6 ms·

It's flat out wrong of you to say that antivirus companies don't care about FP's. There are over 25k new malware samples coming out daily, and everybody is jus

by jgmmo 15y ago

It's flat out wrong of you to say that antivirus companies don't care about FP's. There are over 25k new malware samples coming out daily, and everybody is just trying to cut through them as fast and efficiently as possible. Yes there are innocent casualties of this -- False positives -- but these are sincere mistakes . False positives are very embarrassing for the security company. It is something that can even cause people their jobs. Don't you think for a second that these are not looked at. I make malware definitions for a living, and you can trust me when I say that I check the FP reports first thing every morning, several times during the work day, & I check our forums every night at home to make sure we don't have any FP's rolling in. At most security software companies, FP's taken very seriously & I know that personally I would love to be able to educate Indie developers about what triggers detections and ways we can both work together to reduce them. It's easier said then done, however, and also it is delicate info that you don't really want to yell off the rooftops - because malware creators could really use the same info to their advantage.

jconley 15y ago
I didn't say the industry doesn't care. But, the business model relies on detecting as much as possible and shoving that in your face to get more bookings. I have no doubt you take false positives very seriously at an engineering level. However, the bottom line impact of a false positive on some indie software has to be negligible.
icehawk 15y ago
All of this. False positives are horrible for both antivirus companies and their customers, and great care is typically taken to avoid them. Not to mention that if you start alerting the user too much, they'd start tuning out the alerts; that becomes a big problem if and when they're infected with something.
pasbesoin 15y ago
I'll respond with a variation of what naner describes ( http://news.ycombinator.com/item?id=3511551 http://news.ycombinator.com/item?id=3511551 ). Specifically with Norton, I've received warnings/quarantines where it's rather non-obvious and difficult to learn what the actual problem is. The program's interface allows one to click and drill down one or two levels, but the descriptions are often more non-descriptive than descriptive. And then one faces a link (which is, by the way, not tooltipped or otherwise designated as a link) that fires up your browser and takes you to a web page on the security software vendor's (in this case, Norton) web site. Well, that's f-ing annoying. And then, to boot, often the page that is navigated to contains content that is little or no more helpful in telling you what specifically they detected or why specifically the warning/action triggered. I recall one case in particular, where going through all this and reading between the lines, it appeared that the quarantine was the result of a "reputation" trigger. Norton wasn't familiar with the executable and it didn't have much or any presence in their reputation system, so the default action was to flag it a "high security" risk and to "quarantine" it. I understand there is a balancing act. If you don't keep it simple and use strong enough language, Joe Blow user may start to disregard the warnings, until soon enough s/he has a real problem. But as a more advanced user, this is completely frustrating. I want to know what the problem is, so that I can make an informed decision with regard to the "security event". (And yes, on the Windows machine, I do run Norton. Comes with my only Internet connectivity option, anyway, and it makes an acceptable, and useful, component of a layered defense.)
- joe_bleau 15y ago
  I got bit by this reputation thing just this morning. I'd sent out a link to a .exe for a dead simple app (open serial port, tx commands, rx replies, output to screen) and sure enough, someone tried to download it and got blocked by Norton. I sent it in as a FP, not in the hopes they'll do anything about my little .exe, but just to make more work for them.
pnathan 15y ago
I wrote a Windows program for my dad about a year ago. It would have worked great. I was thinking about selling it, actually! Except, the antivirus flagged it. I called the AV vendor and they (probably the first-line tech support) said unless that my dad called the vendor, they could do nothing. The only false positive that might be remotely reasonable is my executable name is identical to a virus. rte.exe or something similar, as I recall. Whatever. A binary difference should have demonstrated substantial difference between my exe and the virus. So, my dad didn't get his program, and I got left with a renewed awareness that AV vendors are ruinously unhelpful, and I'd rather work on moving my family and friends to Linux or OSX.
- jff 15y ago
  So you spent the time to write a program, one good enough to consider selling it even, but couldn't be bothered to try changing the executable name? Or ask your dad to call the AV vendor? Am I mis-reading you?
  - pnathan 15y ago
    I did ask my dad to call. Nothing seemed to come of it. I was working in a hurry and didn't think to simply change the exe name, making the presumption that such a simple thing shouldn't influence the AV decision.
    - jgmmo 15y ago
      The name of the .exe certainly matters. When going through airport security, do you think it matters at all if your name is Osama Bin Laden? Such a person is going to experience a much larger degree of scrutiny from TSA then a person named John Smith.
      - SomeOtherGuy 15y ago
        That's a great example, as it shows anti-virus scammers are just as bad as the airport security scammers. Someone being named Osama Bin Laden has no bearing on their likelihood of hijacking a plane.

