Chrome's overzealous approach to flagging downloads of newly created software as potential malware is stifling online distribution of indie and free software
Google has an undeniable monopoly on search, and a near-monopoly on web browsing software via Chrome and its forks. Tweets: @danaditomaso , @randomoracle , @byuu_san , @perpetualmaniac , @glenngabe , @kntoukakis , @randfish , and @notdan Tweets: Dana DiTomaso / @danaditomaso : We have a client with this exact issue right now and it's ridiculous. Their software isn't uncommon, it's specialized for their industry. So frustrating. https://twitter.com/... Cem Paya / @randomoracle : It would be ironic if Google— never a believer in EV certificates & happily using Chrome monopoly to undermine the EV distinction in UI— ends up motivating developers to get Authenticode signing certs to avoid malware label... https://medium.com/... Byuu / @byuu_san : My site was flagged again. Therefore, all downloads have been removed until this can be resolved. I've written an article about this here: https://medium.com/... . I would appreciate any retweets to bring attention to this; it affects all free and open source software developers. Zach Vorhies / @perpetualmaniac : Great article showing how Google is using it's chrome browser to extort money out of software developers that release free software. If developers want to get rid of this warning then they need to “pay expensive certificate authority rent-seeking fees”. https://medium.com/... https://twitter.com/... Glenn Gabe / @glenngabe : “Uncommon downloads” is a confusing security issue & a pain in the neck for some devs -> https://medium.com/... https://twitter.com/... Konstantinos Ntoukakis / @kntoukakis : Very interesting article for websites that offer software downloads. Even established small software businesses would need to spend many times their monthly marketing budget for obtaining code signing certificates. #seo #opensource https://medium.com/... Rand Fishkin / @randfish : Google's monopoly is stifling free software. https://medium.com/... I hope this is an unintentional oversight, but Google could so easily put resources toward a fix, it's hard not to think they're just furthering control of the web's ecosystem. https://twitter.com/... @notdan : jfc Google, this is just embarrassing at this point. How many times is it going to take? https://github.com/... @WadeAlcorn pic.twitter.com/IMcJzQBK3y
Context & Ripple Effects
This lands mid-arc on a concern that had been building all year: reporting in May flagged how the rise of Chrome and its Chromium sibling gives Google effective power over the web (Chromium's grip on new browser projects), and the Verge had already documented Google steering web standards through its own browser. Download flagging is that structural leverage showing up at a specific chokepoint — the moment a user tries to install software.
The complaint isn't hypothetical: an agency client with industry-specialized software is caught in it, per Dana DiTomaso, and the thread includes Cem Paya noting the irony of Google using Chrome's monopoly to undermine EV certificates while developers are pushed toward exactly that kind of paid trust infrastructure.
First-order effects
- Indie and free-software developers face a direct choice: pull their download pages, chase reputation-flagging appeals, or buy code-signing certificates (Authenticode among them) so Chrome stops labeling their freshly built binaries as malware.
- Legitimate niche vendors — like the specialized-industry client DiTomaso describes — lose conversions at the download step, since users see a browser warning before the installer ever runs.
Second-order effects
- Certificate authorities become a toll booth by default: when unsigned binaries from new publishers get flagged, paid signing shifts from best practice to a de facto distribution requirement, raising the floor cost of shipping software outside app stores.
- Developers rationally migrate toward channels Chrome doesn't warn about — hosted web apps or storefronts — which strengthens the same Google-controlled surfaces documented in coverage of Google's drift from the open web ethos.
Third-order effects
- If the pattern holds, the browser becomes a quiet arbiter of which software can be distributed at all — a gatekeeping layer layered on top of search dominance that independent developers can't contest individually.
- That trajectory fits the walled-garden endgame analysts sketched when Mozilla's troubles left Chrome, Android, and AdWords unopposed (Google closing in on a WeChat-style walled garden): fewer viable paths for free and open-source software to reach users without passing a Google checkpoint.
The trend: Browser-level security filtering is hardening into a de facto software-distribution gate, with Google's Chrome share deciding who must pay for trust certificates to reach users.