Golang and virustotal

[Paolo C.]

Hello,

I noticed that if you download golang portable zip for aMD64 and upload the

go.exe or gofnt.exe to virustotal one av complains.

If you compile a simple helloword main and upload, 4 or 5 minor av complain.

Anyone has this issue too?

I tested this from many machines, some completely virgin, so it should not be my environment.

Thanks

Paolo

[Rob Pike]

https://go.dev/doc/faq#virus

> --
> You received this message because you are subscribed to the Google Groups "golang-nuts" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/9cc862fa-d61d-46a4-a86f-0a63e4fcc660n%40googlegroups.com.

[Paolo C.]

Rob, thanks a lot.

I saw the disclaimer, but it appeared a little generic, and since with version 18 the av complaining are many, I tought that the issue should be at least mentioned on golang site.

I think this could be a potential disincentive to golang usage,

Because if binary distributions, that can be sometimes necessary in production, are seen as infected,

even if by false positive, this is for sure a deterrent.

Don't you think?

Paolo

[Ian Lance Taylor]

On Fri, Apr 29, 2022 at 4:12 AM Paolo C. <paoc...@gmail.com> wrote:
>
> Rob, thanks a lot.
> I saw the disclaimer, but it appeared a little generic, and since with version 18 the av complaining are many, I tought that the issue should be at least mentioned on golang site.
> I think this could be a potential disincentive to golang usage,
> Because if binary distributions, that can be sometimes necessary in production, are seen as infected,
> even if by false positive, this is for sure a deterrent.
> Don't you think?

I'm not sure quite what you are suggesting, but as the FAQ suggests
this happens with every new Go release. And of course it is mentioned
on the Go site: in the FAQ. There is very little that the Go project
can do about this problem.

Ian

> On Friday, April 29, 2022 at 12:34:16 PM UTC+2 Rob 'Commander' Pike wrote:
>>
>> https://go.dev/doc/faq#virus
>>
>> On Fri, Apr 29, 2022 at 8:22 PM Paolo C. <paoc...@gmail.com> wrote:
>> >
>> > Hello,
>> > I noticed that if you download golang portable zip for aMD64 and upload the
>> > go.exe or gofnt.exe to virustotal one av complains.
>> > If you compile a simple helloword main and upload, 4 or 5 minor av complain.
>> > Anyone has this issue too?
>> > I tested this from many machines, some completely virgin, so it should not be my environment.
>> > Thanks
>> > Paolo
>> >
>> > --
>> > You received this message because you are subscribed to the Google Groups "golang-nuts" group.
>> > To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.
>> > To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/9cc862fa-d61d-46a4-a86f-0a63e4fcc660n%40googlegroups.com.
>
> --
> You received this message because you are subscribed to the Google Groups "golang-nuts" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.

> To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/18a9f0cd-d038-42cb-9901-5e987bd88062n%40googlegroups.com.

[Klaus Post]

Hi!

You can try 'garble' and see if that helps: https://github.com/burrowers/garble

For me, it seems to reduce the number of false positives, but there are still some left.

/Klaus

[Roland Müller]

Hello,

Just a silly question: is the occurrence of false positives also influenced whether the binary has been cross-compiled e.g. in Linux or natively in Windows?

Until now I compiled all my Windows exes in my Linux PC and the "success rate" of the Virus scanner is 100% :-)

Regards,

Roland

--
You received this message because you are subscribed to the Google Groups "golang-nuts" group.
To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/35b078ad-88c5-49e1-8348-b016eb0a2cabn%40googlegroups.com.

[Rusco]

Regarding: "compile a simple helloworld main ...": 

My workaround is to insert a

  import "C"

among the other imports. It somehow alters the structure of the binary created and my av no more recognizes the binary. This is actually something which never happened when I am doing some Rust work.  

Might help.

[Robert Solomon]

My work around is to compile using  -ldflags="-s -w"

This has worked for the cases when my files make Windows unhappy.  I reported it as a bug to Microsoft months ago; I see that they got right on it.

--rob solomon

[Amnon]

My workaround is not to use Windows.
And not to use anti-virus programs that thing all Go programs are viruses.

[Henry]

I use Windows and Kaspersky. I build Go from source. I don't have such problem. 

[Paolo Calvi]

Weird thing is that I think virustotal is backed up by Google (not 100% sure) so it is curious they don't push on a more decent recognition, or provide some detection guidelines. Staying still that the blame is on AV makers, of course.

--
You received this message because you are subscribed to a topic in the Google Groups "golang-nuts" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/golang-nuts/lPwiWYaApSU/unsubscribe.
To unsubscribe from this group and all its topics, send an email to golang-nuts...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/9e4a55fb-0174-43fd-91da-091eaab3ad4en%40googlegroups.com.