4 ms·

The response on that issue was a bit depressing. Since noone seems to care I'm not surprised that it isn't fixed. But it is surprising to me that this isn't a

by tjoff 8y ago

The response on that issue was a bit depressing. Since noone seems to care I'm not surprised that it isn't fixed. But it is surprising to me that this isn't a top priority.

themacguffinman 8y ago
There's probably a significant overlap between developers who use a non-mainstream language like D and developers who use non-mainstream OSs like Linux or macOS.
- tjoff 8y ago
  They obviously put in the probably very non-trivial effort to make a windows version. This is about caring about the product they produce.
  - bachmeier 8y ago
    If "they" refers to the D Language community, there's nothing that they can do. The AV vendors are the ones doing it, and they don't care.
joshstrange 8y ago
I get where they are coming from. Windows is far from the top OS used by D programers, it only effects people who use anti-virus, and I'm betting you can whitelist it or otherwise bypass it. All of those things may seem like sizable hurdles but we are talking about programmers here, I think they can handle it. I know back when I used Windows I would get false positives for all kinds of things because I was on the bleeding edge or always trying new stuff that they hadn't seen or looked malicious (but wasn't). If you are going to run "anti-virus" as a developer you need to know what side-effects you might run into (the same way I know that PrivacyBadger and uMatrix in Chrome can cause issues, I don't go running to the website that is broken just because my extension broke it).
- tjoff 8y ago
  Anti-virus is bundled with windows. Everyone will have it. I wouldn't know how easy it would be to bypass. And in a corporate environment you would not be able to.
  - joshstrange 8y ago
    > Anti-virus is bundled with windows. Everyone will have it. Someone interested in programming in D should be able to disable it and programmers != Everyone > I wouldn't know how easy it would be to bypass. And in a corporate environment you would not be able to. I feel like this knowledge is just a google search away and for corporate... If you computers are so locked down that you can't disable the anti-virus they are probably locked down so that you can't install new programs in general. I, for one, would never choose to work for a company that locked down and in that case I feel like you just need to talk to IT to ask them to whitelist it. All of that said I feel like there is a huge disconnect between the points you are making and the actual population that is trying to use D. Look, I have no clue on the actual install base/user base of D lang but I can't imagine we are talking a "real" number of people having this issue. D doesn't even rank on any of the "Top languages of 2018" lists I found online (that isn't a knock on D, it's just facts) so that coupled with the fact that the vast majority of D developers seem to use non-Windows OS's make this all seem like a lot to do about nothing.
    - tatersolid 8y ago
      > I, for one, would never choose to work for a company that locked down Good luck finding a job in banking, government, healthcare, defense, retail, insurance, securities, food, pharmaceutical, or pretty much anything other than social media. All of these industries are basically forced into “whitelisted software only” by some regulation or another.
      - Brian_K_White 8y ago
        I for one, never did choose to work for such a company, and yet now I do anyway because my chosen small company was sold to a huge one, after I am 19 years in. It's almost like that was easier to say than to do.
pm215 8y ago
The problem is that it isn't really something the project can fix -- the problem is with the antivirus, whose vendors aren't very responsive. See for instance the PuTTY devs' todo list item about virus false-positives: https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/false-positive-malware.html https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/... -- persistently every release gets falsely flagged by something or other, even if they do make a report and get it taken off the list it comes back for the next release, and at least one of the antivirus programs seems to be looking for the putty binary specifically!
- hermitdev 8y ago
  Part of the problem with this is how some AVs rate new binaries. Previous job, we had issues with deployments of new versions. Most of our (only) corporate clients used Symantec. They would consistently flag our app as a possible virus because it's "reputation" was low. To Symantec, reputation basically meant how many times it'd seen the app before. Symantec basically coerced us into buying a code-signing cert from them, and we still had to submit every build directly to them for this reputation issue to go away. Royal pain in the ass.
  - platinumrad 8y ago
    Sounds like a racket, to be honest. Can't say that I'm sad that their reputation, along with the reputation of traditional AV vendors as a whole, is in the dumpster these days.
    - hermitdev 8y ago
      It is most definitely a racket, and their "repuation" score severely affected our reputation with existing clients. Same deployment procedure as had been for years (we'd previously been code-signing with a GoDaddy cert) with Click-Once deployment (was a .Net Office add-in), all of a sudden we start getting dinged. The cost to the company (a relatively small company) was significant. Had to buy a Symantec code-signing cert (~$900), had to ditch ClickOnce and invest in InstallShield (don't recall the license cost) and engineer the installer to both sign the installed libs & the installer itself. All of this because Symantec hadn't seen the new libs enough because, well, we targeted a smaller corporate audience (for argument sake, we had around a 100 clients, of which, each would only have 1 or 2 installs of this particular app).
tracker1 8y ago
It happens with useful system utilities (windows sudo and nssm for instance). It's because they request elevated privileges and aren't part of an installer application that's popular.
dawg 8y ago
Installer and binaries have been signed and submitted to Microsoft since a while to fix the issue with Windows Defender. https://dlang.org/changelog/2.082.0.html#signed_windows_binaries https://dlang.org/changelog/2.082.0.html#signed_windows_bina... Neither the last release nor the recent release candidate have been flagged by any AV according to VirusTotal. https://www.virustotal.com/#/file/e2ea2807faf41978a842f9189000ccc4f81a6c02663bdc2d05fde1bc80db7229 https://www.virustotal.com/#/file/e2ea2807faf41978a842f91890... https://www.virustotal.com/#/file/834d7547d395cc4080ab28a177df40bfa5cd7342aba4f24c49bf5fe3232cc950 https://www.virustotal.com/#/file/834d7547d395cc4080ab28a177...

