Reply to thread

Message

<blockquote data-quote="struppigel" data-source="post: 1035009" data-attributes="member: 86910">Depending on whether you download the file from here: <a href="https://www.glasswire.com/download/" target="_blank">Free Firewall Software by GlassWire</a>Or from here: <a href="https://www.glasswire.com/changes/" target="_blank">GlassWire Software Version Changes List</a>You will either get one that matches the hash or one that does not match.The only significant difference between both files is tracking information in the installer that shows up as not signed on VT:[ATTACH=full]274393[/ATTACH]Putting the tracking info into installers is common practice. Doing so in the certificate structure does not break the signer information for most systems. The only systems where that is broken is when you enabled strict signature enforcement in the registry which some of you have done.More info about that is here: <a href="https://web.archive.org/web/20150426192725/http://blogs.msdn.com/b/ieinternals/archive/2014/09/04/personalizing-installers-using-unauthenticated-data-inside-authenticode-signed-binaries.aspx" target="_blank">Caveats for Authenticode Code Signing - IEInternals - Site Home - MSDN Blogs</a>Now it seems to me that all this is on purpose. GlassWire cannot provide correct hashes AND at the same time store tracking information. So they decided to put different installers on their pages in the hopes that the ones checking the hash will use the download button on the hash page.For all I know both files are clean, but I would still use the one from this site: <a href="https://www.glasswire.com/changes/" target="_blank">GlassWire Software Version Changes List</a></blockquote>

[QUOTE="struppigel, post: 1035009, member: 86910"] Depending on whether you download the file from here: [URL='https://www.glasswire.com/download/']Free Firewall Software by GlassWire[/URL] Or from here: [URL='https://www.glasswire.com/changes/']GlassWire Software Version Changes List[/URL] You will either get one that matches the hash or one that does not match. The only significant difference between both files is tracking information in the installer that shows up as [B]not[/B] signed on VT: [ATTACH type="full" alt="campaignid_glasswire.png"]274393[/ATTACH] Putting the tracking info into installers is common practice. Doing so in the certificate structure does not break the signer information for most systems. The only systems where that is broken is when you enabled strict signature enforcement in the registry which some of you have done. More info about that is here: [URL='https://web.archive.org/web/20150426192725/http://blogs.msdn.com/b/ieinternals/archive/2014/09/04/personalizing-installers-using-unauthenticated-data-inside-authenticode-signed-binaries.aspx']Caveats for Authenticode Code Signing - IEInternals - Site Home - MSDN Blogs[/URL] Now it seems to me that all this is on purpose. GlassWire cannot provide correct hashes AND at the same time store tracking information. So they decided to put different installers on their pages in the hopes that the ones checking the hash will use the download button on the hash page. For all I know both files are clean, but I would still use the one from this site: [URL='https://www.glasswire.com/changes/']GlassWire Software Version Changes List[/URL] [/QUOTE]

Verification