DonationCoder.com Forum

Main Area and Open Discussion => General Software Discussion => Topic started by: db90h on September 23, 2011, 04:41 AM

Title: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 23, 2011, 04:41 AM
I have been a member of a malware working group at the IEEE of which almost ALL security vendors participate. I've therefore been in a position to create and propose this new Forum: http://falsepositivereport.com . This is only hours old, but one security vendor has agreed to take part. As the others wake, we'll see who will voluntarily take part in it. As long as Software Vendors take part, security vendors will eventually be forced to take part in order to respond.

OFFICIAL SITE:  http://falsepositivereport.com (http://falsepositivereport.com)

I would like to congratulate Microsoft as the one company who takes the conservative approach, making their false positive rate the lowest in the industry. Kudos to them. All security companies should act that way! Causing collateral damage to innocent businesses/families is simply unacceptable. It will sometimes accidentally occur, but clearly not enough is being done to prevent this problem, as it has only gotten worse.

---------------------------------

Accountability. Transparency. Communication. Prevention.
Helping to prevent false positives and mis-rating of web sites, instead of merely retroactively addressing them

This is a new effort to help slow (and expose) the plague of false positives and mis-rated web sites that are destroying hundreds or thousands of small businesses every year. Some security companies do better than others, but never before has there been a place where false positives and mis-rated sites can be publicly reported. The security companies can then respond, fix the issue, then determine why it happened and work with the vendor to avoid it in the future. After all, once a false positive happens, the damage is already done. Some security companies will not even respond to reports of false positives and mis-rated sites, much less work to avoid them in the future. Other companies DO act much more responsibly.

This is NOT about crucifying security companies. They do have a terribly hard job. Still, many of them can and should do better. This site is about showing which companies are doing the best to avoid collateral damage. It is also intended to facilitate the mitigation of collateral damage when it occurs, and, through communication, help prevent collateral damage (FPs) from recurring. For instance, why did the FP or misrating occur? What can be done to avoid it in the future?

Ironically, malware authors are hardly affected by these aggressive tactics. After all, if these tactics really worked, why would there be so many malware infestations?

Also remember, public transparency and accountability will let consumers know which security companies care about the collateral damage they inflict. Is this not important in your purchasing decision? If not, it should be ;). By choosing carefully with whom you spend your money, YOU can force companies to start behaving ethically.

As always, the power is in the hands of the consumer. Choose carefully who you spend your money with and you can force these corporations to act ethically and responsibly.

At this site you can:

1. Report false positives and mis-rated sites in REAL TIME to a CENTRAL LOCATION. At this central location, companies will know where to find false positives and mis-rated sites, if they care to look.
2. You can then see which companies care to fix these issues, and how fast. You can also see which companies are interested in AVOIDING them in the future.
3. Communicate with security companies to fix these issues, and help avoid these problems from recurring.
4. Provide historical stories about damage inflicted to your innocent business and/or family.
5. Communicate with other software vendors with similar concerns and troubles.

http://falsepositivereport.com
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 23, 2011, 04:54 AM
AMEN~!

I bought a few domain names a number of years ago because I wanted to try to draw attention to this problem, but never got around to it. (false-positive.com, scareware.net/org)

It's a tough job to detect real malware, but like you said:

Causing collateral damage to innocent businesses/families is simply unacceptable. It will sometimes accidentally occur, but clearly not enough is being done to prevent this problem, as it has only gotten worse.

I sort of see it like being hired to cut the grass in the park, but also mowing down the children. Y'know... Like who cares if a few patches of grass are red? :P

Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 23, 2011, 04:57 AM
Thank you for your support ;).
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 23, 2011, 05:01 AM
If you're an ASP member, post it there -- also -- post it in the JoS forums too.

There are more software forums like those (I've kind of stopped reading/visiting them as so many tech people there just seem to be looking for a fight) -- if anyone can remember some of those, post them as well -- it might help. I know a lot of people have been burned by false positives. Actually, thinking about it, if you've been around for long, it's almost impossible that you haven't... Just about everyone complains about it.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 23, 2011, 05:12 AM
Good idea! I'm not a member of the ASP anymore, I quit years ago and never joined back. However, since I author developer tools, I know a lot of vendors personally, so will start contacting them. Please do spread the word. It is important. We must make a stand. The major security companies will be waking up in a few hours and reading this, so let's show them how much interest there is ASAP.

