considered adding .jpeg libraries to at least a couple apps. Those might be .lib rather than dynamic libraries so maybe they won't require the same signatures? Currently, I'm not using any 3rd party libraries but you're right ... I might down the road.

I'll be happy to write your first script for you, and show you my updating class if it helps. Don't worry if you don't want to know right now; I'll still be here for a while. Using ClickOnce forced me down this route in the end; this may happen to you too.

Thanks for this response and your offer. Let me get a little further and then I might come knocking.

---------------

And now that Frontpage extensions are up and running on the new servers I can share www.wyrbel.com/sudoku.htm and www.wyrbel.com/chess.htm . These unfinished apps are published to the web using ClickOnce. It takes about 3-4 mouse clicks and no FTP'ing of files. It is a pretty cool technology. These links work on my computer after going through the warning page and installing them (you don't need Admin). If you all (random X10 surfer) choose to install them then you'll be among the first people to give me feedback. I know they're incomplete so I'm not asking for that type of feedback ... more the "Um, didn't work on my computer" or "Didn't work on this public library or web cafe computer; wasn't allowed to install it". Thanks.

 

[zen-r]

.....
And now that Frontpage extensions are up and running on the new servers I can share www.wyrbel.com/sudoku.htm and www.wyrbel.com/chess.htm . These unfinished apps are published to the web using ClickOnce. It takes about 3-4 mouse clicks and no FTP'ing of files. It is a pretty cool technology. These links work on my computer after going through the warning page and installing them (you don't need Admin). If you all (random X10 surfer) choose to install them then you'll be among the first people to give me feedback. I know they're incomplete so I'm not asking for that type of feedback ... more the "Um, didn't work on my computer" or "Didn't work on this public library or web cafe computer; wasn't allowed to install it". Thanks.

Don't forget to also post them over on the chess thread, for the attention of fguy64 !

 

[merrillmck]

Don't forget to also post them over on the chess thread, for the attention of fguy64 !

I won't. It took me two days to translate the chess app from C++ to C# (ClickOnce only works with C# and Visual Basic).

 

[xav0989]

Tried both of your apps, and had a lot of fun by myself with them. However, I cannot leave any comment, since there is no website... I can help you create a phpbb3 based community (will work better than an asp.net based website).

Oh, one bug with the sudoku program, when I click on the database link, the app freezes. And for the warnings, the only thing is that it's says that the author is microsoft or something like that. If you write an detailed installation guide with image, people will be more willing to execute it, even if it's not signed.

 

[Hue Kares]

For me they install when using IE8, but both display only xml in Firefox.

I've tested some of my old ClickOnce installs in Firefox, and they work fine, so at this point, I'm judging the problem as being at your end.

If you haven't done so already, I believe adding MimeTypes should fix the issue for you:

In your root directory (/public_html) , edit (or create, if it's not there already) a file called '.htaccess'.

Add the following lines to the file:

AddType application/x-ms-application application
AddType application/x-ms-manifest manifest
AddType application/octet-stream deploy

While you're there, the following MimeTypes are needed for other Microsoft .Net technologies to work (asp.net, silverlight, etc), so add these too:

AddType application/mono .aspx .ascx .asax .ashx .config .cs .asmx .axd
AddType application/x-silverlight-app xap
AddType application/vnd.ms-xpsdocument xps
AddType application/xaml+xml xaml
AddType application/x-ms-xbap xbap

Hope this helps, or at least works! Some nice gdi+ work with the chess program btw...

 

[merrillmck]

Oh, one bug with the sudoku program, when I click on the database link, the app freezes. And for the warnings, the only thing is that it's says that the author is microsoft or something like that. If you write an detailed installation guide with image, people will be more willing to execute it, even if it's not signed.

I know what the database bug is and thanks for pointing it out.

And a detailed installation guide is one of many things on my todo-list. There are others too ... some of the mouseover features got lost in my sudoku translation ... this version is a little more annoying to me. Both of these were originally written in "managed C++" and are now in C#.

Eventually I'll have a dedicated website too (not just generic publish code) and that's another thing on my to-do list.

Edit:

For me they install when using IE8, but both display only xml in Firefox.

I've tested some of my old ClickOnce installs in Firefox, and they work fine, so at this point, I'm judging the problem as being at your end.

If you haven't done so already, I believe adding MimeTypes should fix the issue for you:

In your root directory (/public_html) , edit (or create, if it's not there already) a file called '.htaccess'.

Add the following lines to the file:

AddType application/x-ms-application application
AddType application/x-ms-manifest manifest
AddType application/octet-stream deploy

While you're there, the following MimeTypes are needed for other Microsoft .Net technologies to work (asp.net, silverlight, etc), so add these too:

AddType application/mono .aspx .ascx .asax .ashx .config .cs .asmx .axd
AddType application/x-silverlight-app xap
AddType application/vnd.ms-xpsdocument xps
AddType application/xaml+xml xaml
AddType application/x-ms-xbap xbap

Hope this helps, or at least works! Some nice gdi+ work with the chess program btw...

Thanks again. I'll look into this. I currently only have one of those lines in my .htaccess file.

Regarding ClickOnce, it seems this only works on Microsoft operating systems and then only those with .NET 2.0 installed. I got this complaint and read up on it and it appears to be Microsoft-OS specific. Is this true?

----

Update: I changed my .htaccess file and attempted to run it in Firefox unsuccessfully. Will keep looking into it.

 

[Hue Kares]

Update: I changed my .htaccess file and attempted to run it in Firefox unsuccessfully. Will keep looking into it.

I cleared my Firefox cache, and they work for me now. Clear yours to see if this resolves your issue.

Firefire users must have 'Microsoft .NET Framework Assistant' installed as an add-on for ClickOnce apps to deploy successfully, but you know Microsoft, most users will have this already. Without it installed, I think Firefox simply downloads the application rather than download/install/launch it. Just be aware of this.

Regarding ClickOnce, it seems this only works on Microsoft operating systems and then only those with .NET 2.0 installed. I got this complaint and read up on it and it appears to be Microsoft-OS specific. Is this true?

All .Net applications require the .Net framework to be installed on the client machine, including ClickOnce deployed apps. What you are giving your users is your application (.application); this requires the .net framework. So, no .net = no app.

The way around this is to produce the bootstrapper 'setup.exe' in your project, which will check to see if your specified prerequisites are installed on the clients machine, and install them if they are missing. The Setup.exe you will produce is not a .net executable, so does not require the .net framework to run.

I'm assuming you're using visual studio to manage you deployment, in Project Properties/Publish, simply hit the 'Prerequisites' button and create the setup project from there, ensuring you target the correct version of the framework for your application.

When you rebuild, the new publish.htm should now contain a link to both the .application (for those with the framework/dependancies already installed), and the new setup.exe (for those that don't, or those who are unsure).

Also, in your very next build, I would suggest you change 'Microsoft' as the publisher of your software; they're not, you are. Put your name, or your domain name or anything else...


To answer your question, ClickOnce is a Microsoft technology, so therefore things aren't made easy for other operating systems. .Net applications can run on lynux/mac under the following conditions:

• The Mono Project must be installed on the client machine, instead of the .Net framework. This is an opensource .Net implementation
• Your project may only target dll's supported by Mono, mainly those in version 2.0 of the framework, and some 3.5 stuff.

Nice work on the applications themselves. I can see your C++ to C# conversion process has taken a few liberties... A chess engine is an ambitious project. Good stuff.