Re: [ANNOUNCEMENT] Updated: setup (2.917)

[Adam Dinwoodie <adam@dinwoodie.org>]

On Tue, Jan 25, 2022 at 10:33:52PM +0000, Buchbinder, Barry (NIH/NIAID) [E] via Cygwin wrote:
> On Mon, Jan 24, 2022 at 6:12 PM Bill Stewart wrote:
> >
> >On Mon, Jan 24, 2022 at 3:49 PM Buchbinder, Barry (NIH/NIAID) [E] via Cygwin wrote:
> >
> >Windows protected your PC
> >> Microsoft Defender SmartScreen prevented an unrecognized app from starting.
> >> Running this app might put your PC at risk.
> >>
> >
> >Not to state the obvious, but this means that the Microsoft antivirus program prevented it from running.
> >
> >Exclude it.
> 
> I have no control over the antivirus, so cannot exclude it.
> 
> The point was that this wasn't a problem with 2.915, so most likely is the result of some change made in 2.917.
> 
> However, this morning, after a reboot, it seems to work OK.

The difference was entirely that the new setup installer was new.
Microsoft Defender SmartScreen learns what programs are safe by seeing
how many people download and use them, on the basis that things that are
downloaded by lots of people and don't become known as a specific threat
should be fine, whereas something unknown may well be some new malware.

This flag doesn't indicate there's anything about 2.917 that had changed
to worry about, only that it had changed and that you were one of the
first to try to use it.

If you don't have the ability to override the spurious warning, your
only options will be to wait longer before using the new version, so
SmartScreen has a chance to learn it's safe from people who can click
past the warning, or to take it up with whoever manages your systems.
There is nothing the Cygwin project folks could do to help other than
never release new software.

There's a bit more information on the "reputation" checking under "How
Microsoft Defender SmartScreen works when a user tries to run an app" at
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device

(For the sake of explicitness, I am a Microsoft employee these days, but
SmartScreen is nothing to do with my role at Microsoft, and Cygwin is at
best tangential.  I don't have any more knowledge or influence in this
area than any non-employee.)

Adam