Scott commented that you can get cheap code-signing certs, as Jon Robbins points out. 80 bucks sounds like quite a deal, but a quick look at Jon's post reveals that a cheap code signing cert isn't as easy to use as one issued by the big dogs:

I had some trouble with registration process at Comodo. Make sure you add https://secure.comodo.net to the list of trusted sites in Internet Explorer so they can properly get you registered and install their trusted root certificate on your computer.

It's not just ease of use that I'm worried about here though. What's it mean to ask your customer to install a CA certificate into her trusted root store? I'm thinking of a nontechnical person like my mother - what's she going to think when she's asked to approve something that looks like this (the dialog that pops up on Windows XP when you try to install a cert into the trusted root store):

(click image to enlarge)

If you find that your customers tend to choose the default option here, "NO", your code signing cert won't be trusted, which begs the question, why didn't you save yourself the 80 bucks and simply issue your own code signing cert via Windows built-in Certificate Services?

And even worse, what does it mean if you find that your customers tend to choose, "YES"? That leads to the philosophical question: what use is PKI anyway if the end user doesn't understand it? If every software vendor creates one of those web pages (I'm sure you've seen them) instructing users on what to do when they see the above dialog ("press YES"), then ultimately what's the cost to the consumer?

I don't like tithing to my certificate authority any more than the next guy, but buying a "cheap" cert is more costly in the long term. If you need a cheap certificate for testing or for personal reasons, issue it yourself! If you need a real certificate, your best bet is to stick with a vendor that your customers already "trust", for better or for worse.

If your software is signed with a code signing cert issued by an authority that is trusted on the machine (e.g., Thawte, Verisign, etc.) you're good, because the firewall will automatically allow your software to access the Internet. But if you don't want to shell out the hundreds of $$$ it takes to get one of these certs, especially for homebrew software, you might try to do what I did and tell the OneCare firewall about your app. Under Advanced Settings, you can point at your EXE file and tell the firewall to allow it to make outbound connections. Sadly this doesn't seem to work very consistently. Here's a sample program that I could sometimes get this to work for, and sometimes not:

class FetchMicrosoftHomePage {
    static void Main() {
        byte[] data;
        try {
            data = new WebClient().DownloadData("http://www.microsoft.com");
            Console.WriteLine("Microsoft's home page is {0} bytes long", data.Length);
        }
        catch (WebException x) {
            Console.WriteLine(x);
        }
    }
}

I've spent about an hour trying to figure out why I can only sporadically get the firewall to recognize this program, and I'm done now. FWIW, when it's not recognized, the firewall outputs a log message like this (you need to turn on detailed logging to see this, BTW):

There's a lot of people who will argue that an outbound firewall is useless, especially for non-techies. And a lot of people will argue the opposite point. I'm not here to argue either of these points, but I can say that this type of behavior makes it pretty hard for even highly technical people to use.

Since I'm personally in the, "outbound firewalls aren't that useful" camp, I fixed the problem on my own machine by adding four rules that allow all outbound TCP and UDP connections to all ports (I figured I needed four, since each rule only allows one protocol and you have to pick between local subnet vs. Internet). Then I shut off the prompts for "blocking" programs and everything seems to be working fine. But I wonder how many software developers will be running into deployment problems in home environments where lots of users are running this firewall.