The problem is that it isn't really something the project can fix -- the problem is with the antivirus, whose vendors aren't very responsive. See for instance the PuTTY devs' todo list item about virus false-positives: https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/... -- persistently every release gets falsely flagged by something or other, even if they do make a report and get it taken off the list it comes back for the next release, and at least one of the antivirus programs seems to be looking for the putty binary specifically!

Part of the problem with this is how some AVs rate new binaries. Previous job, we had issues with deployments of new versions. Most of our (only) corporate clients used Symantec. They would consistently flag our app as a possible virus because it's "reputation" was low. To Symantec, reputation basically meant how many times it'd seen the app before.

Symantec basically coerced us into buying a code-signing cert from them, and we still had to submit every build directly to them for this reputation issue to go away. Royal pain in the ass.

Sounds like a racket, to be honest. Can't say that I'm sad that their reputation, along with the reputation of traditional AV vendors as a whole, is in the dumpster these days.

It is most definitely a racket, and their "repuation" score severely affected our reputation with existing clients.

Same deployment procedure as had been for years (we'd previously been code-signing with a GoDaddy cert) with Click-Once deployment (was a .Net Office add-in), all of a sudden we start getting dinged.

The cost to the company (a relatively small company) was significant. Had to buy a Symantec code-signing cert (~$900), had to ditch ClickOnce and invest in InstallShield (don't recall the license cost) and engineer the installer to both sign the installed libs & the installer itself. All of this because Symantec hadn't seen the new libs enough because, well, we targeted a smaller corporate audience (for argument sake, we had around a 100 clients, of which, each would only have 1 or 2 installs of this particular app).

I get where they are coming from. Windows is far from the top OS used by D programers, it only effects people who use anti-virus, and I'm betting you can whitelist it or otherwise bypass it. All of those things may seem like sizable hurdles but we are talking about programmers here, I think they can handle it. I know back when I used Windows I would get false positives for all kinds of things because I was on the bleeding edge or always trying new stuff that they hadn't seen or looked malicious (but wasn't). If you are going to run "anti-virus" as a developer you need to know what side-effects you might run into (the same way I know that PrivacyBadger and uMatrix in Chrome can cause issues, I don't go running to the website that is broken just because my extension broke it).

Anti-virus is bundled with windows. Everyone will have it.

I wouldn't know how easy it would be to bypass. And in a corporate environment you would not be able to.

> Anti-virus is bundled with windows. Everyone will have it.

Someone interested in programming in D should be able to disable it and programmers != Everyone

> I wouldn't know how easy it would be to bypass. And in a corporate environment you would not be able to.

I feel like this knowledge is just a google search away and for corporate... If you computers are so locked down that you can't disable the anti-virus they are probably locked down so that you can't install new programs in general. I, for one, would never choose to work for a company that locked down and in that case I feel like you just need to talk to IT to ask them to whitelist it.

All of that said I feel like there is a huge disconnect between the points you are making and the actual population that is trying to use D. Look, I have no clue on the actual install base/user base of D lang but I can't imagine we are talking a "real" number of people having this issue. D doesn't even rank on any of the "Top languages of 2018" lists I found online (that isn't a knock on D, it's just facts) so that coupled with the fact that the vast majority of D developers seem to use non-Windows OS's make this all seem like a lot to do about nothing.

> I, for one, would never choose to work for a company that locked down

Good luck finding a job in banking, government, healthcare, defense, retail, insurance, securities, food, pharmaceutical, or pretty much anything other than social media.

All of these industries are basically forced into “whitelisted software only” by some regulation or another.

I think the size of the company determines this far more than the industry does. I prefer to work for smaller-sized companies or ones that don't treat their employees like children with locked down computers and access. I work in the corrections industry (think ankle bracelet monitoring) and there are no such regulations. In fact I use my personal computer for all my work people it blows the standard equipment out of the water. Even so all our devs have full root on their boxes and install whatever they want.

Also I find it very hard to believe that everyone working at FAANG companies is using a locked down computer.

I for one, never did choose to work for such a company, and yet now I do anyway because my chosen small company was sold to a huge one, after I am 19 years in.

It's almost like that was easier to say than to do.

I'd like to clarify and point out I used the word "choose" very much so on purpose. There are a number of things that would effectively remove this choice from me. If tomorrow I was laid off and I couldn't find anything within a a couple of weeks I'd work at McDonalds to get by but for as long as I have the choice I'm not interested in locked down computers or locked down internet where I work. If I were in your position I'd have to weigh the pros and cons before deciding to look for a new job. You obviously decided the pros outweighed the cons and I don't hold it against you or anyone else.

> I'm betting you can whitelist it or otherwise bypass it

That you can easily bypass it is irrelevant - it's a bad sign to me, as a potential user, when the installer is flagged as a virus, and a far worse one when the D team seems utterly apathetic about fixing it. I see no evidence in the thread whether it's a false positive or not (though plenty of unbacked claims and some ad hominem: "you are the one using the snake oil software"), only developers asking the users to blindly report it to their AV vendor.

