The response on that issue was a bit depressing. Since noone seems to care I'm not surprised that it isn't fixed.
But it is surprising to me that this isn't a top priority.
But it is surprising to me that this isn't a top priority.
Symantec basically coerced us into buying a code-signing cert from them, and we still had to submit every build directly to them for this reputation issue to go away. Royal pain in the ass.
Same deployment procedure as had been for years (we'd previously been code-signing with a GoDaddy cert) with Click-Once deployment (was a .Net Office add-in), all of a sudden we start getting dinged.
The cost to the company (a relatively small company) was significant. Had to buy a Symantec code-signing cert (~$900), had to ditch ClickOnce and invest in InstallShield (don't recall the license cost) and engineer the installer to both sign the installed libs & the installer itself. All of this because Symantec hadn't seen the new libs enough because, well, we targeted a smaller corporate audience (for argument sake, we had around a 100 clients, of which, each would only have 1 or 2 installs of this particular app).
I wouldn't know how easy it would be to bypass. And in a corporate environment you would not be able to.
Someone interested in programming in D should be able to disable it and programmers != Everyone
> I wouldn't know how easy it would be to bypass. And in a corporate environment you would not be able to.
I feel like this knowledge is just a google search away and for corporate... If you computers are so locked down that you can't disable the anti-virus they are probably locked down so that you can't install new programs in general. I, for one, would never choose to work for a company that locked down and in that case I feel like you just need to talk to IT to ask them to whitelist it.
All of that said I feel like there is a huge disconnect between the points you are making and the actual population that is trying to use D. Look, I have no clue on the actual install base/user base of D lang but I can't imagine we are talking a "real" number of people having this issue. D doesn't even rank on any of the "Top languages of 2018" lists I found online (that isn't a knock on D, it's just facts) so that coupled with the fact that the vast majority of D developers seem to use non-Windows OS's make this all seem like a lot to do about nothing.
Good luck finding a job in banking, government, healthcare, defense, retail, insurance, securities, food, pharmaceutical, or pretty much anything other than social media.
All of these industries are basically forced into “whitelisted software only” by some regulation or another.
Also I find it very hard to believe that everyone working at FAANG companies is using a locked down computer.
It's almost like that was easier to say than to do.
That you can easily bypass it is irrelevant - it's a bad sign to me, as a potential user, when the installer is flagged as a virus, and a far worse one when the D team seems utterly apathetic about fixing it. I see no evidence in the thread whether it's a false positive or not (though plenty of unbacked claims and some ad hominem: "you are the one using the snake oil software"), only developers asking the users to blindly report it to their AV vendor.
I also did not see any response to Mike Franklin's comment: "It's not the compiler that is reporting the virus, it's the installer. What utility are we using the generate the installer executable?"
This throws up an entire forest of red flags to me as a developer - I'll stick to languages where the contributors care enough about the language to report a false positive themselves.
2. They are the only authority that can rightfully claim that their product is virus free. In time they might gain an understanding of what triggers it which might also be beneficial when reporting it. If it is a common occurrence they should probably have a template ready and a process for doing this. They also have interest in it being done correctly and that they have the ability follow up on any issues. In fact, they should prefer to do it themselves rather than random people doing it for them when they only indirectly can be informed of any progress.
3. Thank the reporter for bringing the issue to their attention.
4. Happy to answer questions related to the issue.
Doesn't matter who is to blame. The D community is taking the hit, they should act to try and avoid that.
If google erroneously blacklists your site, why should you care? You haven't done anything wrong? Some things just suck and you have to take care of it yourself.
2. there is no fix for a tool which is not a mass-market-consumer-product
3. as a technologist you should know that all anti-virus is bullshit which does not work. false positives and false negatives abound. the anti-virus's job is to accurately identify viruses/malware because users can't. But the anti-virus can't do it either. It's true. Really. I figured this out on my own over 15 years ago, and it never changed.
I really hate the sentiment and consensus around anti-virus. It's like an "car-crash protection talisman". It just does not work. But if you tell some one not to use it, and they get in a car crash, it's your fault. If they use it, and they get in a car crash, oh well, what can you do. But it's truly bullshit.
> They are the only authority that can rightfully claim that their product is virus free.
This is a dumb idea. What's the point of anti-virus if we just trust the vendor.
> This is a dumb idea. What's the point of anti-virus if we just trust the vendor.
The AV company will, hopefully, not... The vendor is the only one that can vet that the file on the site is the file that it is intended to be. They are also the only ones that can make changes to the their builds (which can help).
Software developers have to lobby on their own behalf so their software fits into larger ecosystems seamlessly. Or deal with angry users.
Also, that's an insane comparison between AV reports and personal credit reports.
Support is important.
All of this stinks of entitlement to me. "I want you to fix my problem cause by my software that only affects a small group of people".
Then, they're actually still patient enough to be polite and trying to suggest to the user what he/she can do to help the project (or actually himself/herself), in order to resolve the issue he/she has. And in response, the user is only trying to deflect any responsibility and work/effort, and aggressively trying to push it back on them, using some weird, illogical, and generally absurd arguments (that they also are politely trying to explain as being invalid). Instead of actually trying to do what they suggested, and what could actually help resolve the issue.
That's how it would look like from the authors/maintainers' side of the fence.
Neither the last release nor the recent release candidate have been flagged by any AV according to VirusTotal. https://www.virustotal.com/#/file/e2ea2807faf41978a842f91890... https://www.virustotal.com/#/file/834d7547d395cc4080ab28a177...