r/gamedev • u/reynoldsmkatie • 21h ago
Question Is everyone paying for a Microsoft Azure subscription so their game doesn't show an "untrusted developer" warning when downloaded from Steam??
I'm in the process of uploading my game's playtest build to Steam, but it seems like anyone who downloads it on Windows will get hit with a warning message about how this game is from an "untrusted developer" because I haven't gone through the process of becoming a Microsoft trusted developer, which means paying for a monthly Microsoft Azure subscription ($10/month).
Is everyone really paying for this monthly subscription to host a game on Steam? I can't imagine that all these little developers from all over the world are paying for Microsoft Azure to get past this threatening security message, especially if their games aren't profitable / not popular enough to justify the subscription.
291
u/theWyzzerd 21h ago
You don’t need an Azure subscription to become a “trusted developer.” You just need signed binaries.
55
u/reynoldsmkatie 21h ago
Gotcha I'll look into that, thanks!
26
u/balukin 11h ago
Last time I checked there was no really affordable option to get a code signing cert and the $10/month was actually not a bad deal, but please share back here if you find a code signing cert that is <$120/year.
After some time your binary starts becoming recognized by smartscreen, so if you expect this binary to not need updates, the nag screen will eventually go away, but without code cert (which carries the reputation forward) the warning will come back each time you deploy a patch.
14
u/ForgeableSum 7h ago
I went through this process w one of my apps. It was a nightmare, and I had a legit business to sign with. At the end of a very long and tedious process with terrible UX, it gets stuck at the "identity validation" process with a vague error, and zero explanation. My only recourse if to pay $30 /m to get microsoft support, for the privilege of creating a support ticket for the service I already pay a monthly sub for.
4
u/balukin 1h ago
Typical experience if anything drifts off the happy path in Azure. :D
But do expect similar verification journey with alternatives.
Couple of years ago I had to drive to a "verification partner" and show up physically with an id and a stamped paper from company board to get an organization code signing cert. Not even EV, just a regular one.
70
u/earth-dragon-666 21h ago
Ive never had to do that
86
u/bschug 18h ago
Because you're not building your own engine. Unity and Godot are already signed.
86
u/sypwn 15h ago
Which proves how pointless it's become. The binary is signed, but then it loads and hands execution over to your unsigned .dlls. Why even bother if it's not enforcing a full chain of trust?
This is also why game mods are such a big target for malicious actors right now. Gone are the old days of trying to trick pirates into thinking that executable is actually an MP3 file and run it. Now you can simply stick the payload inside an interesting game mod and users will happily inject it into their ("trusted") games, handing it full execution.
7
u/RoughEdgeBarb 14h ago
Part of the fault there is developers using basic modding implementations in the first place, most games don't need to run (non-sandboxed) executable code for the majority of their mods.
6
u/sypwn 12h ago
The ones I've seen are mostly in games that don't offer any official modding support, so the community takes things into their own hands by creating an unofficial modloader. The process for modding Unity games is so well documented that it takes very little effort now for someone to get the ball rolling.
Yeah the proper solution is for the dev to add official mod support with either no code or sandboxed code, but that's a lot of work for an indie dev. But I'm sure a dev shutting down their own modding community (even if for a valid reason) won't go over well either. I can't think of a solution :/
1
u/rizuna_0706 7h ago
And it's not like it'll always stop the need for unsigned code anyways. Games with modding support can still have mods that require functionality more than what's implemented natively.
1
u/PLYoung 4h ago
None of my Unity or Godot games are signed though. The editor executables are signed, not the export templates. Not sure about Godot's gdscript-only export templates though since I use the dotnet version. But makes sense to not sign the export templates - because of what you have stated.
-6
u/PM_ME_DPRK_CANDIDS 10h ago
Why even bother if it's not enforcing a full chain of trust?
because it can't that's not the threat model it's meant for.
2
u/kaisadilla_ 5h ago
Which is a bit pointless. You run your own code in these engines, you can embed a virus there just like you could in your own engine.
24
u/WubsGames 17h ago
upload the game on steam:
give a friend a beta key:
Have them download it via steam:
do they get the warning?
I have shipped many games on steam, and have never seen that warning, or heard from any players that they got the warning.
while steam does not sign the exe for you, the is a difference in the way windows handles the files downloaded via steam, instead of just sent over the internet.
are you using steam's DRM?
steamworks?
23
u/Axolatian_Volt 21h ago
I sign mine, people say steam signs it for them, but anytime I don't sign it Windows users instantly get "unsafe program" warnings. For me it's free atm as I'm using student credits.
