From 4dae3ad5fba98262b2a55f1add8addd4f47c0f61 Mon Sep 17 00:00:00 2001 From: Sacha Chua Date: Mon, 19 Oct 2026 13:15:19 -0400 Subject: virus --- 2026/talks/virus.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 2026/talks/virus.md (limited to '2026/talks') diff --git a/2026/talks/virus.md b/2026/talks/virus.md new file mode 100644 index 00000000..4bba693b --- /dev/null +++ b/2026/talks/virus.md @@ -0,0 +1,51 @@ +[[!meta title="It's Probably Not a Virus"]] +[[!meta copyright="Copyright © 2026 Corwin Brust"]] +[[!inline pages="internal(2026/info/virus-nav)" raw="yes"]] + + + + + +# It's Probably Not a Virus +Corwin Brust (he/him) - IRC: corwin, , + +[[!inline pages="internal(2026/info/virus-before)" raw="yes"]] + +Two antivirus engines flagged pieces of the official GNU Emacs 31.1 +Windows binaries this September: McAfee quarantining preloaded .eln +files at startup (bug#81750), and separately, a +Trojan:Win32/Suschil!rfn report on the distributed zip itself +(help-gnu-emacs, active since September 8). As the volunteer who +builds and publishes these Windows binaries, I went looking for an +actual defect: a full static-analysis pass across the shipped +MINGW64 and UCRT64 sets (PE structure, entropy, import tables, and +a byte-for-byte trace of the one specifically-reported export back +to its real source) found nothing. I shipped a second release, +built without native compilation, specifically to test whether +removing the suspected trigger helps – a live experiment, not a +fix, and I said so plainly to the mailing lists and to the FSF. +This talk walks through that investigation: what static analysis +can and can't prove about a false-positive claim, what I found and +what I didn't, and what it looks like to narrate an unresolved +problem honestly in public rather than waiting for a tidy ending +before saying anything. It closes with what's still open as of +talk time – including a small, telling case of two VirusTotal +scan counts for the same file that don't agree with each other, +and what that says about trusting a single number. + +About the speaker: + +Corwin Brust is a GNU volunteer who builds and publishes the +official GNU Emacs Windows binary releases. This talk is a field +report from an active, unresolved antivirus false-positive +investigation into this year's Windows 31.1 release – what got +checked, what didn't turn up an answer, and what shipped anyway +while the question stays open. + + + +[[!inline pages="internal(2026/info/virus-after)" raw="yes"]] + +[[!inline pages="internal(2026/info/virus-nav)" raw="yes"]] + + -- cgit v1.2.3