by tjoff 8y ago

The response on that issue was a bit depressing. Since noone seems to care I'm not surprised that it isn't fixed. But it is surprising to me that this isn't a top priority.

themacguffinman 8y ago

There's probably a significant overlap between developers who use a non-mainstream language like D and developers who use non-mainstream OSs like Linux or macOS.

tjoff 8y ago
They obviously put in the probably very non-trivial effort to make a windows version. This is about caring about the product they produce.
- bachmeier 8y ago
  If "they" refers to the D Language community, there's nothing that they can do. The AV vendors are the ones doing it, and they don't care.

joshstrange 8y ago

I get where they are coming from. Windows is far from the top OS used by D programers, it only effects people who use anti-virus, and I'm betting you can whitelist it or otherwise bypass it. All of those things may seem like sizable hurdles but we are talking about programmers here, I think they can handle it. I know back when I used Windows I would get false positives for all kinds of things because I was on the bleeding edge or always trying new stuff that they hadn't seen or looked malicious (but wasn't). If you are going to run "anti-virus" as a developer you need to know what side-effects you might run into (the same way I know that PrivacyBadger and uMatrix in Chrome can cause issues, I don't go running to the website that is broken just because my extension broke it).

tjoff 8y ago
Anti-virus is bundled with windows. Everyone will have it. I wouldn't know how easy it would be to bypass. And in a corporate environment you would not be able to.
- joshstrange 8y ago
  > Anti-virus is bundled with windows. Everyone will have it. Someone interested in programming in D should be able to disable it and programmers != Everyone > I wouldn't know how easy it would be to bypass. And in a corporate environment you would not be able to. I feel like this knowledge is just a google search away and for corporate... If you computers are so locked down that you can't disable the anti-virus they are probably locked down so that you can't install new programs in general. I, for one, would never choose to work for a company that locked down and in that case I feel like you just need to talk to IT to ask them to whitelist it. All of that said I feel like there is a huge disconnect between the points you are making and the actual population that is trying to use D. Look, I have no clue on the actual install base/user base of D lang but I can't imagine we are talking a "real" number of people having this issue. D doesn't even rank on any of the "Top languages of 2018" lists I found online (that isn't a knock on D, it's just facts) so that coupled with the fact that the vast majority of D developers seem to use non-Windows OS's make this all seem like a lot to do about nothing.
  - tatersolid 8y ago
    > I, for one, would never choose to work for a company that locked down Good luck finding a job in banking, government, healthcare, defense, retail, insurance, securities, food, pharmaceutical, or pretty much anything other than social media. All of these industries are basically forced into “whitelisted software only” by some regulation or another.
    - Brian_K_White 8y ago
      I for one, never did choose to work for such a company, and yet now I do anyway because my chosen small company was sold to a huge one, after I am 19 years in. It's almost like that was easier to say than to do.

pm215 8y ago

The problem is that it isn't really something the project can fix -- the problem is with the antivirus, whose vendors aren't very responsive. See for instance the PuTTY devs' todo list item about virus false-positives: https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/false-positive-malware.html https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/... -- persistently every release gets falsely flagged by something or other, even if they do make a report and get it taken off the list it comes back for the next release, and at least one of the antivirus programs seems to be looking for the putty binary specifically!

hermitdev 8y ago
Part of the problem with this is how some AVs rate new binaries. Previous job, we had issues with deployments of new versions. Most of our (only) corporate clients used Symantec. They would consistently flag our app as a possible virus because it's "reputation" was low. To Symantec, reputation basically meant how many times it'd seen the app before. Symantec basically coerced us into buying a code-signing cert from them, and we still had to submit every build directly to them for this reputation issue to go away. Royal pain in the ass.
- platinumrad 8y ago
  Sounds like a racket, to be honest. Can't say that I'm sad that their reputation, along with the reputation of traditional AV vendors as a whole, is in the dumpster these days.
  - hermitdev 8y ago
    It is most definitely a racket, and their "repuation" score severely affected our reputation with existing clients. Same deployment procedure as had been for years (we'd previously been code-signing with a GoDaddy cert) with Click-Once deployment (was a .Net Office add-in), all of a sudden we start getting dinged. The cost to the company (a relatively small company) was significant. Had to buy a Symantec code-signing cert (~$900), had to ditch ClickOnce and invest in InstallShield (don't recall the license cost) and engineer the installer to both sign the installed libs & the installer itself. All of this because Symantec hadn't seen the new libs enough because, well, we targeted a smaller corporate audience (for argument sake, we had around a 100 clients, of which, each would only have 1 or 2 installs of this particular app).

tracker1 8y ago

It happens with useful system utilities (windows sudo and nssm for instance). It's because they request elevated privileges and aren't part of an installer application that's popular.

dawg 8y ago

Installer and binaries have been signed and submitted to Microsoft since a while to fix the issue with Windows Defender. https://dlang.org/changelog/2.082.0.html#signed_windows_binaries https://dlang.org/changelog/2.082.0.html#signed_windows_bina... Neither the last release nor the recent release candidate have been flagged by any AV according to VirusTotal. https://www.virustotal.com/#/file/e2ea2807faf41978a842f9189000ccc4f81a6c02663bdc2d05fde1bc80db7229 https://www.virustotal.com/#/file/e2ea2807faf41978a842f91890... https://www.virustotal.com/#/file/834d7547d395cc4080ab28a177df40bfa5cd7342aba4f24c49bf5fe3232cc950 https://www.virustotal.com/#/file/834d7547d395cc4080ab28a177...