Today at Microsoft's MSRA conference, AppEsteem is announcing that we're finally ready to onboard security partners. It's a great deal: we provide free access to the information they need to protect their customers from PUA, and in return they commit to working with us as they "nudge" our sealed customers back into compliance.
Today we're giving both a review of where we are with our beta/pilot, the learnings and pivots we've made, and our request for support. Here's the deck we're presenting: MSRA security partner pilot review.pdf (1.16 mb)
So far we've gotten lots of positive response from the AVs and browser security teams. They've helped us craft solid guidelines, and provided great feedback on the right technology to use. We're looking forward to a great partnership!
If you're a security partner, a software vendor, or a compliance officer, please come register at our site: http://appesteem.com --> REGISTER.
(I'm amazed at how far we've come in just three months. Our dev/research team is now 12 strong; we've got a great slate of early customers, and supportive security partners. I can't wait for the day when the software monetization industry is clean and thriving!)
Today we formally announced AppEsteem at the CSA Summit being held at Google in Mountain View. We asked for customers to join our Beta, and we announced that both Tightrope Interactive and RedBrick have agreed to build sealed installers and download managers for the Beta.
I'm incredibly proud of how far we've come in just two months: we've got AVs and platforms agree to be security partners, and we've gotten good vibes from CSA about how they could rely on our seal to help build a safer, sealed ecosystem.
But as you'll see in my deck posted here, we have a lot to do between now and the end of July in order to pull this off. We'll be working hard, and counting on support from our partners and future customers to make this happen.
(Yshey from ESET asked for a pic of him, Oshrit, and me... he said Daniel really wanted it :-)
Last night, Dan Shiff from Upclick, Oshrit Aviv from Entero, and I spoke at the e-commerce meetup Tel Aviv. Our three companies offer services to software monetization partners: payments, compliance/strategy, and certifications, so our presentations flowed together nicely.
Oshrit said that I should tell the story of why I care so much about getting the bad guys out of the software monetization space. She said it may inspire more people in the industry to gain the courage it's going to take. And she suggested that since everybody in this industry has known me as "Dennis from Microsoft," that maybe I could explain why I left. That made sense to me, so I prepared the talk, and this was the result... I hope you like it!
(And if you're in this space, I hope you're inspired to get your app/installer sealed!)
Here we are after the talk... thanks to Itai P. for letting us join his meetup, and to Klarna for hosting us!
In a few hours I will speak to the CARO attendees here in Bucharest, Romania. I'm asking them to support the creation of the safe haven of a clean and sealed app marketplace. You can see the deck here: Destroying unwanted software together.pdf
AppEsteem is offering anti-malware vendors a great value proposition: it's difficult to keep up with the classifications of the software monetization applications, because there are too many bad apples in the bunch. Making it easy for them to know the difference between vendors who have pledged to be clean and those who haven't, and providing them data and support when there are questions, helps the anti-malware vendors provide more value to their customers. Plus it allows them to get even more strict on the dirty players in this industry.
We'll see how it goes... the talk is at 8:30 AM, after a long party night sponsored by Avira... at least it's a fun topic :-)
I was in China for the past week on a fact-finding mission to see if AppEsteem could help clean up their app ecosystem. I met with teams from Qihoo, Baidu, Microsoft, and ThreatBook to get educated. Here's what I learned:
- The large AV vendors in China (Qihoo, Tencent, and Baidu) have a robust whitelisting service for in-country apps, which they provide to apps for free. These services include company validation and app certification. So while a local Chinese app has to submit at least three times, the process already exists.
- What's considered "clean" and "unwanted" is different in China than the rest of the world. Many apps trusted by Chinese AV vendors would not pass muster with non-Chinese AVs. Which means that vendors will need help getting their apps compliant for the rest of the world.
- The mobile world works differently in China. Since Google Play isn't available through the Great Firewall, there are many Android app stores out there, each with their own approach to curation. This means that it's pretty easy to lure customers to install repackaged, fraudulent, unwanted, and malicious Android apps from app stores with not-so-hygenic practices.
There's definitely a big opportunity, and even some urgency to get it right. But doing business in China is harder than just hiring a local bus-dev person; we'd have to solve language and cultural issues too.
One thing is clear: I have to think bigger than just Windows. I was thinking that I'd tackle Android next year, but now I'm going to spin up some additional research so I know how a sealed APK would work.
So it will take some time to figure out the right approach, and we'll have to find some great local partners to pull it off. I'd like to get something set up by early next year; in the meantime I'll stay focused on getting the Windows beta up and running.
Today I had the privilege of presenting AppEsteem's plans at the SERENE-RISC Spring 2016 Workshop in Vancouver, BC.
SERENE-RISC's goal is to improve the general public's awareness of cybersecurity risks and to empower all to reduce those risks through knowledge. This seemed like the perfect place to talk about how AppEsteem is going to help fix the software monetization industry.
Here's the presentation: Saving the software industry from itself.pdf (2.30 mb). The talk seemed well-received :-)
Next step: get the technology side demo-able in time for CARO on 20 May :-)
Welcome to AppEsteem. We're going to work like crazy to help the software monetization world work safely... and hopefully have a lot of fun with you as we do it.
We can't wait to explain more! But we have to figure it all out, and get ourselves organized, and that will take a little time.
In the meantime, you'll be able to here more about AppEsteem as we present at the following security and monetization industry events:
- Serene Risc in Vancouver, BC on 27 April 2016
- CARO 2016 in Bucharest, Romania on 20 May 2016
- TLV Software Meetup in Tel Aviv, Israel on 8 June 2016
- Clean Software Alliance meeting in Mountain View, CA on 16 June 2016