Failure to update

[Vela Nanashi]

Like I posted @ grc.sqrl:

I think this is a first for me, SQRL said there was a new version, and I told it to update (like it has always been able to do before, and I have not changed anything), and this time it failed with failure code: 8.

Also for whatever reason SQRL self terminates upon failure, rather than stay running, or start its old version back up again, would be nicer if it upon failure tried to execute its old version I think if it was running.

 

[Sludgeguts]

Like I posted @ grc.sqrl:

I think this is a first for me, SQRL said there was a new version, and I told it to update (like it has always been able to do before, and I have not changed anything), and this time it failed with failure code: 8.

Also for whatever reason SQRL self terminates upon failure, rather than stay running, or start its old version back up again, would be nicer if it upon failure tried to execute its old version I think if it was running.

Yep same thing with me just one minute ago.

 

[nutter]

Same here. I've come to my phone to post this because I can't conveniently login on my computer at the moment because of the update failure.

 

[nutter]

I've solved it by downloading the newest version manually, running it and allowing update through the dialogue which appears.

 

[sj phillips]

My download was blocked by Windows Defender Smart Screen. Win10 32 Home Edge

 

[alt3rn1ty]

Same - Running #64, Windows 10x64, I am only using Windows Defender, no other antimalware

failure code: 8

Manually prompted it to check for updates a few times, and get the same error repeatedly ..




All previous auto updates up to #64 were fine, and nothing about my system has changed.

Edit : I also just experienced SQRL self terminating, so its no longer in my system tray, relaunched it from the Start menu.

 

[curlym]

Noticed when trying to do full download that Microsoft Edge blocked it. Chrome loaded exe file Ok

 

[shanedk]

Same here, Code 8 on Win10 x64.

EDIT: It worked fine on Linux.

 

[nutter]

@alt3rn1ty
You can try to download from here (you shouldn't trust and click on my link ) and run it, following update prompts and it should work, assuming you can download it (see above comment from @curlym ).

 

[alt3rn1ty]

Yes I have the link already bookmarked in Chrome, but would rather keep #64 in case Steve wants to push another update in an attempt to fix whatever the problem is, which may succeed, and we can then confirm.

Manually updating to a new version will mean we cannot test any solution.

I saw Steve posted about Virustotal having a few vendors giving false positives, maybe Microsoft is also using similar signatures shared universally preventing this update.

 

[Gage]

This just happened on my Windows 10 system as well. Same failure code (8) and no security software running other than Windows Defender. Downloading the latest version manually and updating by installing latest executable in the system mitigated the issue.

Edit: It's probably related to what @Steve posted about VirusTotal and Windows Defender at https://sqrl.grc.com/threads/sqrl-interim-release-65.558/

 

[Dave]

I went to www.grc.com/dev (entered manually, @nutter) and got:



followed by:

 

[nutter]

@alt3rn1ty good ideas!

 

[nutter]

I went to www.grc.com/dev (entered manually, @nutter) and got:

View attachment 328

followed by:

View attachment 329

Oh. Were you using Edge browser? @curlym had a problem with that, but not with Chrome

edit: virustotal thinks it's OK aside from what is probably a false positive from Cylance
another edit: and it's signed by Gibson Research Corporation. Is yours?

 

[alt3rn1ty]

I also tried downloading it manually just to check the file, Chromium downloads it just fine.

Also right click and Scan it with Windows Defender did not give any bad results, Defender thinks its clean here.

 

[Steve]

I am sorry to put everyone through this hassle... but this MUST BE
due to the lack of reputation of my newly minted code signing cert.
(And thank goodness it's happening NOW and not when this app was released!)​

I have just RE-SIGNED 4 of the top 5 freeware exe's at GRC (SecurAble is a bit trickier to build, but I'm about to) using this new "EV" code signing cert. Many thousands of them are downloaded every day. So before too long the benign use of this new cert should spread and become widely known.

The only explanation for this sudden problem is that code signed by this cert hasn't yet established a reputation for safety, coupled with the fact that it DOES perform scary-looking self-installation, which malware will also do. When you think about it, it =totally= makes sense that A/V heuristics SHOULD initially mistrust anything signed with a previously unknown cert -- no matter by whom and from whom -- since anyone can get one, and malware must be doing this now all the time.

 

[jk_physics]

Hello all. I totally understand the app signature being the problem, but if we explicitly allow the app through our firewall, turn off Defender temporarily, and don't have any other AV running, then what else on a Windows 10 system would be blocking it? I'm not totally familiar with all of Window's sub settings.

 

[nutter]

I am sorry to put everyone through this hassle... but this MUST BE
due to the lack of reputation of my newly minted code signing cert.
(And thank goodness it's happening NOW and not when this app was released!)​

I have just RE-SIGNED 4 of the top 5 freeware exe's at GRC (SecurAble is a bit trickier to build, but I'm about to) using this new "EV" code signing cert. Many thousands of them are downloaded every day. So before too long the benign use of this new cert should spread and become widely known.

The only explanation for this sudden problem is that code signed by this cert hasn't yet established a reputation for safety, coupled with the fact that it DOES perform scary-looking self-installation, which malware will also do. When you think about it, it =totally= makes sense that A/V heuristics SHOULD initially mistrust anything signed with a previously unknown cert -- no matter by whom and from whom -- since anyone can get one, and malware must be doing this now all the time.

It's all part of the fun and games.

And thank goodness it's happening NOW and not when this app was released!

Indeed. How would this be approached in future if you wanted to use new certs? Could you build the reputation another way before using the cert for sqrl?

 

[Steve]

Indeed. How would this be approached in future if you wanted to use new certs? Could you build the reputation another way before using the cert for sqrl?

That's really a good question / point... and it definitely merits some planning ahead of time. I have 3 years before this occurs again.

 

[shanedk]

Is there a way to have the new cert signed by the old, so they know it's from the right person?