• Which the release of FS2020 we see an explosition of activity on the forun and of course we are very happy to see this. But having all questions about FS2020 in one forum becomes a bit messy. So therefore we would like to ask you all to use the following guidelines when posting your questions:

    • Tag FS2020 specific questions with the MSFS2020 tag.
    • Questions about making 3D assets can be posted in the 3D asset design forum. Either post them in the subforum of the modelling tool you use or in the general forum if they are general.
    • Questions about aircraft design can be posted in the Aircraft design forum
    • Questions about airport design can be posted in the FS2020 airport design forum. Once airport development tools have been updated for FS2020 you can post tool speciifc questions in the subforums of those tools as well of course.
    • Questions about terrain design can be posted in the FS2020 terrain design forum.
    • Questions about SimConnect can be posted in the SimConnect forum.

    Any other question that is not specific to an aspect of development or tool can be posted in the General chat forum.

    By following these guidelines we make sure that the forums remain easy to read for everybody and also that the right people can find your post to answer it.

FS Developers Association

L

Lefteris Kalamaras

Administrator
Staff member
FSDevConf team
Messages
37
Country
greece
Gents-

I posted this on the FSX Beta forums, but I'd like to now open up the suggestion to the (larger) group of FS Developers.

Small explanation of the situation as it develops, first:

Starting with FSX, all .DLL and .GAU files that addon products (freeware and commercial alike) will be required to have a code signature verifying the authenticity of the developer (i.e. that the person/organization who wrote the addon is really who they claim to be), in order for Flight Simulator X to run the DLL. If the DLL is not signed, there will be an annoying popup dialog box asking the user if they want to run the "untrusted" gauge and possibly add it to their list of trusted add ons.

This is not a big problem if the addon has one or two gauges, but some addons have tens or even hundreds of smaller gauges added, which will definitely cause headaches to each user and MUCH larger headaches to the developers who will be barraged with each user requesting to know wtf this is all about.

Code signing is an easy enough process but the catch is that it costs about two hundred US Dollars (per year, nonetheless!) to purchase a code-signing certificate from a commercial entity such as Verisign or Thawte. This surely does not present a problem with commercial enterprises (such as our own PMDG), but I can certainly see that freeware authors will not want to spend $200 per year to be able to sign their products.

Fortunately, there is a way around this:

FSDevelopers can become the administrative authority which will create a self-signed root CA certificate. This certificate can then become trusted by all users who want to download and use freeware addons (there's a small two-step process involved, but that will be a one-off deal).

Once a user has decided to trust the FSDevelopers root CA, FSDevelopers can produce code-signing certificates for each developer who is willing to submit identification papers (a simple scan/fax of their passport, or similar ID will be enough). The developers then use those certificates to sign their gauges. Such signed gauges will automatically be trusted by any user who's trusting the FSDevelopers root CA - problem solved!

A step further would be for FSDevelopers to apply for a root CA certificate with someone like Microsoft, so that it becomes a secondary Certificate Authority that is automatically trusted as it will be certified by an already known root CA.

Potential problems:

a) Unless we put our collective weight behind this effort and get it widely recognized, known and accepted, this effort will fail as users won't have the FSDevelopers root CA trusted in their system. We might want to add an automated way of installing the FSDevelopers root CA by means of the FSDevelopers web site. We'll also need to heavily promote this effort by sending out press releases to AVSim, SimFlight, FlightSim and other major news networks.

b) There will have to be one or two administrators who will keep the root CA private key file and thus be able to issue developer certificates. These individuals have to be of known reputation and fame, so that the private key file can be kept, well... Private! ;-) These individuals will need to safeguard the private key and also be involved in the issuance of the developer certificates. As freeware developers aren't THAT many, I don't see the process requiring too much of the admins' time, but there will be an initial burst of applications which will need to be done in a quick timeframe.

c) Verification of the paperwork sent in by developers will need to be done by the admins on reception of scanned or faxed copies of Identification Papers. Again - this requires high trust on those admin individuals. We can't have any doubt cast on those people.

Opinions are very welcome in the general discussion forum.

Best regards,
Lefteris Kalamaras
Precision Manuals Development Group
(and also freeware developer ;-))
 
Hi Lefteris,

As I also wrote on the FSX forum, I strongly support this initiative.

Like you said we will need a wide promotion campaign on the major FS websites but if all associated developers put the authentification logo/banner on their website then this wil already point the users to the "association" creating awareness for other developers but also for the users.

I strongly believe this can work if we all put some effort behind it ! Give me a call if you need any help...

