6 ms·

This has been a problem with many compilers that aren't MSVC. I had antiviruses claim issues with Free Pascal as well as less used C compilers. My solution to

This has been a problem with many compilers that aren't MSVC. I had antiviruses claim issues with Free Pascal as well as less used C compilers. My solution to this "problem" is to simply ignore it - there isn't anything i can do about it anyway - and tell anyone who asks that it is a false positive. Though FWIW Windows Defender (or whatever the antivirus installed by default is called) so far never had a false positive. Perhaps other antiviruses are over-eager to justify their existence - and price - so they have an incentive to scare the clueless users.

e40 4y ago
> My solution to this "problem" is to simply ignore it - there isn't anything i can do about it anyway - and tell anyone who asks that it is a false positive. That works most of the time, but there are some orgs (e.g., US gov) where it will not.
pietroppeter 4y ago
mmh, so is using MSVC compiler a possible workaround?
- badsectoracula 4y ago
  Possibly, but note that this is a lack of encountering an issue, not that the issue doesn't exist. Also it limits you to MSVC, C/C++ and languages that can transpile to C/C++ via MSVC. This isn't something that, e.g. Free Pascal can do and when i use other C compilers is mainly to avoid MSVC :-P.
- GoblinSlayer 4y ago
  No, the workaround is a signed executable.
  - noobermin 4y ago
    Is Nim trying to get a signed compiler?
    - mike_hearn 4y ago
      It's not the compiler that has to be signed, it's the outputs. Any Windows EXE can be signed. It doesn't matter what compiler you used. The problem here isn't actually anything specific to Nim or Go, it's rather, the underlying UNIX oriented culture in which developers rarely sign their binaries. It'd affect any language with that culture. The Go FAQ on virus detection doesn't even mention signing at all - no wonder they have such problems.
      - noobermin 4y ago
        Ok, tell me then, how does a random person sign their binaries without paying through the nose and going through an extensive review process? It's one thing for a developer to get to distribute apps on an app store full hog with no oversight, and even there app stores are onerous. It's another to stop users from running their own software. Calling that a cultural difference is way too much. Heck, teenage Bill Gates made money selling his own software without someone forbidding it running on their own computers, it'd be hard imagining microsoft being what it is if this is the environment we're leaving the next generation of young hackers.
        GoblinSlayer 4y ago
        CAs want to eat. Also antivirus doesn't prevent users from running a program, it just shows a scary looking message. The whole thing is just a drop in quality as viruses are a thing of the past since Vista and as a result antiviruses don't have enough funding to maintain quality.
        mike_hearn 4y ago
        "how does a random person sign their binaries without paying through the nose and going through an extensive review process?" You just self sign. Conveyor does it by default, even. You can always run your own software on your own machine. Now, other people's Windows machines out of the box won't treat that as signed of course. Users would have to install your signing certificate. But you certainly can sign code without paying for it, it's just not meaningful to a fresh Windows install. Self signing is useful for distributing software internal to organizations for example. To distribute more widely, well, neither OV nor EV is actually an extensive review process. Even for EV they just verify that you're actually buying a certificate by looking you up in a business directory and calling you via the published contact details. Nothing about your software is reviewed.
PMunch 4y ago
The biggest issue with this comes from people trying to use these languages in a work scenario where an over-eager antivirus that can't be disabled by the user would cause issues.
ziml77 4y ago
It's a balancing act to not trigger too many false positives while also not missing any malware. Hitting more false positives to also get more true positives can be a good thing when even one false negative can be destructive. I don't think any AV wants to present false positives though. That's just annoying to users and they're going to disable the AV if it tries to tell them half the things that they download are viruses.
jonathanstrange 4y ago
I've reported a false positive via the official Microsoft Security channel for it (it's a web form) and AFAIK it has been whitelisted. My suspicion is that this process is mostly automated, too, but it's worth giving it a try.
md5madman 4y ago
MSVC also gets false positives if the Windows libraries are statically linked to the compiled project. A painful irony that has made sharing an indie-game with test users quite difficult as it requires they install the VC++ redistributables.
- account42 4y ago
  You can ship VC++ redistributables as DLLs alongside your application without an installer. Not that you should have to.
  - forrestthewoods 4y ago
    > not that you should have to On the contrary, every application should ship their dependencies!
    - account42 4y ago
      Sure, but the best option for that is to statically link them (if they are only used by one binary and users swapping them out doesn't make sense). And you should be able to do that without third parties slandering you.
wzdd 4y ago
Windows Defender reports plenty of false positives, most recently for me with Pyinstaller (https://duckduckgo.com/?q=pyinstaller+windows+defender&ia=web https://duckduckgo.com/?q=pyinstaller+windows+defender&ia=we...). They're all just bad.
noobermin 4y ago
A possible work around: is there any blessed assembler? Like can you tie into MSVC's assembler? This does sound kind of dumb but, idk. Does LLVM work? Does is there a Nim frontend for LLVM? I guess you can always compile Nim into C as it was done in the past I believe.
- planetis 4y ago
  > is there a Nim frontend for LLVM? Yes there is. https://github.com/arnetheduck/nlvm https://github.com/arnetheduck/nlvm

e40 4y ago

> My solution to this "problem" is to simply ignore it - there isn't anything i can do about it anyway - and tell anyone who asks that it is a false positive. That works most of the time, but there are some orgs (e.g., US gov) where it will not.