I also did not see any response to Mike Franklin's comment: "It's not the compiler that is reporting the virus, it's the installer. What utility are we using the generate the installer executable?"

This throws up an entire forest of red flags to me as a developer - I'll stick to languages where the contributors care enough about the language to report a false positive themselves.

Why is it on D's developers to fix a false positive in someone else's software? They redirected the reporter to the proper venue. I don't see what else they should be doing.

1. Show interest.

2. They are the only authority that can rightfully claim that their product is virus free. In time they might gain an understanding of what triggers it which might also be beneficial when reporting it. If it is a common occurrence they should probably have a template ready and a process for doing this. They also have interest in it being done correctly and that they have the ability follow up on any issues. In fact, they should prefer to do it themselves rather than random people doing it for them when they only indirectly can be informed of any progress.

3. Thank the reporter for bringing the issue to their attention.

4. Happy to answer questions related to the issue.

Doesn't matter who is to blame. The D community is taking the hit, they should act to try and avoid that.

If google erroneously blacklists your site, why should you care? You haven't done anything wrong? Some things just suck and you have to take care of it yourself.

1. these same false-positives have been a recurring issue for multiple years already

2. there is no fix for a tool which is not a mass-market-consumer-product

3. as a technologist you should know that all anti-virus is bullshit which does not work. false positives and false negatives abound. the anti-virus's job is to accurately identify viruses/malware because users can't. But the anti-virus can't do it either. It's true. Really. I figured this out on my own over 15 years ago, and it never changed.

I really hate the sentiment and consensus around anti-virus. It's like an "car-crash protection talisman". It just does not work. But if you tell some one not to use it, and they get in a car crash, it's your fault. If they use it, and they get in a car crash, oh well, what can you do. But it's truly bullshit.

> They are the only authority that can rightfully claim that their product is virus free.

This is a dumb idea. What's the point of anti-virus if we just trust the vendor.

So, the solution is to antagonize a user that is taking time and effort to inform you of the problem?

> This is a dumb idea. What's the point of anti-virus if we just trust the vendor.

The AV company will, hopefully, not... The vendor is the only one that can vet that the file on the site is the file that it is intended to be. They are also the only ones that can make changes to the their builds (which can help).

That's like asking why you should correct false data on your personal credit report. It's someone else's computer database, not yours! (Or maybe a better analogy would be "Why should I ask Google to stop marking my legit domain as spam and hiding emails to my users? It's their system!")

Software developers have to lobby on their own behalf so their software fits into larger ecosystems seamlessly. Or deal with angry users.

Angry users is not something you can opt out of. Malware reports are just another fact of life for many open source projects. I think the putty link (was posted elsewhere) is an awesome summary of the impossible fight you're asking developers off taking on.

Also, that's an insane comparison between AV reports and personal credit reports.

Another analogy: "This is why Red Hat got $34 billion for some stuff that a bunch of other people, not unlike the D compiler authors, wrote for free."

Support is important.

akavel said it best, you have to pick your battles. Who are we to tell the D programmers that this small issue affecting a tiny percentage of their users is a higher priority than any feature/bug/etc they have in their backlog?

All of this stinks of entitlement to me. "I want you to fix my problem cause by my software that only affects a small group of people".

I totally emphatically understand, that for DMD authors, reporting their binary to a truckload indifferent AV vendors is the worst kind of kafka-esque, soul-draining, burnout-inducing, and quixotic chore imaginable. While at the same time they're certainly trying to manage a lot of hard chores already, where at least they have a bit more agency over the eventual result. There's only so much they can do with limited resources. They must pick their battles, and it's fully and only their choice to make, no one can force them otherwise.

Then, they're actually still patient enough to be polite and trying to suggest to the user what he/she can do to help the project (or actually himself/herself), in order to resolve the issue he/she has. And in response, the user is only trying to deflect any responsibility and work/effort, and aggressively trying to push it back on them, using some weird, illogical, and generally absurd arguments (that they also are politely trying to explain as being invalid). Instead of actually trying to do what they suggested, and what could actually help resolve the issue.

That's how it would look like from the authors/maintainers' side of the fence.

Installer and binaries have been signed and submitted to Microsoft since a while to fix the issue with Windows Defender. https://dlang.org/changelog/2.082.0.html#signed_windows_bina...

Neither the last release nor the recent release candidate have been flagged by any AV according to VirusTotal. https://www.virustotal.com/#/file/e2ea2807faf41978a842f91890... https://www.virustotal.com/#/file/834d7547d395cc4080ab28a177...

There's probably a significant overlap between developers who use a non-mainstream language like D and developers who use non-mainstream OSs like Linux or macOS.

They obviously put in the probably very non-trivial effort to make a windows version. This is about caring about the product they produce.

If "they" refers to the D Language community, there's nothing that they can do. The AV vendors are the ones doing it, and they don't care.

It happens with useful system utilities (windows sudo and nssm for instance). It's because they request elevated privileges and aren't part of an installer application that's popular.