My personal story of FPs and misratings you wouldn't believe.. and I do NOT compress my software or use any protector. That is why I got so fed up. I finally was able to fix problems only through my direct contacts, because so many of these companies simply don't respond to their false positive or mis-rating reporting systems. They just ignore you, its absurd. Some others DO respond well, but the damage is done, and they don't make an effort to PREVENT it from happening in the future.

Let's change the world! ;)
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 23, 2011, 05:39 AM
Yeah... It can take MAJOR effort to get a false positive removed. I've done it before, but I also know other people that have major fights with the AV vendors trying to get their software delisted.

It's not just the damage, but the additional damage of also having to take out all that time and effort from real productivity and funnel it into what shouldn't be an issue in the first place.

FWIW - MS is pretty good, but they do have some false positives as well... Even with their own partners... :( But that's typical MS - the left hand doesn't know what the right hand is doing.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 23, 2011, 06:38 AM
I did not make it clear.. if you want your comments to be seen by people who MATTER, then please post them at the thread I linked above. They will be waking soon, and visiting that thread. If it is just me, I look like a crazy person. If there is some user support, they realize users are fed up.

I have a real fear now that users, in general, don't care (not you guys, but others.. the average user).
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: tomos on September 23, 2011, 06:56 AM
I did not make it clear.. if you want your comments to be seen by people who MATTER, then please post them at the thread I linked above. They will be waking soon, and visiting that thread. If it is just me, I look like a crazy person. If there is some user support, they realize users are fed up.

I have a real fear now that users, in general, don't care (not you guys, but others.. the average user).
-db90h (September 23, 2011, 06:38 AM)

I'm not fully clear - you want false positives posted there.
Do you want "dissatisfaction with the way thing are in general" posted there as well?
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 23, 2011, 07:05 AM
Sorry for the confusion ... Just in the Sticky Topic, to get the ball rolling... I just want them to understand that USERS CARE ... that helps to then get the ball rolling on the whole project. If they realize their CUSTOMERS care, then they care 10x more. Sorry

EDIT: A big part of this is USER TRANSPARENCY, so users know what is happening to small businesses, and which security vendors are causing the most harm (like donationcoder, though it isn't a traditional business, it is still a form of business).

I would not be surprised to suddenly find my web site rated RED/DANGEROUS and all my software false positive'd on .. as paranoid as that sounds. To challenge some of the corporations is, risky...
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 23, 2011, 07:15 AM
What I meant was... if you have anything to say, now is your chance. Rarely do users get a chance to have their comments read by anyone who matters at these giant corps (sadly). I guess that was clear though. Oh well. I just get enthused, and hope for change. Apathy will kill us all.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: mouser on September 23, 2011, 07:18 AM
It's great to see you moving on this front db -- the software world needs something like this badly.

We've discussed on this forum the abysmal and almost-criminal behavior of antivirus companies when it comes to false positives.

And i've made my own proposal for what I think would help move things forward here (https://www.donationcoder.com/forum/index.php?topic=20810.0) -- namely a set of standards to live up to and a kind of award/certification that would give security companies a positive incentive to do better -- which i think they crucially lack right now.

If you can make some progress in this effort you'd be doing us all a great service.  Go for it!
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 23, 2011, 07:19 AM
I will add that link to the forum post now, thanks mouser
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: mouser on September 23, 2011, 07:39 AM
I just want to reiterate what I think is an essential point: Fixing the incentive structure for the security companies.

There is huge competition in the security/antivirus world to build the best and most popular scanner.  These companies have very skilled coders working day in and day out, 365 days a year to improve their software.

Why then is every company doing such a horrible job with false positives and how they present alert information to the user?

Laziness, yes -- but at its core I believe the reason is simply that their does not exist an meaningful incentive for them to do better.

When comparisons of antivirus software is written -- no review puts much emphasis or effort into discussing false positives or the way heuristic/false alerts are presented and explained to the user.

And users don't seem to be aware of how important this issue is when choosing an antivirus engine.

So to me, the absolutely key part of reforming/rehabilitating the antivirus software industry in this respect is by creating both positive and negative incentives around this issue -- a carrot and stick approach.

