Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Symantec throws up hurdles to independent software developers

codeandweb.com

Post reply on HN
Print view View original

31–40 of 45 posts

Re: Symantec throws up hurdles to independent software developers

#31

Post by jiggy2011 »

ams6110 wrote: post #29
jiggy2011 wrote: post #27

Is there even much point in using AV software? I ask this because I have never installed any on my computer (including on Windows) and I have only ever knowingly been infected once in the last 10 years (I think this happened because I didn't update Windows Media Player and it was still associated with a file type and somehow a rogue media file streamed from a website attacked it). On the other hand people I know who…

In the past, on Windows and Macs (pre-OSX), it was pretty much a requirement unless your machine was really stand-alone and you never dealt with files from any untrusted sources. These days, if you keep your system patched, use an unprivileged account for your normal activity, use a local firewall and/or NAT, and stay away from shady websites you are probably pretty safe. I have similar experiences with a friend who'…

There is possibly a problem with user education here.

Running software on your computer that is not set to automatically pull down and install security patches to me seems like a far bigger problem than not running AV software. Windows does warn you if you turn automatic updates off , but afaik there is rarely such a warning about third party software.

In your friends case it would seem that he is not getting updates from adobe, since viewing a PDF file should not cause third party code execution so he must be getting PDFs that are exploiting his PDF reader (presumably adobe fixes these quickly as they arise).

Re: Symantec throws up hurdles to independent software developers

#32

Post by AndreasLoew »

mjard wrote: post #14

I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a…

> This goes directly to the team and they should have your programs whitelisted within a few business days. 50% of my users are from USA - Symantec claims that they have a 60% market share in USA - this means that I loose 30% of my income. Day by day until it is fixed. Who is going to compensate for this? Is there a way to seed things up?

> Second: sign your executables. Well - now I know. But I just leaned it because I got complaints from my users.

> Third: don't change domains. This wiped out your known reputation. Thanks for that information. I switched my internet provider and domain. I also use Amazon Cloud Front for fast software distribution to allow users outside Europe a fast download. I've also added subdomain cdn.codeandweb.com because I thought this might solve the problem.

So you say that it will help 1) To place the downloads on the "old" domain? 2) Sign the executables 3) Move the downloads back to the new domain / cdn?

Re: Symantec throws up hurdles to independent software developers

#33

Post by symcthrowaway »

kevingadd wrote: post #17
mjard wrote: post #14

I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a…

Is it actually possible for everyone to sign their executables? Last time I did it, I had to fork over something like $250/yr for a signing key along with providing copies of various documents. This seems a little high for someone who just, say, wants to make free utilities available to the world. In the case of Firefox, one would think it would be possible for you guys to do something about it on your end, because y…

So, I also worked on this team (and am good friends with mjard). At some point there was a big decision made to heavily bias the engine against "unknown" executables. I said it was a bad idea then, and I still think it is now. The only way it can "know" about an executable is via its source, or its signature, or if it is on other users machines. This creates the obvious huge problem for "the little guy" distributing software. They actually think this is no big deal, and when it steps on toes, the distributor can just use their dispute system and eventually they will fix it. And if you don't like it, you can just get your software signed. I was of the opinion that this was bad behavior and unreasonable. They really liked what it did for review scores (surprise, we detect everything!). I lost.

Create a harmless helloworld.exe and put it on a random website. Download and run it. If things haven't changed since I left, it will get flagged as malware.

What I can say is that this has nothing to do with trying to crush the little guy or malice. With some exceptions, there is a general attitude there of not caring, or caring about the wrong things. Hanlon's Razor a little bit.

Re: Symantec throws up hurdles to independent software developers

#34

Post by symcthrowaway »

cluda01 wrote: post #2

Suppose Symantec started a program where companies were allowed to pay for their apps to be white listed would and precluded from this check. Could this be considered a protection racket under anti-trust rules?

They do have this program, though you are allowed to pay other CAs if you want. Symantec sells certificates (they bought Verisign), which will whitelist you, but it is not required that you get your certificate from them.

Re: Symantec throws up hurdles to independent software developers

#35

Post by malkia »

symcthrowaway wrote: post #33
kevingadd wrote: post #17

Earlier quoted context omitted.

Is it actually possible for everyone to sign their executables? Last time I did it, I had to fork over something like $250/yr for a signing key along with providing copies of various documents. This seems a little high for someone who just, say, wants to make free utilities available to the world. In the case of Firefox, one would think it would be possible for you guys to do something about it on your end, because y…

So, I also worked on this team (and am good friends with mjard). At some point there was a big decision made to heavily bias the engine against "unknown" executables. I said it was a bad idea then, and I still think it is now. The only way it can "know" about an executable is via its source, or its signature, or if it is on other users machines. This creates the obvious huge problem for "the little guy" distributing…

Wait... A Typical gamedev studio uses 50-100 own executables, if not more. Directly fro perforce/svn/etc. In between studios.

....

