Search code examples
windowsgoogle-chromedownloadexecode-signing

How to prove to Chrome my executable is safe

I've written a program that I would like to share, but Google Chrome makes it impossible for others to download it, citing that it may be "dangerous"

Dangerzone

The language is extremely alarming, and more importantly, the UI only gives the option to Discard it. I understand this is to curb the download of viruses, but my program is just a benign toy. I suppose my problem is that I'm a false-positive with no money.

Code Signing might help, but it is prohibitively expensive and not something I feel is ethical. But this should not be the cause because in chrome's FAQ it cites:

cold comfort https://support.google.com/webmasters/answer/3258249

But I'm left with no clues on how to correct this. There's no way to fix the 'uncommonly downloaded' problem because a program with this kind of warning is going to remain uncommonly downloaded. I don't want to have to put it in an archive (not that it would help, chrome is smart enough to check inside zip archives).

What steps can I take to prove to chrome that my executable is safe? I have no money to throw at this, but I can change the executable to rectify any red-flags. It is factually safe and self-signed, and would pass any CA's verification and QA process. Ultimately, this file would be hosted on Patreon if that might help it.

Solution

  • "Uncommonly downloaded" warning

    If Google Safe Browsing hasn't seen a particular binary before, Chrome may warn that it is uncommonly downloaded and could be dangerous. In these cases the warnings are lifted automatically if Google Safe Browsing verifies that it is benign.

    If your site is showing uncommon download warnings, you can also request a review in Search Console.

    While the Google page doesn't specifically call out your situation, you can Request a Review, so Google can check to see if your binary is actually harmless. I believe they eventually get around to doing it, but you can request it be done: Google - Review Request

    You should check your Security Issues Report to see if anything is in there to address as well.

    I hope this helps.