5

The converse of this question.

How to give evidence that an open-source project is reputable?

The installer for my project is being picked up as "Untrusted" by a popular anti-virus software (in this particular case, Symatec). The scanner doesn't say that my project is a virus, but really just warms that it is Untrusted because it's only seen it in the wild a few hundred times. The software is safe, but this warning is potentially scaring off new users.

How can I either get virus scanners to trust my software, or impress upon my potential users that the software really isn't contaminated?

  • Comments are not for extended discussion; this conversation has been moved to chat. – Zizouz212 Aug 20 '15 at 21:30
1

There is a great deal of malware out there. There are new exploits every day. From the point of view of non-technical users of computers, particularly Windows computers, it is a good thing that AV systems warn them against the rare and unusual.

So, realistically, anyone with a new thing has a hill to climb. It's a marketing hill. What can you do? If your audience is really nontechnical people, you have to find a way to get noticed by the media. Get your program reviewed in places where potential users will read the review. If trustworthy people write 'this is a good thing, don't worry about the AV' warning, then people will install it. If enough people install it, you won't get warnings any longer.

  • 1
    You will get false positives for every new release of your installer, though. Happens to us every time, and makes me feel that virus 'scanners' are basically huge whitelists of file checksums :) – Michael Schumacher Aug 21 '15 at 8:44
1

First off, you need to understand that this isn't just you. It happens to all kinds of projects.

Symatec thinks Git is untrustworthy]

That's Git several hours after release. Symatec thinks it's not trust worthy too. Bmarguiles is absolutely right that the "easy" way to deal with this is to have a large number of users. Then, this will magically take care of itself as the AV vendors see more instances of the software.

That's not very practical for a young project though. That warning is scaring off the very same users you need to make that warning go away. The solution here is to start blanketing as many AV vendors as possible with Whitelist requests. Each vendor has a different process, but it generally involves filling out a form, attaching your installer, and sending them the request. Wikipedia has a non-exhaustive list of notable AV software that would be a great place to get started. Settle in though, because it's a big list and you generally need to do this every time you release. At least until you have a good reputation with a consistent user base. Honestly, as often as we release our project, we just don't bother making whitelist requests, but it could be manageable if you're only releasing a few times a year.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.