Hacker News Reader

Comment by Guzba | Hacker News Reader

It's interesting. How does one exactly address this? If anyone knows I'm genuinely curious since this seems horrible.

(Snark time) Is there someone that gets paid for protection? Maybe a "contribution" to security research efforts at one of these places? Or is there just an "I'm not a virus" flag Nim is forgetting to set.

View on HN

AV vendors have points of contact to report false positives. They don't always respond quickly, but they're not brick walls. Reliable FPs from a specific toolchain seems like something their team would be especially interested in solving. CrowdStrike's reporting point is an email address on their contact page: https://www.crowdstrike.com/contact-us/

Ok I sent an email report explaining the issue with additional info. Let's see what happens.

Edit: Got a reply:

> Thank you for contacting CrowdStrike’s public AV scanner team! If you have not done so yet, please upload a sample of the file in question to Hybrid Analysis at https://www.hybrid-analysis.com/. Furthermore, please make sure that your request contains the SHA256 hash of the file.

I look forward to them no longer flagging one specific Nim binary produced just as an example.

Try adding debug symbols or make a fatter binary. Nim (and to a lesser extent Zig) has an emphasis on producing tiny binaries. I suspect some of the same optimization outputs matches the signatures of malware (which often is written in heavily optimised code).

I realize you are trying to help, but I find this to be a very depressing suggestion. "Make things worse". Fortunately I do not need to care about people captured by these anti-virus cartel members so I will not do this.

Reply on news.ycombinator.com