3 ms·
Virus scanning user uploaded files always seemed like a very sensible thing to me. I've used ClamAV before in web apps, and it was fairly easy to get working -
by GordonS 2y ago
Virus scanning user uploaded files always seemed like a very sensible thing to me.
I've used ClamAV before in web apps, and it was fairly easy to get working - but it has a few big flaws: it's very slow, it uses a huge amount of memory, and detection rates are... honestly, pretty terrible.
I've used Verisys Antivirus API for 2 recently projects, and it works great, a huge improvement over self-hosted ClamAV. There are a couple of other virus scan APIs available, including Scanii[1] which I think has been mentioned on HN before, and I Trend Micro has something too - but their pricing is secret, so I have to assume it's expensive.
[0] https://www.ionxsolutions.com/products/verisys-virus-api https://www.ionxsolutions.com/products/verisys-virus-api
[1] https://scanii.com https://scanii.com
- byyll 2y agoHow are those better than ClamAV? I am not saying they aren't but you just said the detection rates of one is terrible compared to the rest.
- GordonS 2y agoThings got a lot better for ClamAV after the Cisco purchase, but detection rates remain attrocious. There are some commercial signatures available, which would certainly help, but it still doesn't come close to the detection rates of commercial scanning engines. ClamAV needs lots of memory to work - we needed at least 8GB in one project I worked on (where we also used commercial signatures), 4GB was just about enough for another. The more signatures you have, the more memory it uses. ClamAV chews through a lot of CPU, and it's so very slow. For example, scanning a 25MB MSI file from my test corpus takes 65 seconds - and that's on a fairly beefy machine! I've used both of the services linked above, and both seem excellent - detection rates and performance are far superior to ClamAV, and they Just Work(TM).