virus

1 files changed, 51 insertions, 0 deletions

diff --git a/2026/talks/virus.md b/2026/talks/virus.md
new file mode 100644
index 00000000..4bba693b
--- /dev/null
+++ b/2026/talks/virus.md
@@ -0,0 +1,51 @@
+[[!meta title="It's Probably Not a Virus"]]
+[[!meta copyright="Copyright © 2026 Corwin Brust"]]
+[[!inline pages="internal(2026/info/virus-nav)" raw="yes"]]
+
+<!-- Initially generated with emacsconf-publish-talk-page and then left alone for manual editing -->
+<!-- You can manually edit this file to update the abstract, add links, etc. --->
+
+
+# It's Probably Not a Virus
+Corwin Brust (he/him) - IRC: corwin, <https://savannah.gnu.org/users/carlc>, <mailto:corwin@bru.st>
+
+[[!inline pages="internal(2026/info/virus-before)" raw="yes"]]
+
+Two antivirus engines flagged pieces of the official GNU Emacs 31.1
+Windows binaries this September: McAfee quarantining preloaded .eln
+files at startup (bug#81750), and separately, a
+Trojan:Win32/Suschil!rfn report on the distributed zip itself
+(help-gnu-emacs, active since September 8). As the volunteer who
+builds and publishes these Windows binaries, I went looking for an
+actual defect: a full static-analysis pass across the shipped
+MINGW64 and UCRT64 sets (PE structure, entropy, import tables, and
+a byte-for-byte trace of the one specifically-reported export back
+to its real source) found nothing. I shipped a second release,
+built without native compilation, specifically to test whether
+removing the suspected trigger helps &ndash; a live experiment, not a
+fix, and I said so plainly to the mailing lists and to the FSF.
+This talk walks through that investigation: what static analysis
+can and can't prove about a false-positive claim, what I found and
+what I didn't, and what it looks like to narrate an unresolved
+problem honestly in public rather than waiting for a tidy ending
+before saying anything. It closes with what's still open as of
+talk time &ndash; including a small, telling case of two VirusTotal
+scan counts for the same file that don't agree with each other,
+and what that says about trusting a single number.
+
+About the speaker:
+
+Corwin Brust is a GNU volunteer who builds and publishes the
+official GNU Emacs Windows binary releases. This talk is a field
+report from an active, unresolved antivirus false-positive
+investigation into this year's Windows 31.1 release &ndash; what got
+checked, what didn't turn up an answer, and what shipped anyway
+while the question stays open.
+
+
+
+[[!inline pages="internal(2026/info/virus-after)" raw="yes"]]
+
+[[!inline pages="internal(2026/info/virus-nav)" raw="yes"]]
+
+