Software Security. It's About Time

I've been asked by ASE users about the update that was mentioned previously. It was planned to be available for download and installation by the end of January. Since it's not yet available, there's obviously a problem.

Cause of Delay

Please accept my apology for the delay. Recently I made a firm decision not to release anymore installers of ASE Civil or licenses without a digital signature. Internet security nowadays is a MUCH bigger deal than it was back in 2002 when the first version of ASE Civil became available. Downloading software from the Internet really wasn't a "thing" just yet. Most software development companies were still distributing their applications on CDs or DVDs. Installers on the hard media had no need for any type of security other than an activation code.

Paradigm Shift

Fast-forward 22 years & now downloading (& installing in some cases) applications directly from the publisher's website is the status quo of delivery. But with this new convenience also comes a need for tight security. This is simply due to the fact that since the application came through electronic delivery, and not from a disc, there exists a chance that either the download installer could've "picked up" some malicious programs in-transit to you. Or maybe the installer itself might send you to a malicious site, or even worse steal your data and hold it hostage for 'endless' extortion threats. It sounds extreme, but it happens.

Industry Trend of Today

Nobody wants to worry about those potential outcomes everytime an app is installed after being downloaded from the web, which is usually the case nowadays. The solution to the problem was to timestamp the creation of the installer and record that metadata somewhere where anybody in the world could read it. So when you install the software inside the package you downloaded (the installer), you can be assured that it is exactly the same file created by the publisher and nothing has been added to it or removed from it. The installer knows where to check for the digital signature's authenticity because its publisher and the last build info are registered online.

DigiCert to the Rescue?

Since I've already used DigiCert elsewhere, I am already familiar with it. As well, DigiCert are apparently the industry leader when it comes to providing digital signature services for application developers and software distributors that deliver applications to clients through the web. They provide other related services too, but this is my focus now.

Moving Forward

All installable software and related resources created by ASE must be delivered within an installer package that comes from EDI as the verified publisher.

Real-World Experience

I was under the impression this process of getting a digital signature for ASE Civil and it's related resources, would only take a day and a couple hundred bucks. Not so. Not in my case. Here's what I got:

Cost increased to almost triple what was advertised
I've been waiting 2-1/2 weeks for my company's verification
I've chatted with nearly 10 different agents
I could only clearly understand 1 of those agents (an Australian)
Emails have been sent & received multiple times, daily
None of the agents seem to be communicating w/each other
They gave me actions items to address then invalidate the results
I was given incorrect information on at least two occassions by agents
I've been frustrated to the point of sending very ugly emails (not my nature)
I almost abandoned the effort altogether

Order Status

As of February 6, my order is finally complete (or so they say) & a hardware lock is (allegedly) being mailed to me.

Impact on Next ASE Update

It will take a couple of weeks to get the digital signature software integrated into the ASE Civil installer. This pushes back the next release of ASE Civil 2024 to around early March, to be realistic. There's a lot to do in terms of integration, debugging & testing, so please be patient with me. The next ASE Civil is on the way.

3 Comments

cbrenton

Mar 22

Is it your plan that your clients just need this to Install or do we need this to run the program too?

Edited

dev

Mar 23

Replying to

Hi Chris,

This is actually separate from the installer itself. Clients won't do anything different nor will they notice any difference at all in the software itself. However they also will not be warned during the installation that the application is from an unknown source and could potentially harm their computer.

The digital signature identifies a particular installer (or executable) as being created by a developer who maintains an account with a globally-recognized 3rd party organization. Digicert, in my case, holds records regarding my company's location & legal ownership. My assumption is that the digital signature provides clients with some recourse in the event that installing or using a product results in losses or harm to the client or its staff in any way. The creator or distributor of the application can be readily identified and contacted to resolve any issues caused by installing an application.

I wish I didn't have to do this. It's a time-consuming resource drain for EDI in terms of the initial learning-curve related to integrating this technology into the build process. But there's also an annual cost associated with maintaining the globally-recognized account status. The only benefit EDI receives from this is trust from clients and prospects who want to use ASE Civil, but need to know they can do so without any concern of compromising their company's network. I totally get it. I'd want the same for myself too, especially in today's connected world. It seem scams, viruses, phishing and identity theft are everywhere, so I have to tread carefully as well.

Despite the delays and costs this has incurred, acquiring a registered digital signature has become an absolute necessity, especially when it comes to introducing ASE Civil to large, national or international firms whom have never met me nor know who I am. They have no history with me and no reason to trust me or my product. A digital signature gives both clients and prospects some tangible level of security & comfort when using or trying out ASE Civil or any other product distributed by EDI.

I apologize for the time it's taking to get this new system integrated. I've applied a (digital signature) in the past for other projects, but the system has changed a bit from that previous experience. The USB key has been added this time.

Thanks for your patience and support, Chris.

Admin

Feb 09

Finally!

The DigiCert USB token arrived in the mail today!

Now I'll get started integrating this into ASE's .MSI installer, then you'll never see that ugly message again indicating an "Unkown publisher" when you install ASE Civil or any other product we distribute. ASE & EDI applications will be totally legit.

More updates to come...