On: Each Firefox download has a unique identifier

[blibble]

how does this get through the MS smartscreen and authenticode checks?

[dataflow → blibble]

In fact this is how you get past SmartScreen checks. Windows freaks out a lot more when it sees the same file being downloaded by lots of people, but if you make them all different, then it calms down.

[blex → blibble]

Yes, how does the .exe keep its valid digital signature if the hash of the .exe is modified for each person?

Would someone have documentation about which bytes we can modify in a code-signed .exe without making the digital signature invalid?

In the case it's not possible, does this mean Mozilla generates a new .exe on the fly + codesigns the .exe on the fly for each new download?

[laurent123456 → blibble]

As long as the executable is signed (and it must be), and the company well known, Windows should be fine with it.

[eps → blibble]

There is a way to add random data to signed executables without invalidating the sig. Data, not code.

Smartscreen is bypassed by using EV sig, which gives the exe an instant reputation boost.

[blex → eps]

Would you have documentation about this? Where can random bytes be added to a signed exe without invalidating the sig?