Confusing experience even for a technical user #90
Description
I honestly think User Experience (UX) is a key to any kind of tooling. The ability to intuitively use it without study is important. I like the idea of Block Block but I've got no idea if this alert is important or not.
What does this mean? It has no results on Virus Total. It would be easier to use if this screen had supporting info like Certificate Status, Signer, etc. Any sort of log of similar updates to this file-path.
No results on Virus Total could be suspicious because uniqueness suggests an attack rather than an upgrade. This could be mentioned. Some prelim investigation would be useful.
I'm just making this issue thinking about how security should be for everyone. Not just technical users. Good UX helps a lot for opensource security, so I'm posting this with that in mind.
If you'd leverage the crowd-effect of visibility of popular software normalcy (hashes, paths, certs, and such), then it could be known if a SharePoint upgrade was normal or not, but it'd mean more telemetry from users, and that could be done with a careful hand so as not to impinge on privacy.
There should be some statistical thresholds from sampling user software installation meta-data, that would prove authentic software is different to malware.