Kind regards,
Björn
 
Hi Lefteris,

I have not looked closely at this problem yet, but from your description is surely sounds like something that we should try to solve as the community together. So I support this idea.
 
I think this should be possible, and I agree with all comments made. The issue I see is maintaining it as a "free service".

I prefer the idea of becoming a secondary Certificate Authority, but I wonder about the costs... Maybe MS or some other entity can sponser this. Difficult to know.
 
This definitely has my support in principle. This site has the potential to become a recognized and respected site so that people can trust what is said here and what comes from it. All of us as developers would benefit from something which recognizes that we are legitimate and trustworthy.
 
When I thought about a Root CA there was the lack for an issuer, I believe that LK gave the solution.

These were my thoughts about the subject now changed to the proposed solution:

If you buy a certificate from an already trusted enterprise they are saying:
I know this guy and what he claims to be he really is.

Now, suppose that fsdeveloper creates a root certificate and gives the PKV and CER files to addons producers. Windows doesn't know FSDeveloper so the site needs to publish the public root key.

What it is saying to the end user is: Windows doesn't know me, but since you do and trust me, you need to import this file to allow windows to know me. Them to the addon producer fsdeveloper can say, you have to come here, lunch with me so I can trust you and give the files.

Or he can say: If 3 well known producers say who you are I give the key. After a while you are well known and can issue the recommendation. This is the web of trust.

I believe that there are enought "known" developers around here to start the web of trust.

José
 
Online chat meeting

Gents-

I'd like to propose that we have an online meeting whereby we can set up the basis for the FSDevelopers association. Those attending will be considered "founding members".

In that meeting, we can select two people who, with my technical assistance, will be responsible for starting the process, setting up the root CA, finding out what's the best solution for applying for secondary trust certification with a major organization, etc. In short, we'll make them "official representatives" of our FSDevelopers association.

We can do this via MSN (chat) or (better) we can do it over Teamspeak, which also allows a recording facility for minutes taking. Obviously, time is a factor for everyone so I think we should keep this short and sweet.

Let's set up a proposed agenda and post agenda items here - to succeed, the meeting should concentrate on discussing two, or three topics maximum. (KISS principle). Also, we should come up with a few (one or two each) individuals we consider good candidates for participating in the FSDevelopers association - that way, we'll expand the founding member basis to 15-20 people thus giving it critical mass for support.

I'm nominating Arno and Nick as minutes keepers and administrators of FSDevelopers.

What say you?
 
Last edited:
Hi everybody,

I really like this idea and would like to join this meeting. I'm fine with both Teamspeak and MSN.

There might be one more problem though: licensing. It certainly will be possible to use one shared certificate for freeware stuff but I fear that Thawte, Verisign,... won't accept the use of such a certificate for payware products. We need to make sure that the whole thing is legal otherwise it might result in really big trouble.
 
Lefteris Kalamaras said:
Gents-

I'd like to propose that we have an online meeting whereby we can set up the basis for the FSDevelopers association. Those attending will be considered "founding members".

In that meeting, we can select two people who, with my technical assistance, will be responsible for starting the process, setting up the root CA, finding out what's the best solution for applying for secondary trust certification with a major organization, etc. In short, we'll make them "official representatives" of our FSDevelopers association.

We can do this via MSN (chat) or (better) we can do it over Teamspeak, which also allows a recording facility for minutes taking. Obviously, time is a factor for everyone so I think we should keep this short and sweet.

Let's set up a proposed agenda and post agenda items here - to succeed, the meeting should concentrate on discussing two, or three topics maximum. (KISS principle). Also, we should come up with a few (one or two each) individuals we consider good candidates for participating in the FSDevelopers association - that way, we'll expand the founding member basis to 15-20 people thus giving it critical mass for support.

I'm nominating Arno and Nick as minutes keepers and administrators of FSDevelopers.

What say you?
Click to expand...

I suppose the most difficult thing would be to get a time when everyone could "attend" worldwide, as some schedules might conflict. What do you propose?

Regards,

Owen
 
Hans Hartmann said:
Hi everybody,

I really like this idea and would like to join this meeting. I'm fine with both Teamspeak and MSN.

There might be one more problem though: licensing. It certainly will be possible to use one shared certificate for freeware stuff but I fear that Thawte, Verisign,... won't accept the use of such a certificate for payware products. We need to make sure that the whole thing is legal otherwise it might result in really big trouble.
Click to expand...

Hans-

this is not targeted for commercial products - I assume that any company or individual charging for their product will assume the $200 per year as a cost of doing business...