The stick is the traditional one -- bring attention to the bad actors and provide a site where people can learn to avoid them.  The fear of damage to their reputation will cause them to do better.

But this is also a case where a VERY attractive positive incentive can be created to encourage the good companies -- allowing them an opportunity to set themselves ahead of the pack.  By creating a kind of certification/award that people recognize as the gold standard in security software.

Such a thing, if it could come to be seen as having some weight behind it, would be welcomed by the good security software vendors as a way for them to set themselves apart from their competitors -- and a way for them to get attention for their efforts at doing things the right way.  It would be a way to reward the good guys and help build the reputations of the companies that are doing the right thing.  And such an effort -- if done right, would be welcomed by the better antivirus companies as a way to separate the serious companies from the unserious ones.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 23, 2011, 08:10 AM
I did not make it clear.. if you want your comments to be seen by people who MATTER, then please post them at the thread I linked above. They will be waking soon, and visiting that thread. If it is just me, I look like a crazy person. If there is some user support, they realize users are fed up.

I have a real fear now that users, in general, don't care (not you guys, but others.. the average user).
-db90h (September 23, 2011, 06:38 AM)

Side note: If you could turn the CAPTCHA level down a bit, it would be much easier to post. I had to try 3 times. :(
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: tomos on September 23, 2011, 08:29 AM
I did not make it clear.. if you want your comments to be seen by people who MATTER, then please post them at the thread I linked above. They will be waking soon, and visiting that thread. If it is just me, I look like a crazy person. If there is some user support, they realize users are fed up.

I have a real fear now that users, in general, don't care (not you guys, but others.. the average user).
-db90h (September 23, 2011, 06:38 AM)

Side note: If you could turn the CAPTCHA level down a bit, it would be much easier to post. I had to try 3 times. :(
-Renegade (September 23, 2011, 08:10 AM)

+1 (well twice here)
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: KynloStephen66515 on September 23, 2011, 08:41 AM
A couple of handy links for reporting False-Positives:

(More will be added when I find them :P)

Symantechttps://submit.symantec.com/false_positive/
Microsoft Anti-Malwarehttp://www.microsoft.com/security/portal/isv/fpform.aspx
Bit Defenderhttp://forum.bitdefender.com/index.php?showforum=138
AVGhttp://forums.avg.com/ww-en/avg-forums?sec=thread&act=show&id=395
Kasperskyhttp://forum.kaspersky.com/index.php?showtopic=13881
McAfee https://community.mcafee.com/thread/2016
Comodohttp://www.comodo.com/home/internet-security/submit.php

Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 23, 2011, 09:15 AM
NICE~!

Let me add 1 there to your table:

Symantechttps://submit.symantec.com/false_positive/
Microsoft Anti-Malwarehttp://www.microsoft.com/security/portal/isv/fpform.aspx
Bit Defenderhttp://forum.bitdefender.com/index.php?showforum=138
AVGhttp://forums.avg.com/ww-en/avg-forums?sec=thread&act=show&id=395
Kasperskyhttp://forum.kaspersky.com/index.php?showtopic=13881
McAfee https://community.mcafee.com/thread/2016
Comodohttp://www.comodo.com/home/internet-security/submit.php
NOD32http://kb.eset.com/esetkb/index?page=content&id=SOLN141

I got hit with a NOD32 false positive (http://cynic.me/2011/03/29/disappointed-in-nod32/). Not very happy with that. :(
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: KynloStephen66515 on September 23, 2011, 09:17 AM
Forgot about NOD32 tbh :P - The bigger we can get this list, the better!
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 23, 2011, 02:54 PM
Remember, it is about showing how bad the problem is - reporting them AFTER they occur directly to the company is fine, but we must also PUBLICLY report them in a CENTRALIZED location. We must remove their vested interest in generating FPs to start with, by embarrassing them, and showing which companies care about determining WHY it happened, and avoiding it in the future...and which do not.

The forum must be moved to a dedicated site soon. I also don't know if I have the time to maintain it (nor if I can stand being angry all the time).
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 23, 2011, 03:16 PM
@Renegade: CAPTCHA turned down, thanks for letting me know .. I had 'upped' it just the other day because I got sick of those 'SEO' (yea right) people ... ;o.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: JavaJones on September 23, 2011, 04:03 PM
It's great to see someone finally tackling this. I hope the effort is successful. It sounds like you have some connections that will help. I'll do what I can to spread the word, though my networks are not necessarily large.