pietroppeter 4y ago

mmh, so is using MSVC compiler a possible workaround?

badsectoracula 4y ago
Possibly, but note that this is a lack of encountering an issue, not that the issue doesn't exist. Also it limits you to MSVC, C/C++ and languages that can transpile to C/C++ via MSVC. This isn't something that, e.g. Free Pascal can do and when i use other C compilers is mainly to avoid MSVC :-P.
GoblinSlayer 4y ago
No, the workaround is a signed executable.
- noobermin 4y ago
  Is Nim trying to get a signed compiler?
  - mike_hearn 4y ago
    It's not the compiler that has to be signed, it's the outputs. Any Windows EXE can be signed. It doesn't matter what compiler you used. The problem here isn't actually anything specific to Nim or Go, it's rather, the underlying UNIX oriented culture in which developers rarely sign their binaries. It'd affect any language with that culture. The Go FAQ on virus detection doesn't even mention signing at all - no wonder they have such problems.
    - noobermin 4y ago
      Ok, tell me then, how does a random person sign their binaries without paying through the nose and going through an extensive review process? It's one thing for a developer to get to distribute apps on an app store full hog with no oversight, and even there app stores are onerous. It's another to stop users from running their own software. Calling that a cultural difference is way too much. Heck, teenage Bill Gates made money selling his own software without someone forbidding it running on their own computers, it'd be hard imagining microsoft being what it is if this is the environment we're leaving the next generation of young hackers.
      - GoblinSlayer 4y ago
        CAs want to eat. Also antivirus doesn't prevent users from running a program, it just shows a scary looking message. The whole thing is just a drop in quality as viruses are a thing of the past since Vista and as a result antiviruses don't have enough funding to maintain quality.
      - mike_hearn 4y ago
        "how does a random person sign their binaries without paying through the nose and going through an extensive review process?" You just self sign. Conveyor does it by default, even. You can always run your own software on your own machine. Now, other people's Windows machines out of the box won't treat that as signed of course. Users would have to install your signing certificate. But you certainly can sign code without paying for it, it's just not meaningful to a fresh Windows install. Self signing is useful for distributing software internal to organizations for example. To distribute more widely, well, neither OV nor EV is actually an extensive review process. Even for EV they just verify that you're actually buying a certificate by looking you up in a business directory and calling you via the published contact details. Nothing about your software is reviewed.

PMunch 4y ago

The biggest issue with this comes from people trying to use these languages in a work scenario where an over-eager antivirus that can't be disabled by the user would cause issues.

ziml77 4y ago

It's a balancing act to not trigger too many false positives while also not missing any malware. Hitting more false positives to also get more true positives can be a good thing when even one false negative can be destructive. I don't think any AV wants to present false positives though. That's just annoying to users and they're going to disable the AV if it tries to tell them half the things that they download are viruses.

jonathanstrange 4y ago

I've reported a false positive via the official Microsoft Security channel for it (it's a web form) and AFAIK it has been whitelisted. My suspicion is that this process is mostly automated, too, but it's worth giving it a try.

md5madman 4y ago

MSVC also gets false positives if the Windows libraries are statically linked to the compiled project. A painful irony that has made sharing an indie-game with test users quite difficult as it requires they install the VC++ redistributables.

account42 4y ago
You can ship VC++ redistributables as DLLs alongside your application without an installer. Not that you should have to.
- forrestthewoods 4y ago
  > not that you should have to On the contrary, every application should ship their dependencies!
  - account42 4y ago
    Sure, but the best option for that is to statically link them (if they are only used by one binary and users swapping them out doesn't make sense). And you should be able to do that without third parties slandering you.

wzdd 4y ago

Windows Defender reports plenty of false positives, most recently for me with Pyinstaller (https://duckduckgo.com/?q=pyinstaller+windows+defender&ia=web https://duckduckgo.com/?q=pyinstaller+windows+defender&ia=we...). They're all just bad.

noobermin 4y ago

A possible work around: is there any blessed assembler? Like can you tie into MSVC's assembler? This does sound kind of dumb but, idk. Does LLVM work? Does is there a Nim frontend for LLVM? I guess you can always compile Nim into C as it was done in the past I believe.

planetis 4y ago
> is there a Nim frontend for LLVM? Yes there is. https://github.com/arnetheduck/nlvm https://github.com/arnetheduck/nlvm