Some AV vendors (notably Avast, AVG, Avira, McAffee, Norton and Windows Defender) use extremely poor heuristics and never actually tweak them, instead just whitelisting a given file. You think that if false positive in a compiler or runtime is reported they'll at least will get serious about it? Nope.

Consider Red, which gets hit by AV truck almost on a monthly basis [1]. Not only toolchain itself gets recognized as a "generic malware" †, but almost all compiled user applications get flagged too. Such false positives are alway duly reported, issue seems to be gone... and then cycle repeats, even though no changes in compiler output or runtime with REPL were made ‡. Just like that, sporadically. Some of them go nuts even over simple "hello world".

Last year, as a last resort, developers directly twitted one of the most nastiest vendors (Avira) about this issue [2]. Nothing changed. They don't care at all, since 2012, when the Red project started.

I know NirSoft [3] products suffer from that plague; network utilities (Wireshark, nmap) get hit, so as various packers (WinRar, also see [4]); re-reading the thread after the original post, I'm not even surprised that demoscene experiences problems with anti-virus software; but seeing this issue pertaining mainstream language such as D is, well, terrifying, to say the least ⁂.

It can be easily brushed off as an anomaly in such mature, widely adopted code bases, but with non-mainstream, yet-in-development languages it's a scourge that hinders the adoption and serves as a constant source of headache both for developers and users. And, honestly, I can't see how this can be resolved without raising public awareness and engaging other developers in a debate.

--

[1]: https://github.com/red/red/issues?utf8=%E2%9C%93&q=label%3At...

[2]: https://twitter.com/red_lang/status/887970289618829312

[3]: https://www.nirsoft.net/

[4]: https://news.ycombinator.com/item?id=4152539 (apparently, original post is deleted, but still can be retrieved via Archive)

--

† We can only guess what causes the trigger, as vendors never give any feedback. One guess is that toolchain generates a file layout different from VisualStudio or GCC linkers, and uses a custom compression of DATA segment.

‡ I think this happens after each update of heuristic DBs or AV engines which vendors share. IIRC Windows started to use machine learning for malware detection some time ago. Total bonanza.

⁂ Ever wondered what the very first issue in Nim repository was? (https://github.com/nim-lang/Nim/issues/1)