I also wanted to mention that I still think mouser's idea of a test and badge system rewarding good (low false positive) software/software publishers has a lot of potential. I think a combination of shaming the bad and rewarding the good could be most effective. Hopefully this effort can develop toward that long-term. But you have a good place to start.

- Oshyan
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 23, 2011, 04:04 PM
I also wanted to mention that I still think mouser's idea of a test and badge system rewarding good (low false positive) software/software publishers has a lot of potential. I think a combination of shaming the bad and rewarding the good could be most effective. Hopefully this effort can develop toward that long-term. But you have a good place to start.
-JavaJones (September 23, 2011, 04:03 PM)

I agree, and we should include that as well (already I linked to his post about it). One thing at a time though. FIRST, we must expose the problem, then we can work on solutions.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: JavaJones on September 23, 2011, 04:11 PM
Yes, I agree. That's why I said I hope this effort can develop toward that. This is a good way to start, getting people to post their experiences and getting pledges from devs/publishers for support of the idea.

- Oshyan
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 23, 2011, 06:51 PM
Thanks to all of you, and please forgive me when I repeat myself. I move at 1000 miles an hour, so sometimes it is accidental --- but other times it is purposeful. In this day and age, everyone skims, so it is important to repeat things in order to get the point across ;).

I am happy to say that this effort has some major supporters already and is spreading like wildfire! Thanks to those of you who have volunteered your time or other services. I may very well be taking you up on that, as I have a business to run. Not spending half my time dealing with FPs and site rating issues will sure make that job easier.

I am now trying to get security vendors to publicly commit. They are scared publicly to do so at this time, but as it grows, they will .. I believe ;). Some have expressed their private willingness to participate, which is a great first step!
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Curt on September 24, 2011, 05:00 AM
I sure hope this anti-FP action will go well.  :up:

However, already been told that the thread will move to another domain, I am not inclined to register at Bitsum's, in order to upload a post or two. I think more people than me may have had a similar thought.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Jibz on September 24, 2011, 05:03 AM
I think this is a really good idea, and I sincerely hope you manage to get the security companies interested and involved.

Having to report false positives to each company individually, and hope that they all fix the error is horrible. Having a common place to publicly post is a much better solution, increasing transparency and helping security companies to address the issues.

I posted on the bitsum forum as well, and because I am a dinosaur I posted in the historical section as well ;D.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 24, 2011, 10:29 AM
I sure hope this anti-FP action will go well.  :up:

However, already been told that the thread will move to another domain, I am not inclined to register at Bitsum's, in order to upload a post or two. I think more people than me may have had a similar thought.

-Curt (September 24, 2011, 05:00 AM)

Thanks, and do not worry, all accounts and posts will be moved... we use SMF, so will the new forum.. easy migration. I indicated this, but it may have been missed (or not believed ;p).
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 24, 2011, 11:34 AM
I sure hope this anti-FP action will go well.  :up:

However, already been told that the thread will move to another domain, I am not inclined to register at Bitsum's, in order to upload a post or two. I think more people than me may have had a similar thought.

-Curt (September 24, 2011, 05:00 AM)

Thanks, and do not worry, all accounts and posts will be moved... we use SMF, so will the new forum.. easy migration. I indicated this, but it may have been missed (or not believed ;p).
-db90h (September 24, 2011, 10:29 AM)

Was that what was happening? I saw 2 of my 3 posts were removed, so I got pissed at being censored, deleted my remaining post and deleted my account.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 24, 2011, 11:39 AM
Was that what was happening? I saw 2 of my 3 posts were removed, so I got pissed at being censored, deleted my remaining post and deleted my account.

I was informed the company we were discussing (Open Candy) likes to sue people. I got freaked out, removed the posts. Sorry... The new policy is: NO DISCUSSION OF BUNDLED PRODUCTS.

If you don't want the false positive, don't bundle with that software. You CHOSE to bundle with that software.

I do not mean to be harsh, I just have to set some limits. There are more egregious and clear examples of harm. Mentioning FPs with bundled software just confuses the issue and defeats our purpose.

