diff options
Diffstat (limited to '2026/talks/virus.md')
| -rw-r--r-- | 2026/talks/virus.md | 51 |
1 files changed, 51 insertions, 0 deletions
diff --git a/2026/talks/virus.md b/2026/talks/virus.md new file mode 100644 index 00000000..4bba693b --- /dev/null +++ b/2026/talks/virus.md @@ -0,0 +1,51 @@ +[[!meta title="It's Probably Not a Virus"]] +[[!meta copyright="Copyright © 2026 Corwin Brust"]] +[[!inline pages="internal(2026/info/virus-nav)" raw="yes"]] + +<!-- Initially generated with emacsconf-publish-talk-page and then left alone for manual editing --> +<!-- You can manually edit this file to update the abstract, add links, etc. ---> + + +# It's Probably Not a Virus +Corwin Brust (he/him) - IRC: corwin, <https://savannah.gnu.org/users/carlc>, <mailto:corwin@bru.st> + +[[!inline pages="internal(2026/info/virus-before)" raw="yes"]] + +Two antivirus engines flagged pieces of the official GNU Emacs 31.1 +Windows binaries this September: McAfee quarantining preloaded .eln +files at startup (bug#81750), and separately, a +Trojan:Win32/Suschil!rfn report on the distributed zip itself +(help-gnu-emacs, active since September 8). As the volunteer who +builds and publishes these Windows binaries, I went looking for an +actual defect: a full static-analysis pass across the shipped +MINGW64 and UCRT64 sets (PE structure, entropy, import tables, and +a byte-for-byte trace of the one specifically-reported export back +to its real source) found nothing. I shipped a second release, +built without native compilation, specifically to test whether +removing the suspected trigger helps – a live experiment, not a +fix, and I said so plainly to the mailing lists and to the FSF. +This talk walks through that investigation: what static analysis +can and can't prove about a false-positive claim, what I found and +what I didn't, and what it looks like to narrate an unresolved +problem honestly in public rather than waiting for a tidy ending +before saying anything. It closes with what's still open as of +talk time – including a small, telling case of two VirusTotal +scan counts for the same file that don't agree with each other, +and what that says about trusting a single number. + +About the speaker: + +Corwin Brust is a GNU volunteer who builds and publishes the +official GNU Emacs Windows binary releases. This talk is a field +report from an active, unresolved antivirus false-positive +investigation into this year's Windows 31.1 release – what got +checked, what didn't turn up an answer, and what shipped anyway +while the question stays open. + + + +[[!inline pages="internal(2026/info/virus-after)" raw="yes"]] + +[[!inline pages="internal(2026/info/virus-nav)" raw="yes"]] + + |