“Windows protected your PC” is not what most people think

Ship a small free Windows tool and you will meet a blue dialog that says "Windows protected your PC." Most people read that as "this file is dangerous." It does not mean that, and the difference is worth understanding whether you are installing software or publishing it.

What the warning actually says#

SmartScreen is a reputation service, not a scanner. When you run a downloaded executable, Windows asks a simple question: has this exact file been seen enough times, from a publisher we recognise, to be considered established?

If the answer is no, you get the blue screen. That is the entire mechanism. It is not reporting that something was found in the file. It is reporting that nothing has vouched for it yet.

Windows Defender, which is a scanner, runs separately and would tell you something quite different if it objected. SmartScreen going quiet is a statement about popularity and paperwork. Defender going quiet is a statement about content.

There are two ways to make the warning go away. Be downloaded by a very large number of people, or buy a code signing certificate so the reputation attaches to your publisher identity instead of the individual file.

Why it comes back on every single release#

This one surprises people, including developers. SmartScreen ties unsigned reputation to a specific file hash.

Change one byte and it is a new file with no history. So a project that ships a bugfix a week never accumulates anything. Version 1.0.1 starts from zero reputation even if 1.0.0 was downloaded ten thousand times without incident. The warning is not sticky in your favour, only against you.

The practical result is that active maintenance is penalised. A tool that is updated regularly looks permanently suspicious, while an abandoned binary that happened to go viral looks trustworthy.

What the certificate actually costs#

A few hundred dollars a year, renewed forever, and since the industry moved to hardware-backed keys it also means a physical token or an HSM-backed cloud signing service, which adds cost and setup on top of the certificate itself.

For commercial software that is a rounding error. For a free tool that solves one annoying problem, it is a recurring bill with no revenue behind it. That is the whole reason so much small, genuinely useful Windows software throws this warning.

It is worth being precise about what you would be buying. A signature attests to provenance: this binary came from this publisher and was not altered in transit. It is not a security audit and it is not a warranty. Signed malware exists. Unsigned software that is completely fine is the overwhelming majority case. The signature answers "who made this," not "is this safe."

What we do instead#

We could not justify the certificate for a free tool, so the goal became making the trust question answerable without one. Four things, all of which you can check yourself.

1. The source is public and small#

DragIn1 is MIT licensed and it is two C# files. Not a framework, not a dependency tree, not a minified bundle. You can read the entire data flow in an afternoon, and the part that matters, that it opens no sockets, is verifiable by searching the source for the networking namespaces and finding nothing.

2. Releases are built in public, not on a laptop#

Every released binary is produced by a GitHub Actions workflow↗ from the public source, on a GitHub-hosted runner, triggered by a version tag. The run is publicly visible. It compiles with the C# compiler already included in Windows, with no third-party dependencies, no package restore, and no network access during compilation.

No binary is ever built on a developer workstation and uploaded by hand. That removes the most common way a clean repository still produces a dirty download.

3. Every release publishes a SHA256#

Computed by that same workflow, so you can confirm the file you downloaded is the file the public build produced:

Get-FileHash DragIn1-Setup.exe -Algorithm SHA256

Compare it with SHA256.txt on the release. If it does not match, do not run it, and please open an issue so we can look into it.

4. You can build it yourself in about two seconds#

No Visual Studio, no .NET SDK, no internet connection. The C# compiler has shipped inside Windows since .NET Framework 4, which is already on every Windows 10 and 11 machine.

git clone https://github.com/wildtechdev/DragIn1.git
cd DragIn1
Build-Installer.cmd

That produces DragIn1.exe and DragIn1-Setup.exe. If you would rather trust your own machine than our release page, that option is a clone away, and it is the strongest answer to the trust question that exists.

The disclosure that should come with it#

A signature is worth less without knowing what the software actually does, so that is written down too. DragIn1 makes no network connections of any kind: no accounts, no licence checks, no update pings, no analytics. Files you drop on it are copied to %LOCALAPPDATA%\DragIn1\ on your own machine and cleaned up after seven days.

Everything the installer changes is per-user and needs no admin rights:

• Files in the install folder you choose.
• An uninstall entry under HKCU, removed when you uninstall.
• Start Menu, desktop, and start-with-Windows entries, each a checkbox during setup and each reversible afterwards.

No services, no drivers, no shell extensions, no scheduled tasks, no browser components, and no code loaded into any other process. The full breakdown is in the code signing policy↗.

So what should you actually do?#

When you hit the warning on DragIn1, click More info, then Run anyway. That is the intended path for software that has not bought reputation. There is a walkthrough on the support page if you want it alongside the other install steps.

But the more useful habit is the general one: treat the dialog as a prompt to ask where the file came from, not as a verdict. Did you get it from the project's own release page? Can you read the source? Does the hash match? Those questions are answerable, and they tell you far more than the presence or absence of a blue screen.

If DragIn1 releases are ever signed through the SignPath Foundation↗, which provides free certificates to open source projects, that will be noted on the releases page and in the policy. Until then the warning is the honest cost of shipping something free, and we would rather explain it than have you wonder.

If you arrived here from the warning itself and want to know what the tool underneath it actually does, that is the other half of the story: why dragging attachments out of New Outlook does nothing, including the probe output that found the cause.