Anyway, the site is under new management now and being moved as we speak, so maybe you can talk them into allowing it.. I no longer am in control.

OTHERS: Would you agree this is a reasonable policy? If we allow BORDERLINE cases, or cases of debate.. then we confuse the whole issue and defeat the purpose. I personally consider all bundles deceptive as they rely on those users who accidentally miss the checkbox. I, personally, don't want the bundled crap, and imagine others feel the same. Can someone back me up?

I mean NO OFFENSE.. but to get things done, we can NOT allow borderline cases like this.

I had a LONG discussion about this... this nearly destroyed the entire effort. If we allow these type cases, it would. Besides, since Open Candy, according to my sources that may or may not be accurate, sues everybody who calls them a threat, they can hold their own. I am NOT saying they are a threat, in face they are NOT a threat in most, if not all, cases. Since they have different bundles, I can't speak for all of them though.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: app103 on September 24, 2011, 11:58 AM
Was that what was happening? I saw 2 of my 3 posts were removed, so I got pissed at being censored, deleted my remaining post and deleted my account.

I was informed the company we were discussing (Open Candy) likes to sue people. I got freaked out, removed the posts. Sorry... The new policy is: NO DISCUSSION OF BUNDLED PRODUCTS.

If you don't want the false positive, don't bundle with that software. You CHOSE to bundle with that software.

I do not mean to be harsh, I just have to set some limits. There are more egregious and clear examples of harm. Mentioning FPs with bundled software just confuses the issue and defeats our purpose.

Anyway, the site is under new management now and being moved as we speak, so maybe you can talk them into allowing it.. I no longer am in control.

OTHERS: Would you agree this is a reasonable policy? If we allow BORDERLINE cases, or cases of debate.. then we confuse the whole issue and defeat the purpose. I personally consider all bundles deceptive as they rely on those users who accidentally miss the checkbox. I, personally, don't want the bundled crap, and imagine others feel the same. Can someone back me up?

I mean NO OFFENSE.. but to get things done, we can NOT allow borderline cases like this.
-db90h (September 24, 2011, 11:39 AM)

I tend to agree on this, and here is another way of looking at it:

If you choose to bundle with anything, and your installers are getting flagged because of what you are bundling with, it's not your software that is triggering the false positive if there is one.

If it is not your software, then it's not your battle here. Your battle is with the company in which you are bundling their product.

If it is OpenCandy, you need to either cry to them about it or stop bundling their product.

If OpenCandy feels that it is a false positive, they can come and complain about it themselves, since it is their product that is getting flagged.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 24, 2011, 12:12 PM
BTW, thanks to your report ESET won't speak to me any longer.. that's the harm of introducing borderline cases, or bundle companies that may or may not sue people, into the mix. Again, since Open Candy has different bundles, I am not saying they are a threat at all. I just mean we can only show more clear cut examples. Consumers, in general, don't like bundles, and that would substantially lessen our support on that front as well.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: wraith808 on September 24, 2011, 12:33 PM
I disagree- a false positive is a false positive, and I think that the suing nature of OC has come from the antagonistic relationship that has developed because of the lack of accountability for false positives.  And it is a false positive, and IMO unfair to blame that on Renegade's post.  And saying that the fact that a bundled software causes false positives is not in your ability to fight the battle is short sighted to say the least, especially since it's not their product in the end that's getting flagged, but the developer that includes it.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 24, 2011, 12:34 PM
I disagree- a false positive is a false positive
-wraith808 (September 24, 2011, 12:33 PM)

This is FALSE, because they detected OpenCandy as OpenCandy. It is a classification issue, which is different than a false positive. We can NOT get into classification debates, period.

Those who believe bundles are a non-deceitful practice are welcome to start their own site ... However, they will not be part of THIS site because we need only the most EGREGIOUS and CLEAR CUT examples of harm. I said it all above. I will not repeat further. Reference my explanation. We simply can not allow borderline cases, because the system would not work. I discussed and thought about this for a hell of a long time with security vendors, so do not tell me that it is short-sighted. I *KNOW* bundles help you pay you bills, but ... they are deceitful in nature, in my opinion, and considered 'borderline' cases. Even though the user can opt-out, since almost nobody wants the bundled software, the clear intent is to 'get' those few who miss the checkbox.

