9 ms·

Is specific effort being put in to dodge antiviruses? I've been unable to use redbean at work due to Crowdstrike deciding it's malware.

jart 3y ago
Author here. I invented a novel polyglot executable format that makes developers lives easier, and we're helping the AV industry feel comfortable with that through openness and transparency. Every time I ship a release, I make an effort to upload all the executables to Microsoft Security Intelligence to give them a heads up and let them know that I wrote them (since there's currently no vendor neutral solution for code signing). If you build APE binaries, then you should do that too: https://www.microsoft.com/en-us/wdsi/filesubmission?persona=SoftwareDeveloper https://www.microsoft.com/en-us/wdsi/filesubmission?persona=... Every time I submit the form, Microsoft whitelists them with zero hassle. They even let you upload a single zip file containing hundreds of executables, and they'll take care of them all. It's great. Doing that ensures Windows Defender won't cause issues. The good news is most other AVs are plugged into the same database as Defender (even Google Search bases their analysis on Microsoft's security intelligence) so that form actually gets you off the radar of a lot of AVs. As for CrowdStrike, if you have contacts there, then I'd be happy to share with them information about what our team is building and shipping, as well as documentation on the APE file format, in addition to free consultation from me for any help they need supporting it on their end. My email is in the blog post.
- andrew_shay 3y ago
  Which options do you choose on that page before uploading?
  - jart 3y ago
    - Product: Windows 10 Defender - Company Name: Justine Tunney - Incorrectly detected as malware/malicious - Detection Name: Trojan:Win32/Wacatac.B!ml - Additional Information (example): I'm the author of Redbean, an open source web server https://redbean.dev https://redbean.dev It uses a polyglot executable format called APE which I designed. My project has received positive coverage in the media: https://www.theregister.com/2022/06/20/redbean_2_a_singlefile_web/ https://www.theregister.com/2022/06/20/redbean_2_a_singlefil... Sadly we're having trouble with AVs. Could you unflag my release binaries? Thanks!
    - andrew_shay 3y ago
      Thank you
Barrin92 3y ago
Administrators can create exclusions in Crowdstrike. Given the question I'm assuming you don't have admin rights and you should definitely not try to avoid company policy, that is a fantastic way to get canned

jart 3y ago

Author here. I invented a novel polyglot executable format that makes developers lives easier, and we're helping the AV industry feel comfortable with that through openness and transparency. Every time I ship a release, I make an effort to upload all the executables to Microsoft Security Intelligence to give them a heads up and let them know that I wrote them (since there's currently no vendor neutral solution for code signing). If you build APE binaries, then you should do that too: https://www.microsoft.com/en-us/wdsi/filesubmission?persona=SoftwareDeveloper https://www.microsoft.com/en-us/wdsi/filesubmission?persona=... Every time I submit the form, Microsoft whitelists them with zero hassle. They even let you upload a single zip file containing hundreds of executables, and they'll take care of them all. It's great. Doing that ensures Windows Defender won't cause issues. The good news is most other AVs are plugged into the same database as Defender (even Google Search bases their analysis on Microsoft's security intelligence) so that form actually gets you off the radar of a lot of AVs. As for CrowdStrike, if you have contacts there, then I'd be happy to share with them information about what our team is building and shipping, as well as documentation on the APE file format, in addition to free consultation from me for any help they need supporting it on their end. My email is in the blog post.

andrew_shay 3y ago
Which options do you choose on that page before uploading?
- jart 3y ago
  - Product: Windows 10 Defender - Company Name: Justine Tunney - Incorrectly detected as malware/malicious - Detection Name: Trojan:Win32/Wacatac.B!ml - Additional Information (example): I'm the author of Redbean, an open source web server https://redbean.dev https://redbean.dev It uses a polyglot executable format called APE which I designed. My project has received positive coverage in the media: https://www.theregister.com/2022/06/20/redbean_2_a_singlefile_web/ https://www.theregister.com/2022/06/20/redbean_2_a_singlefil... Sadly we're having trouble with AVs. Could you unflag my release binaries? Thanks!
  - andrew_shay 3y ago
    Thank you

Barrin92 3y ago

Administrators can create exclusions in Crowdstrike. Given the question I'm assuming you don't have admin rights and you should definitely not try to avoid company policy, that is a fantastic way to get canned