How do I make a computer program that other computers do not see as a threat?

Factual Questions
1

I am new to computer programming but I (recently) made one for my company.

It’s nothing super fancy. Just automates a task. And it is not a big program at all…quite small really. Used Python as the programming language.

I sent it to a co-worker and their computer got pissy about it and threw up red flags. They got through them all but why was my program flagged?

I have downloaded lots of programs over the years and none get big scare warnings at all.

Why did mine trigger such flags? How do I stop that in the future?

2

There’s almost no way to know that without knowing what flags were thrown.

Same answer as above.

3

It seemed to be some general flag. An executable was running and it was not trusted.

The program merely makes links in a text document someone has written. Nothing fancy or malicious. The links all point back to our website. Kinda like Wikipedia has links to other pages in Wikipedia.

Just trying to keep people on our site (which is not remotely evil).

4

Most software these days needs to be cryptographically signed in order to be trusted.

5

How do I do that? (assuming a simple answer…otherwise tell me to figure it out).

Thanks!

6

I’m not sure how to do it with a Python app, and I’m not even sure it’s possible with a Python script.
On the Mac (which is what I’m familiar with), Xcode (the development environment) will automatically sign a complied app with a key that is registered with Apple based on your developer status (no cost). It’s kind of a pain in the ass, initially, but after all the keys are generated, the app signing is transparent.

7

I’m on a PC using Visual Studio to write/compile my code.

I have not seen a way to crypto-sign anything. It may be there and I have missed it.

8

A quick search shows:

9

Agreed about the code signing. But you’ll need a certificate (with private key) that your organization views as legitimate.

Your IT department should be able to provide that certificate. Or you could create one yourself, but send it to IT so they can set their malware scanner to ignore things signed with that cert. It’s generally better to let them handle it though since they’ll have a certificate chain that handles expiration, revocation, etc. in reasonable fashion.

IT might be able to just handle the whole thing and sign it for you. I guess for a Python script, you’ll want to compile it into an executable first.

10

Can I suggest you consider making it a web app? That would greatly simplify deployment and distribution and would make it compatible with any operating system.

Normally you’d port it to JavaScript (manually or with AI help; it’s pretty good at “porting” from one programming language to another). But there are probably also ways to get Python to run behind the scenes on a website.

Let me know if you want more details.

11

I definitely want more details but not sure this is the place for it nor do I think you should go to that much effort for this.

Thanks though! This helps (as well as @Dr.Strangelove and @beowulff )

12

Also, separate from the signing and the web app idea, are you on a different version of Windows than your users? Did you manually turn down some of your system security settings (like User Account Control)? Weird that they’re seeing errors that you’re not if you’re running the same compiled executable.

How are you compiling Python code into a Windows executable anyway? I may be wrong, but I thought that Python normally requires an interpreter to run and making an executable out of a script requires jumping through some hoops… does Visual Studio include a compiler like that or are using another tool?

13

I have to do it via command line using pyinstaller. I have not seen a button that compiles in Visual Studio (you’d think there would be one, maybe there is, but I have not found it).

14

Well, it’s no bother, but it’s your thread and your call :slight_smile: Feel free to make a new linked thread or just PM me if you wanna chat more. Happy to help if I can.

15

I’ll happily take all the advice you or anyone else are willing to give.

I feel bad for putting you and whoever else to work though.

I certainly appreciate the help.

16

For a Windows app, I think the others here are right about the code signing. Hopefully your company can do it, or you might have to spend money to buy one from a certificate authority: https://cheapsslsecurity.com/sslproducts/codesigningcertificate.html. I think Azure just started offering this for somewhat cheaper ($10/mo), but you have to have been a business entity for 3+ years: Trusted Signing documentation | Microsoft Learn

You can also self-sign it, but that will still result in an “unknown publisher” warning: How to self-sign a Windows executable created with Pyinstaller · GitHub

(It’s crazy to me that the Windows world doesn’t have a free alternative like LetsEncrypt!)

I’ll start a different link thread about the web app stuff. Give me a bit.

17

Hmm, apparently the linked topic was slotted under the individual post I replied to. Might not be the easiest thing to see up above, so here it is: Turning a Python app into a web app for easier distribution?

18

I have to do this a couple times a year for in-house PC applications that I need to deploy on a group of production workstations. Some details have changed over the years, but basically:

  • I had to get set up with a SysAdmin account which has higher privileges than my normal login
  • Once a year or so I have to contact someone in IT to send me the “root” certificate(s) I need to create my own code signing certificate.
  • I log into my workstation with my SA account and run Microsoft Management Console (mmc.exe). In mmc I import the root certificate(s) then generate my own certificate.
  • Visual Studio has a command line tool called “signtool” that I use to apply the certificate to an exe or msi file that I want to distribute.
  • I have to run the application so that it gets blocked by IT security, then I have to open a whitelist request to allow it to be installed.
  • Once the exe or msi has been whitelisted, my cert is good to go. I can apply that cert to any application I write and it will not get blocked when it runs.
  • My cert is usually good for one year and then I have to go through the whole process again.

I realize I’m leaving out a lot of detail but at a high level these are the hoops I have to jump through to keep my PC apps from getting blocked.

19

Not sure if this helps, but when I found our company email system would refuse filenames ending in .exe, I just changed the extension to the filename ending in .virus, which the system thought was fine. I’d also tell the recipient to change the extension back.

20

Hey folks – I’m pretty new to coding and recently made a small Python script for work using PyInstaller. Nothing fancy, but when I sent it to a co-worker, their system freaked out with security warnings. I’ve downloaded tons of apps before and never seen alerts like that, so it threw me off.

Turns out, unsigned programs (especially .exe files) are a big red flag for antivirus and Windows SmartScreen. To stop that, code signing is essential—it proves your app is from a trusted source. I’d highly recommend checking out https://signmycode.com/cheap-code-signing-certificates for a proper code signing certificate. It’s one of the easiest and most affordable ways to sign your apps and avoid those scary pop-ups. So, the computer program that is getting flag warning you can make it safe by purchasing a Code signing certificate and make it safe.

Just wanted to share in case anyone else runs into the same thing! I hope it helps.