I understand they pay you $$$... so you bundle supporters will never agree with this, so I invite you to start your own site. Argue no more, because this policy WILL NOT CHANGE. Read my first post, I explain it quite clearly. If we allow borderline cases, the whole system degrades into nothing but debate about what is good and what isn't. Instead, we want a site that demonstrates OBVIOUS mis-ratings and false positives... not debated classifications.

Again, the developer has the option to NOT include that bundle.. so it *is* Open Candy's fight, and they have plenty of power to fight.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: app103 on September 24, 2011, 01:40 PM
It would be far more productive in the long run if 1000 developers of 1000 different products would stick to reporting false positives in their products and not reporting a false positive in some 3rd party bundled product like OC.

Because it is a single false positive and the problem is with OC and not 1000 false positives with the 1000 different products.

It would be far better for those 1000 developers to bang on OC's door and complain about it, then let OC handle the issues with their product.

You, as the developer of one of the 1000 products bundling some 3rd party adware are not in the position to make any changes to that 3rd party software to comply with any requirement that might be needed to resolve the issue (other than removing it from your installer), while OC is in a position to change their product and resolve it. They are the ones that should be complaining if they are upset by what they believe to be a false positive.

And I do not see something containing OC being detected as Adware:Win32/OpenCandy as a false positive. It was identified correctly as OpenCandy. If it were being identified as a Trojan:Win32/Vundo, that would be a FP.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 24, 2011, 01:41 PM
I'm going to try to be short here.

I was informed the company we were discussing (Open Candy) likes to sue people. I got freaked out, removed the posts. Sorry... The new policy is: NO DISCUSSION OF BUNDLED PRODUCTS.
-db90h (September 24, 2011, 11:39 AM)

I think this is very short sighted.

There is little software out there that doesn't incorporate other software. They're called libraries or components. They help enable different functionality. At the extreme end of the argument there, there isn't any software at all that doesn't incorporate other software.

To me, the line you seem to be drawing there for components appears to be rather arbitrary. I'd say that leaving it at the installer level or installed level is best. (I don't expect that we'll ever see eye-to-eye there though.)

As far as suits go, I am not aware of any from OC (SweetLabs now). I have a good relationship with them, and wouldn't expect them to sue me for anything that I'd written there. I know their community evangelist very well.


BTW, this is FALSE, because they detected OpenCandy as OpenCandy. It is a classification issue, which is different than a false positive. We can NOT get into classification debates, period.
-db90h (September 24, 2011, 01:10 PM)

I went on at length about this in a post that you'd deleted.

I understand (I think) what you want to limit the discussion to. For misidentification, that's one thing, but I still think that "false positive" implies any identification of innocent software as malware.

Yes. I know you want to rule that out. Perhaps terminology is a problem, and that will only create red herrings unless rectified. Perhaps some more specific terminology would help.

I still think that you're basically going to make most software irrelevant though. Just for example, you're ruling out Screenshot Captor (a favorite program of mine).

Screenshot Captor includes other software components. If it or any part of it is identified as "malware" (or whatever), the practical upshot is that mouser gets screwed by that. I know that mouser has had to deal with false positives in the past.

Thinking about it again, it seems to me that you're trying to be extremely technical. I don't think that approach will be very productive though. It might make sense to techies and gearheads, but it would probably be more useful to think about the user perspective, because that's what really matters in the end.

As far as I'm concerned, if any AV software detects an installer as threat/malware (or whatever), that's a false positive to me. I see the debate about components/libraries as a non-issue.

There is a lot of software out there that incorporates defunct or non-maintained software or abandonware. In those cases there's, as you've defined, there is NOBODY to stand up and tell the AV companies to fix their **** ups.

I'll give you an example...

One of my favorite pieces of software is from Infralution. It uses a component for graphing, but it's no longer maintained. So what happens there?

Anyways...

I'm going to bow out of this discussion. I'm simply not interested in the extreme end of the spectrum.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 24, 2011, 01:46 PM
There is little software out there that doesn't incorporate other software. They're called libraries or components.
-Renegade (September 24, 2011, 01:41 PM)

You are comparing libraries and software components to installer bundles? Come on ... Components/libraries have a FUNCTIONAL PART of the software, installer bundlers are SEPARATE products that are there to get installed into the PC as a separate product (and for commercial purposes, that is why you get paid).  