by jgmmo 15y ago

jconley 15y ago

I didn't say the industry doesn't care. But, the business model relies on detecting as much as possible and shoving that in your face to get more bookings. I have no doubt you take false positives very seriously at an engineering level. However, the bottom line impact of a false positive on some indie software has to be negligible.

icehawk 15y ago

All of this. False positives are horrible for both antivirus companies and their customers, and great care is typically taken to avoid them. Not to mention that if you start alerting the user too much, they'd start tuning out the alerts; that becomes a big problem if and when they're infected with something.

pasbesoin 15y ago

I'll respond with a variation of what naner describes ( http://news.ycombinator.com/item?id=3511551 http://news.ycombinator.com/item?id=3511551 ). Specifically with Norton, I've received warnings/quarantines where it's rather non-obvious and difficult to learn what the actual problem is. The program's interface allows one to click and drill down one or two levels, but the descriptions are often more non-descriptive than descriptive. And then one faces a link (which is, by the way, not tooltipped or otherwise designated as a link) that fires up your browser and takes you to a web page on the security software vendor's (in this case, Norton) web site. Well, that's f-ing annoying. And then, to boot, often the page that is navigated to contains content that is little or no more helpful in telling you what specifically they detected or why specifically the warning/action triggered. I recall one case in particular, where going through all this and reading between the lines, it appeared that the quarantine was the result of a "reputation" trigger. Norton wasn't familiar with the executable and it didn't have much or any presence in their reputation system, so the default action was to flag it a "high security" risk and to "quarantine" it. I understand there is a balancing act. If you don't keep it simple and use strong enough language, Joe Blow user may start to disregard the warnings, until soon enough s/he has a real problem. But as a more advanced user, this is completely frustrating. I want to know what the problem is, so that I can make an informed decision with regard to the "security event". (And yes, on the Windows machine, I do run Norton. Comes with my only Internet connectivity option, anyway, and it makes an acceptable, and useful, component of a layered defense.)

joe_bleau 15y ago
I got bit by this reputation thing just this morning. I'd sent out a link to a .exe for a dead simple app (open serial port, tx commands, rx replies, output to screen) and sure enough, someone tried to download it and got blocked by Norton. I sent it in as a FP, not in the hopes they'll do anything about my little .exe, but just to make more work for them.

pnathan 15y ago

I wrote a Windows program for my dad about a year ago. It would have worked great. I was thinking about selling it, actually! Except, the antivirus flagged it. I called the AV vendor and they (probably the first-line tech support) said unless that my dad called the vendor, they could do nothing. The only false positive that might be remotely reasonable is my executable name is identical to a virus. rte.exe or something similar, as I recall. Whatever. A binary difference should have demonstrated substantial difference between my exe and the virus. So, my dad didn't get his program, and I got left with a renewed awareness that AV vendors are ruinously unhelpful, and I'd rather work on moving my family and friends to Linux or OSX.

jff 15y ago
So you spent the time to write a program, one good enough to consider selling it even, but couldn't be bothered to try changing the executable name? Or ask your dad to call the AV vendor? Am I mis-reading you?
- pnathan 15y ago
  I did ask my dad to call. Nothing seemed to come of it. I was working in a hurry and didn't think to simply change the exe name, making the presumption that such a simple thing shouldn't influence the AV decision.
  - jgmmo 15y ago
    The name of the .exe certainly matters. When going through airport security, do you think it matters at all if your name is Osama Bin Laden? Such a person is going to experience a much larger degree of scrutiny from TSA then a person named John Smith.
    - SomeOtherGuy 15y ago
      That's a great example, as it shows anti-virus scammers are just as bad as the airport security scammers. Someone being named Osama Bin Laden has no bearing on their likelihood of hijacking a plane.