On: Codehash.db – A public database for software and firmware hashes

[j_s]

Is there any accommodation for the per-user downloads implemented by Chrome, Dropbox, etc. (each with their own ways of sneaking around Authenticode verification)?

https://textslashplain.com/2016/05/13/cheating-authenticode-...

[gruez → j_s]

Why would they even do that? After you get a signing certificate, you can sign as many times as you want, so it's not like they're saving any money.

[quicklyfrozen → gruez]

Even if the installer is signed, Windows and/or your AV will warn you if it's a package that hasn't been downloaded by many other users.