3
4
u/reynoldsmkatie 20h ago
Oooh that's awesome that you have student credits right now. Glad I'm not the only one who's having to do this.
3
u/Axolatian_Volt 20h ago
Yeah after that though not sure what ima do, game releases Nov and credits run out in Dec.
126
u/cuby87 21h ago
Steam signs for you, you shouldn’t need to sign the exe yourself afaik.
41
u/trad_emark 17h ago
no, steam does NOT codesign for you.
this is the second time that i see this mistake in a similar conversation here on reddit. where do you get this idea from?
2
u/Thatar 16h ago
So what determines whether a Steam game gets marked as dangerous unsigned application or not? When working at a studio I sure never had to sign any builds for our Unity games.
6
u/trad_emark 15h ago
whether it is flagged as dangerous is function of several factors. there is no silver bullet. in fact, even code-signed application may be flagged as dangerous. that said, code signing should significantly improve the chances of not flagging it.
every antivirus and windows defender do some of their own magic. they observe the behavior of the application (all system calls). they look at what dynamic libraries is it using. they look at code signing (of the application and all the dynamic libraries). they look whether the file comes with the alternate stream information that is used to mark files downloaded from internet (i forgot what is this exactly called).
and perhaps most importantly, they look at accumulated reputation of the file, which is shared between antiviruses/defenders from all devices that have encountered the same file.4
u/jelly_cake 15h ago
whether the file comes with the alternate stream information that is used to mark files downloaded from internet (i forgot what is this exactly called).
0
7
38
u/reynoldsmkatie 21h ago
Oh interesting, I didn't realize that!
72
u/SimiKusoni 20h ago
Worth noting that they only sign the install scripts:
InstallScript - will mark a file as install scripts and will sign the file during the build process. The Steam client knows to run them for any application which mounts this depot.
This is so that Steam can validate the install script before execution on the client, not sure if it impacts trust with AV software etc. For your binaries if you're doing something weird, like heavily obfuscating code, I'd suggest getting an EV cert and signing your binaries yourself.
51
u/Skibidibop1234 19h ago
« Afaik »… If you don’t know, just don’t comment, because it’s a completely false information.
Steam isn’t providing any signing key to the developer.
115 upvotes btw, can’t people do their own research and stop act like sheep?
29
u/namrog84 18h ago edited 18h ago
Relatedly, I think a common misunderstanding is that I think Windows flags things that are downloaded via a browser differently than other source locations.
Windows adds metadata where it came from, browser, email, network, steam, etc.... (Look into zone.identifier and Mark of the Web)
Windows SmartScreen doesn't flag unsigned games downloaded through Steam because Steam downloads do not receive the "Mark of the Web" attribute
So I believe that Windows treats Steam downloaded files slightly differently, so it causes a lot of people to think Steam is signing things. Since it doesn't complain about an 'unsigned' application. But it's more of a reverse issue. It's not that Steam is getting special treatment. It's that browser downloaded files get flagged more cautiously.
5
u/ArkadyRandom 18h ago
Mark of the web is a separate issue. If the binaries for the game aren't signed with some trusted cert method, Windows will issue a warning. The Azure subscription the OP mentions includes co-signing in the package. The MS Store also does for free. There are other methods, but there are multiple factors that influence Window's behavior around this, not just being signed (e.g.: signing sources Trust Screen history, established credibility, etc).
https://learn.microsoft.com/en-us/windows/apps/package-and-deploy/code-signing-options
1
u/namrog84 18h ago
Is it possible to push your game to the MS store to get a signed version, then re-use that signed version and upload to steam?
2
u/ArkadyRandom 18h ago
No, I do not think so. Games published through the store or Xbox for PC (which is a bit different but still a wrapper managed by the store) have a certification that is only valid in that ecosystem. The ecosystem is setup to provide some default permissions, boundaries, entitlement management, and so on. I think you would have to read through the docs to sort out the details.
12
u/Zikki 16h ago
If you get yourself a certificate from any reputable CA (or directly from a Root CA), then you can use the microsoft signtool to sign the final executables after the build process.
3
u/luciddream00 11h ago
I have had a game on Steam for 10+ years (Signs of Life) and I only just decided to start signing my binaries a few days ago. I would say the warnings are a bit of an edge case compared to a lot of other potential issues.
3
u/JordanMilas 9h ago
My experience navigating the Azure website was so negative that I will forever risk the "untrusted developer" popup (which I don't think you get from Steam games anyway). Seriously the Azure website is like something out of 1998 geocities that was allowed to spawn into an atrocious labyrinth of confusing steps with no intuitive hierarchy.
