Port 25 - Communications from the open source community at Microsoft

Comments RSS

1. fluke said:

   I consider Winqual a step in the right direction.
   
   The website is at:  https://winqual.microsoft.com/
   
   However, without a login, there is not much to look at.
   
   The Class 3 Cert required is available from:
   http://www.verisign.com/products-services/security-services/code-signing/digital-ids-code-signing/designed-for-windows.html
   
   I am not sure how this is helpful to the FOSS community.  The Class 3 Cert is only available to businesses at the cost of $500 per year.  So, it seems like someone like OSDL or SourceForge would have to get into the business of signing so that FOSS developers can become sub-developers of OSDL or SF.  And all of this to get QA through an API/method that works only on a single vendor's platform.  Any other ports for the application is not addressed.
   
   According to VeriSign support, Authenticode certificate is not in any standard format (PEM, DER, PKCS#7, PKCS#12, etc) which would also mean that anyone that wants to get into the signing business will also need to use Microsoft tools to work with the MS/VeriSign propietary format.  This, of course, would even lower the odds any FOSS friendly company would step forward in taking such responsiblity.
   
   If, on the off chance, VeriSign does provide Authenticode certs in a standard format, that would also indicate that MS is forcing developers to buy certs from a company that doesn't know their own product.
   
   I don't mean any disrespect, but there seems to be more return in terms of price and time to just use the code for Mozilla's QA crash agent.  Once you get over the learning curve of how to wrap Mozilla's work around a different application, you then have a QA system that has been proven on multiple platforms without having to every year deal with Verisign directly or indirectly.
   
   But, some questions I am still left with:
   
   Is there any requirements to be able to run ActiveX to use Winqual?
   
   Does accessing Winqual dumps end up always being a manual process or is there code provided to help automate having dump events generate tickets in a developer's own bug tracking system?
   

   posted at 07:21PM 05/18/2006
2. JasonHar (MS) said:

   Although currently the only supported certificate used to establish a Winqual account is a Class3 VeriSign certificate, we are working on providing supporting establishing an account with other certificate authorities in the future.  The Certificate is simply used to establish that you are the company you say you are at the time of account registration.  There is no other requirement around signing your code files, or having to purchase a certificate each year.
   
   Windows Error Reporting is available to any application running on Windows XP or higher client platforms or Windows Server 2003 or higher server platforms.  The ability to access crash data for your applications running on these platforms is just a baseline of value offered through the Windows Error reporting service.  
   The service enables you to view these reports group by product.  In addition to seeing the holistic list of events (and respective metadata such as Operating System, Language, and Average reports per day) we offer aggregation views of the top 20 reports by Volume and Growth over the past 90 days.  This enables prioritization to fix the problems with the most hits or problems that are growing fast and will soon have the most hits.
   The service also enables a company to register a response to be associated with a crash of a set of crashes (based on a file and version range mapped to your company) that will be displayed to the end-user when the crash is encountered in the future.  These responses can direct the end-user to an update, knowledge base article, or even information that the product is no longer supported.  
   
   Overall, the Windows Error Reporting service enables you to close the loop with your customers and aid in distribution of reliable updated software.
   
   <Is there any requirements to be able to run ActiveX to use Winqual?>
   There are services on Winqual that leverage ActiveX controls today, but in general for most of the services (such as Windows Error Reporting) supporting ActiveX controls is not required.  
   Overall, the general Winqual privacy policy, security policy, and requirements are located at https://winqual.microsoft.com/help/about_winqual.aspx.  
   
   <Does accessing Winqual dumps end up always being a manual process or is there code provided to help automate having dump events generate tickets in a developer's own bug tracking system?>
   Working with Crash data is a manual process today that requires a user to log into Winqual to view/download crash information.  However, we are working on new features that include subscription services for crash events that can be configured (for instance, subscribe to events that exceed a certain threshold/growth% over a period of time).
   

   posted at 02:49PM 05/24/2006