As such, this is for freeware enterprises right now. You go commercial, you lose the right to carry the freeware certificate, at least in my opinion.

Lefteris
 
owenhewitt said:
I suppose the most difficult thing would be to get a time when everyone could "attend" worldwide, as some schedules might conflict. What do you propose?

Regards,

Owen
Click to expand...

Hi Owen-

I propose a weekend. Most of us can afford to spend an hour or so on a Saturday evening (or late night, or early morning)... :-)

Lefteris
 
Lefteris Kalamaras said:
Gents-

I'd like to propose that we have an online meeting whereby we can set up the basis for the FSDevelopers association. Those attending will be considered "founding members".

In that meeting, we can select two people who, with my technical assistance, will be responsible for starting the process, setting up the root CA, finding out what's the best solution for applying for secondary trust certification with a major organization, etc. In short, we'll make them "official representatives" of our FSDevelopers association.

We can do this via MSN (chat) or (better) we can do it over Teamspeak, which also allows a recording facility for minutes taking. Obviously, time is a factor for everyone so I think we should keep this short and sweet.

Let's set up a proposed agenda and post agenda items here - to succeed, the meeting should concentrate on discussing two, or three topics maximum. (KISS principle). Also, we should come up with a few (one or two each) individuals we consider good candidates for participating in the FSDevelopers association - that way, we'll expand the founding member basis to 15-20 people thus giving it critical mass for support.

I'm nominating Arno and Nick as minutes keepers and administrators of FSDevelopers.

What say you?
Click to expand...

If we are to do this, I vote for teamspeak. MSN is messy.

I also agree about this being for freeware people only (at least initially).
 
I'm not a suspect since I do freeware but can't understand why is for freeware only.

I believe that FSDeveloper needs some money to pay the site etc. Why can't payware pay a fee that could be used to run the site? If the money is more than enought it could be given to red cross or simillar.

José
 
jcboliveira said:
I'm not a suspect since I do freeware but can't understand why is for freeware only.

I believe that FSDeveloper needs some money to pay the site etc. Why can't payware pay a fee that could be used to run the site? If the money is more than enought it could be given to red cross or simillar.

José
Click to expand...

Valid point. One to discuss.
 
Lefteris Kalamaras said:
I'm nominating Arno and Nick as minutes keepers and administrators of FSDevelopers.
Click to expand...

I have no problem with that. But as I see this as an issue that is more important for aircraft designers, I expect someone with that background to take the lead in the actual action. But I am happy to support it where I can (via the site for example).

Lefteris Kalamaras said:
I propose a weekend. Most of us can afford to spend an hour or so on a Saturday evening (or late night, or early morning)... :-)
Click to expand...

Yes, if we take a time late in the evening here in Europe, it is early morning at the westcoast of the US. So I think that should allow most of us to attend. A weekend is indeed needed, as else it is hard to get everybody online.

jcboliveira said:
I believe that FSDeveloper needs some money to pay the site etc. Why can't payware pay a fee that could be used to run the site? If the money is more than enought it could be given to red cross or simillar.
Click to expand...

Maybe I am missing something, but I don't think we are discussing here how to keep FsDeveloper running? At the moment Nick and I are paying for this site, with the support of all donations (and we have already received some in the last days). So at the moment that is enough to keep the site going and if the site grows a lot in the future we can always look at alternative ways to sponsor it or so.

If I understand this discussion correctly it mainly goes about the fact that modules for FS now need to be certified, or else we get a nagging screen in FsX. As it makes no sense to let each (freeware) developer buy his own verification, we are trying to do that as a community as a whole. Of course doing this as a community also costs some money, but it we split that in some way, each designer has to pay very little. Or maybe we can find a different way to sponsor it, so it becomes really free.
 
Lefteris Kalamaras said:
I'm nominating Arno and Nick as minutes keepers and administrators of FSDevelopers.
Click to expand...

Partly because I agree with anything that involves making Nick working, but mainly to follow up Lefteris' proposal, I hereby second this.

The concept I think is fantastic and takes the discussion we had on the FSX group to the next logical conclusion. I also would agree that TS is the best method available for discussion to us collectively.
 
arno said:
Maybe I am missing something, but I don't think we are discussing here how to keep FsDeveloper running?
Click to expand...

I was just trowing ideas in to the table :)

BTW simconnect managed programs that wish to use clickonce deploy could also benefit from the certificate.

José
 
I certainly support the idea proposed here and would like to participate in discussing this ;)
 
Last edited:
Shall we try to have the online meeting next weekend? This weekend is probably a bit to soon by now :).
 
You must log in or register to reply here.
Back
Top