Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Troubleshooting section about antivirus false positive #1840

Merged
merged 6 commits into from
Sep 21, 2021

Conversation

philrz
Copy link
Contributor

@philrz philrz commented Sep 17, 2021

As discussed in a thread on public Slack, a user recently made us aware that our suricata-update.exe binary gets flagged as possible malware. Here's my attempt at writing an article to address the topic proactively or via link should it come up again with other users. In addition to pointing our own users at it, I expect I might also be able to reference it from:

  1. The "comments" area of the Community tab for the VirusTotal entry, as was recommended to me by one community user in that Slack thread.
  2. Forms or emails with which we might contact the antivirus providers to make the case that it be considered a false positive.

I admit this content was a little awkward to write. Obviously I'd prefer to not have gone into such extensive detail when describing the origin of the file i question. At the same time, just saying "don't worry, it's a false positive" would have felt sleazy (isn't that exactly what a malware-provider would say?), and saying "it's open source... go convince yourself" without some detail would have felt like a lazy attempt to distract. Given that we're open source, I figured I might as well put it all out there in the open.

In addition to our own PR review process, I'll also bring this PR to the attention of the community user that offered some initial guidance and will hold off on merging until they've had a chance to offer feedback as well.

@philrz philrz self-assigned this Sep 17, 2021
@philrz
Copy link
Contributor Author

philrz commented Sep 20, 2021

I got a passing grade from the community. 😉

docs/Troubleshooting-(v0.25.0+).md Outdated Show resolved Hide resolved
docs/Troubleshooting-(v0.25.0+).md Outdated Show resolved Hide resolved
docs/Troubleshooting-(v0.25.0+).md Outdated Show resolved Hide resolved
docs/Troubleshooting-(v0.25.0+).md Outdated Show resolved Hide resolved
philrz and others added 4 commits September 21, 2021 11:47
Co-authored-by: Noah Treuhaft <noah.treuhaft@gmail.com>
Co-authored-by: Noah Treuhaft <noah.treuhaft@gmail.com>
Co-authored-by: Noah Treuhaft <noah.treuhaft@gmail.com>
… code

Co-authored-by: Noah Treuhaft <noah.treuhaft@gmail.com>
@philrz philrz merged commit fbde3bc into main Sep 21, 2021
@philrz philrz deleted the virus-false-positive branch September 21, 2021 18:49
@philrz
Copy link
Contributor Author

philrz commented Sep 21, 2021

I've also added a comment at VirusTotal pointing back at the article. When I have some cycles I'll look into what's involved with contacting the anti-virus providers to see if there's a chance of this being marked as benign at the source such that this becomes a non-issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants