ebook .exe format download and virus scanners

[Mary van Kemenade]

Hi, I love the ebook format. For now still plan to use the chm as the 'main' publishing format but for excerpts of the manuals in the ebook format. My IT department has expressed concerned that users would not be able to download or they could download and it would be blocked by virus scanner because it is an .exe file. They are hesitant to use the files because they think everyone will have issues and want to use the PDF (which I really dislike for so many reasons...)Has anyone encountered any issues with people having trouble accessing the files via download? thanks

[Tobias Escher]

Same here. I would never download an .exe file where I am not 100% sure where it comes from.
I usually even do downloads on a virtual machine and only later copy them over.

[Tim Green]

Yes, this is a potential issue. However, it is just as much an issue for CHM files: CHMs have exactly the same security classification as EXE files on the entire web, because they still have full access to ActiveX (which is now an anachronism), which allows them to do literally anything on your machine. Actually, CHM files are even more restricted on Windows than EXE files: Even if you mail a CHM file in a ZIP or other archive, Windows will almost always notice this and block it when it is received. It is not even possible to send a CHM as an attachment from a GMail account, even if you pack it in a zip (try it).

The main thing you need to do on EWriter books for distribution is to sign them with a digital code signing certificate. This costs a little, but it is really worth having and it makes trusted distribution possible, because your signature with your details (those you include when getting the certificate) become part of the file. This is exactly how software for Windows is distributed: That is why you can download the installer files for Help & Manual updates without them being blocked, for example, because they are signed with EC Software's code signing certificate. If they weren't, both your browser and Windows would throw a hissy fit when you tried to download and run the installer.

See this page for an introduction to digital code signing certificates and how to get them.

You should definitely sign your EWriter EXEs if you install them together with your software -- but then you will already have a signing certificate for your software and you just need to use it for your EWriter EXE as well.

Generally, EWriter files in their present form are probably not ideal for direct distribution by download because of the EXE issue. If you are just publishing eBooks it is better to use ePub or Kindle/Mobi instead for that. In the future we may provide a mechanism for separating the viewer and the book portions of EWriter. Then your users would install the viewer once and they would then be able to download the neutral book portion in the same way as an ePub or Kindle book. We wanted to avoid that initially, because in the past all new help formats have been hobbled by the need to install a separate viewer. Having everything in the book itself make its use as a CHM replacement much easier.

[julio]

We tried using CHM on our website's download area but Windows automatically blocks it, so you must teach users how to unblock it. Our solution was: CHM format goes with installers and PDF goes with the download area. As H&M ebook format is an executable, you may find difficult to convince IT professionals that it is a perfectly safe document.

[Tim Green]

Hi Julio,

We tried using CHM on our website's download area but Windows automatically blocks it, so you must teach users how to unblock it.

Exactly -- see what I wrote about CHM files above as well.

Our solution was: CHM format goes with installers and PDF goes with the download area. As H&M ebook format is an executable, you may find difficult to convince IT professionals that it is a perfectly safe document

As I noted, the first important step is to sign your EWriter EXEs, but that still won't overcome the psychological barrier. For that we need to have a separate viewer with a signed once-only installer and neutral eBook files that only contain the content.

[Mary van Kemenade]

Thanks Tim I will let the guys know about signing and see how we go!

[Darren Rose]

I can highly recommend this website for good priced code signing certificates - have used them myself for several years now

http://www.ksoftware.net/