Why Windows warns you before installing Stayaway
Stayaway's installer is not code-signed yet, so SmartScreen shows a warning. What it means, why we have not bought a certificate, and how to check the file.
By the Stayaway team3 min read
When you run Stayaway's installer for the first time, Windows shows a blue box that says "Windows protected your PC". That happens because the installer is not code-signed yet. To continue, click More info, then Run anyway.
It is a fair warning, and we would rather explain it than hope you do not notice. Here is what it means, why it is there, and how to check that the file you have is the one we built.
What the warning is saying
Microsoft Defender SmartScreen checks programs you download before they run. It asks two questions: does the file carry a signature from a publisher Windows can identify, and has Windows seen enough people run this exact file to trust it?
Stayaway's installer answers no to both. It has no code-signing certificate, so Windows shows the publisher as unknown. And each new version is a new file with no history, so there is no reputation to lean on either.
SmartScreen cannot tell the difference between an honest app from a small team and something harmful. It treats every unsigned newcomer the same way, which is the right default for it to have.
Why we have not signed it yet
A code-signing certificate ties a file to a verified publisher. It costs money every year, and for a product this new we decided to spend it once Stayaway has paying customers, and until then to be open about the warning rather than bury it under a download button.
Signing would change one thing: the warning at install time. It would not change what the app does once installed, and it is not a promise of anything beyond who published the file.
Why antivirus software may flag it too
Some antivirus engines may flag Stayaway as well. It simulates mouse and keyboard input and registers global keyboard shortcuts, like Alt+X for Emergency Stop, and that is behaviour those engines are right to look at closely. We would rather tell you now than have it come as a surprise.
How to check the file is ours
Every installer's SHA-256 checksum is published on the download page and beside each release. The checksum is a fingerprint of the file: if a single byte changed, it would not match.
To check your copy, open PowerShell in your Downloads folder and run:
Get-FileHash .\Stayaway_<version>_x64-setup.exe -Algorithm SHA256
Put in the version number from the file you downloaded. PowerShell prints the hash in capitals; the letters and digits should match the published one exactly, whatever the case. If they differ, do not run the file. Download it again, and write to us if it still does not match.
What about updates?
Updates are a different story. When the app installs an update itself, it checks the update against a signing key built into the app, and refuses any update that is not signed with it. That key is ours and separate from the Windows certificate question above, so an update cannot be swapped for something else on the way to your computer.
In short
The warning appears because the installer is unsigned and new, not because anything is wrong with it. Click More info, then Run anyway, and if you want to be sure, compare the checksum first. When Stayaway is signed, this post will say so.