Digital Defender - field check
==============================

Thank you for running this. It helps more than you might think.


HOW TO RUN IT  (this is all you actually need)
==============================================

  1. Unzip everything into one folder. All five files must stay together.
  2. Double-click ddcheck.exe.
  3. It tells you what it is about to do. Press Enter to start.
  4. Wait a few minutes. That is it - there is nothing to uninstall.

  You do NOT need to be an administrator.

  Windows will show the publisher as "SmithyForge LTD". That is us - it is the
  company; Digital Defender is the product.

  Prefer it to send nothing at all? Open a command prompt in that folder and run
      ddcheck.exe --no-upload
  It will write the report to your Desktop and go nowhere.

  Everything below is detail, and you are not obliged to read any of it. The
  program itself explains what it will do before it does anything, and waits for
  you to agree. The rest of this file is here for anyone who wants to check that
  what it says is true.


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


WHAT THIS IS
  A measurement tool. It looks at the programs already installed on your PC
  and records what our (still experimental) detection engine WOULD have said
  about each one. We are trying to find out where it gets things wrong, and
  the only way to do that is on real computers that are not ours.

  ONE THING THAT MIGHT LOOK ODD: Windows will tell you this program is signed
  by "SmithyForge LTD", not Digital Defender. SmithyForge is the company; Digital
  Defender is the product. Software is signed by the legal company behind it,
  which is why the two names differ - but you should always be suspicious when
  they do, so we would rather tell you than have you wonder.

WHAT IT DOES NOT DO
  It does not block, delete, quarantine, rename or change anything at all.
  It reads files; it never modifies them.
  It does not install itself, does not start a service, does not add a driver
  and does not run in the background afterwards. You run it once, it finishes,
  it is gone. There is nothing to uninstall.

  It is NOT antivirus and gives you NO protection. Please keep using whatever
  security software you already have.

WHAT IT SENDS
  It writes a report to your Desktop, and sends a copy of that same report to
  reports.digital-defender.com. That is the only thing it sends and the only place
  it sends it.

  YOUR FILES ARE NEVER UPLOADED. The report contains file names, sizes and
  fingerprints (hashes) - not the contents of anything.

  It asks before it starts, and the report stays on your Desktop afterwards, so
  you can read exactly what was sent at any time. Be aware it lists file paths
  from your machine, which include your user name and show which software you
  have installed.

  If you would rather it sent nothing at all, run it like this:
      ddcheck.exe --no-upload
  and it will write the report locally and go nowhere. Then send it by hand, or
  don't - genuinely no hard feelings.

WHAT YOU END UP WITH
  Two files on your Desktop, both starting "dd-fieldcheck-":
    the .txt  - a readable summary, worth a look
    the .jsonl - the same information, one line per file, for our tooling

  You don't have to do anything with them. They are your copy of what was sent.

CHANGED YOUR MIND?
  Email Paul and say so, and the report is deleted. You don't need a reason.
  The machine name at the top of your .txt is how we find it.

DON'T TAKE OUR WORD FOR IT
  "We only send X" is the sort of thing every program claims. Here is how to
  check, without trusting us:

  1. The report on your Desktop IS the thing we sent. Not a summary of it, not
     an edited version - the same content. So reading it tells you exactly what
     we received. That is deliberate: it means we cannot quietly send more than
     we showed you.

  2. Watch it go. Open Resource Monitor (search for it in Start), go to the
     Network tab, and run ddcheck. You will see one connection, to
     reports.digital-defender.com, at the very end. Nothing during the scan.

  3. Run it with --no-upload and watch that tab stay empty.

  4. If you are technical: ddcheck.exe imports seven Windows libraries --
       kernel32, ntdll, api-ms-win-core-synch  (files, threads)
       bcryptprimitives                        (hashing)
       wintrust, crypt32                       (checking code signatures)
       winhttp                                 (sending the report, over HTTPS)
     winhttp is the only way it can reach a network. Check with:
       dumpbin /imports ddcheck.exe

     Search the file for hostnames and you will find exactly one that belongs
     to us: reports.digital-defender.com.

     You will ALSO find a dozen or so http:// addresses at sectigo.com,
     comodoca.com and usertrust.com. Those are not ours and we never contact
     them: they are part of the digital signature itself - the timestamp and
     certificate-revocation servers of the company that issued it. Every signed
     Windows program has them. The unsigned build of this file contains no
     http:// addresses at all, which is how you can tell they arrived with the
     signature rather than with the code.

  Even the signature checking stays offline: verifying a code signature normally
  looks up certificate revocation over the internet, and we deliberately
  restrict that to your machine's local cache. So the report upload is the only
  network activity there is.

WHAT WE DO WITH IT
  We look at any file the engine would have blocked or asked about, and work
  out whether it was wrong. Files it got wrong are the whole point: they go
  into the test set so the next version does better. We do not upload your
  files anywhere, and we have no interest in what software you own beyond
  whether our engine mishandles it.

QUESTIONS
  Ask Paul.