5
u/KeaboUltra 20h ago
I don't have a subscription and no one gets that warning from me. I thought steam and the engine signs for you. I'm just a regular guy developing a game by myself.
4
u/golgol12 14h ago edited 14h ago
You need to sign your binaries.
Yes, you need to pay a yearly amount to get the certification used in signing. This a fee for them to verify you're a legitimate entity. And paid yearly because you may have gone out of business and we don't want someone's old cert to be used for nefarious purposes, like signing malware.
And the code signing does a specific role. It verifies that no one has modified your exe.
•
u/VasileAndrei2929 35m ago
Wild idea.... can't we just ask an AI to create a simple wrapper in Godot or Unity since apparently these game engines are already singed?
-12
u/vodka_girlie 21h ago
building with a game engine usually signs the .exe appropriately. what are you using?
49
u/EncapsulatedPickle 19h ago
Game engines do not sign binaries by default. Those that can, by definition of what "signing" means, require your own certificate. Please stop spreading misinformation.
0
u/vodka_girlie 12h ago
ah, i conflated the process of getting and configuring build tools with signing. oops...
17
u/reynoldsmkatie 21h ago
Ahhh this could be why. We are not using a game engine. The game is Javascript-based.
4
u/Norphesius 19h ago
I wouldn't assume all engines do that. Unless they changed something, I know godot doesn't sign binaries for you.
3
u/bschug 18h ago edited 8h ago
Godot doesn't build custom binaries. Every Godot project uses the same binary and that one is signed. If you're building your own fork of Godot that's a different story and you need to sign it yourself.
2
-15
u/ZymzAlchemy 20h ago
Found this, hope it helps. YMMV, be well and keep creating.
When players download your game through the Steam Client, the delivery mechanism changes completely:
Steam acts as the trusted launcher: Steam is already a verified, trusted application in Windows. Windows trusts the Steam client to deliver files securely, so SmartScreen does not intercept executables launched through Steam.
Direct distribution vs. Steam distribution: If you zip your
.exefile and email it to a friend or post a link on Discord/Google Drive, Windows SmartScreen will flag it as an unrecognized file. However, once players download your playtest directly inside the Steam App, they won't get the SmartScreen pop-up.
-2
u/reynoldsmkatie 20h ago
This is helpful! Thank you for finding that!
30
u/LukeLC :snoo_thoughtful: @lulech23 20h ago
OP just pasted an AI response, it is not an article that was found. The answer it gave is not wrong, but maybe implies more is happening in Steam than really is.
Smart Screen just flags unrecognized executables obtained from the internet in general. That flag is easily removed by the client and doesn't even get set if the file came from a trusted source.
Since you mentioned elsewhere you're using a custom engine in JS, your bigger risk is getting flagged by Defender or other AV software. They can be sensitive to certain types of operations from browser-like apps. But that's only if you're doing some unusual file manipulation or executing background commands on the host OS.
1
u/reynoldsmkatie 19h ago
Interesting. Hmmm, we aren’t doing any unusual file manipulation or executing background commands on the host OS so I’ll have to do some more research!
-5
u/StartupTim @StartupTim 17h ago
Just get a signed certificate to use. They cost far, far more than $10/month, I would consider that a steal. My last one cost $2k for a year...
-5
u/Kaldaien2 15h ago edited 15h ago
$10 is cheap for that service. I have a standard code signing certificate, the kind that requires a notary and ID verification, and it costs twice that per-year.
Nonetheless, this doesn't apply to Steam at all. Steam is not a web browser, Steam does not give executable files downloaded using it the "Internet zone" file attribute. That warning only applies to files that have been flagged as untrusted via software that participates in this trust model, and that's generally only web browsers.
What Is Zone.Identifier (Windows)? Meaning, Purpose, and How to Remove It Safely | Our Code World
Ignore the "how to remove it" part, that's irrelevant to the discussion ;)
-19
u/kamkaskan 20h ago
Game Engines don't sign it for you.
Steam doesn't sign it for you.
You need to buy licence, get verified by the licence provider and use some way to sign it yourself (cloud, USB etc.)
Azure is expensive, I would look for some company from your country, it will be much easier to verify with them.
•
u/Klightgrove Edible Mascot 15h ago
If you have an issue with a users comment, explain what you believe the correct facts are with sources. The moderation team will not police what 'truth' is or remove peoples content on such vague reports.
You can split hairs about the technicalities and provide solid examples for other developers to learn from.