Re: Symantec throws up hurdles to independent software developers

#36

Post by mjard »

AndreasLoew wrote: post #32
mjard wrote: post #14

I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a…

> This goes directly to the team and they should have your programs whitelisted within a few business days. 50% of my users are from USA - Symantec claims that they have a 60% market share in USA - this means that I loose 30% of my income. Day by day until it is fixed. Who is going to compensate for this? Is there a way to seed things up? > Second: sign your executables. Well - now I know. But I just leaned it becaus…

> Is there a way to speed things up?

Afraid not, the team will manually vet your executables so it takes some time. Fill out the forms, I wouldn't be surprised if they responded by monday. Make sure you list the possible locations to download your software.

I'd mention on your download page that Norton is currently vetting your software, so a WS.Reputation.1 message can be expected. Users are able to pull the file out of quarantine, if they read the popup message, so it'd help if they are expecting it.

>> Second: sign your executables. Well - now I know. But I just leaned it because I got complaints from my users.

ALL DEVELOPERS SHOULD SIGN THEIR EXECUTABLES / PACKAGES: it's not just for antrivirus products, its a way for your customers to verify they are getting the expected product from you.

> So you say that it will help 1) To place the downloads on the "old" domain? 2) Sign the executables 3) Move the downloads back to the new domain / cdn?

I wouldn't change anything at this point, you have the downloads working as you want, let Symantec fix its reputation for how your system works.

Re: Symantec throws up hurdles to independent software developers

#37

Post by mjard »

malkia wrote: post #35
symcthrowaway wrote: post #33

Earlier quoted context omitted.

So, I also worked on this team (and am good friends with mjard). At some point there was a big decision made to heavily bias the engine against "unknown" executables. I said it was a bad idea then, and I still think it is now. The only way it can "know" about an executable is via its source, or its signature, or if it is on other users machines. This creates the obvious huge problem for "the little guy" distributing…

Wait... A Typical gamedev studio uses 50-100 own executables, if not more. Directly fro perforce/svn/etc. In between studios. ....

Version control products wont have to deal with the reputation engine.

Re: Symantec throws up hurdles to independent software developers

#38

Post by mjard »

apiguy wrote: post #25
mjard wrote: post #14

I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a…

Your steps sound nice but in reality it doesn't work out this way (speaking from multiple experiences with your reputation system). First of all, EVERY piece of desktop software my company delivers to users is signed via a known and trusted authority. We knew that would be important and took steps before ever releasing our first piece of desktop software. Secondly, the error message that users are presented with SCAR…

> Secondly, the error message that users are presented with SCARES THEM.

Antivirus customers are they type of users that are scared, they are typically users that don't know what to trust. I feel you, I really do.

> It took us quite a while to figure out where that "false positive" link was.

This was a huge peeve of mine, the form is pretty impossible to find unless you use a search engine.

> When we finally did discover the issue, it wasn't clear what to do. It took us quite a while to figure out where that "false positive" link was, and we weren't even sure that it was the right place to send it to. Even worse, you claim that they "should" have the programs whitelisted within a few business days. This is patently false and never happens that quickly. It took a month before the executable we submitted was whitelisted and you know what? It didn't help one bit.

Normal turn around time is a few days, it shouldn't take a month. Was this around Christmas? Were the files served via https? Are files unique between downloads? Were the files mirrored to different domains? Did the team have actual executables to vet?

I understand your frustration and I am sorry it feels like Symantec is working against you. Please continue to fill out false positive reports, the team takes those seriously. With false positives, it shows the system is flawed and they'll take a deeper look at fixing the fundamental problems, otherwise they think the system is working perfectly.

Re: Symantec throws up hurdles to independent software developers

#39

Post by mjard »

kevingadd wrote: post #17
mjard wrote: post #14

I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a…

Is it actually possible for everyone to sign their executables? Last time I did it, I had to fork over something like $250/yr for a signing key along with providing copies of various documents. This seems a little high for someone who just, say, wants to make free utilities available to the world. In the case of Firefox, one would think it would be possible for you guys to do something about it on your end, because y…

> Is it actually possible for everyone to sign their executables? Last time I did it, I had to fork over something like $250/yr for a signing key along with providing copies of various documents. This seems a little high for someone who just, say, wants to make free utilities available to the world.

No, it's not. If you sell programs, then forking over the $250 a year makes sense. If you give away programs, well, is it a loss if a user is scared off? (Serious question)

> In the case of Firefox, one would think it would be possible for you guys to do something about it on your end.

In the end, this is what we did. But it is impossible to do this for everybody.

> because you're the ones who added this reputation system that's causing users grief.

Oh boy. We did keep stats on this. Files that the reputation system scored to be "bad" and were later vetted. All in all, the reputation system works really well. There are some false positives and those do cause grief, but a majority of the time, the system blocks legitimately bad software.

Re: Symantec throws up hurdles to independent software developers

#40

Post by voltagex_ »

mjard wrote: post #14

I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a…

How can a developer check his or her applications against this without needing to run Norton Internet Security or AV.

If this isn't possible, is there a cheap(er) option that I can get my hands on that still includes this reputation check?

Post reply on HN