Also, you took my one, non-applicable quote.. thanks for that. That was why I first removed them, but then it became clear how problematic it would be to allow, after long discussions about the issue.

These are the rules. You have the freedom to start your own site. I mean no offense.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 24, 2011, 02:09 PM
It would be far more productive in the long run if 1000 developers of 1000 different products would stick to reporting false positives in their products and not reporting a false positive in some 3rd party bundled product like OC.

Because it is a single false positive and the problem is with OC and not 1000 false positives with the 1000 different products.

It would be far better for those 1000 developers to bang on OC's door and complain about it, then let OC handle the issues with their product.

You, as the developer of one of the 1000 products bundling some 3rd party adware are not in the position to make any changes to that 3rd party software to comply with any requirement that might be needed to resolve the issue (other than removing it from your installer), while OC is in a position to change their product and resolve it. They are the ones that should be complaining if they are upset by what they believe to be a false positive.

And I do not see something containing OC being detected as Adware:Win32/OpenCandy as a false positive. It was identified correctly as OpenCandy. If it were being identified as a Trojan:Win32/Vundo, that would be a FP.
-app103 (September 24, 2011, 01:40 PM)

Whether it's OC or whatever is completely irrelevant.

For a bunch of customers to start bugging a component vendor because an AV vendor is incompetent is simply idiotic.

Why further the component vendor's burden when they are already getting screwed by the AV company?

Inform them? Sure. Bitch and cause problems for them? That's counterproductive.

It's much better to have those 1,000 software authors screaming to the AV vendors for their incompetence.

Quite frankly, it's the AV companies that are dropping the ball here. They are the ones that need to be screamed at.

Sure, I'll email a component vendor to let them know that an AV company is incompetent and accusing them of something that they're not guilty of, but I'm sure as hell not going to bitch at them because of something that's not their fault.

The fault lies ENTIRELY with the AV vendors. THEY are the ones that are in error.

Classification is irrelevant to me.

At the end of the day, it's the AV companies that are the guilty parties here.

And I quite frankly don't care about their problems all that much. Yes. I know that it's a hard job. But there's just no excuse for screwing me when I don't want to get screwed.

The more I think about this, the angrier I get.

I've been screwed by the AV companies with false positive across the entire spectrum of *whatever* you want to call a false positive. The end result is the same. I get screwed. I don't like that. Getting screwed is bad.

My sympathy levels for the AV companies is only dropping now... The more I think about it, the more I see that they are simply incompetent, and that they have NO excuse.

It's not that hard to take a detection, quarantine it, and then inform the user that they have a possible infection, and that a more thorough check is being done... Please stand by... We'll return to the regular programming momentarily...

But they don't do that.

If something is detected, sure. Quarantine it. False positive or otherwise. Play safe. But also take into account that you *could* be wrong and do some due diligence.


Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 24, 2011, 02:23 PM
You are comparing libraries and software components to installer bundles? Come on ... Components/libraries have a FUNCTIONAL PART of the software, installer bundlers are SEPARATE products that are there to get installed into the PC as a separate product (and for commercial purposes, that is why you get paid). 
-db90h (September 24, 2011, 01:46 PM)


We're not going to see eye-to-eye on this.

Yes. They have a functional part. It's called putting food on the table.

As an independent software vendor (mISV), I have to look at the big picture. I don't have the luxury of looking at one very tiny isolate part.

If my software is labeled malware, for whatever reason, that's a very real problem for me. It's a kind of steak vs. ramyen problem.

For the specific example that I gave that you deleted in your forums, no software is "installed". (We've gone over that issue here in some other thread, and I don't believe that execution is equivalent to installation.)


Also, you took my one, non-applicable quote.. thanks for that. That was why I first removed them, but then it became clear how problematic it would be to allow, after long discussions about the issue.
-db90h (September 24, 2011, 01:46 PM)


I'm not sure what you mean there.


These are the rules. You have the freedom to start your own site. I mean no offense.
-db90h (September 24, 2011, 01:46 PM)


You can have whatever rules you want at your site. I don't have any problem at all with that. Heck, I think that you can do some very real good.

You've simply limited the discussion to a very narrow band, and I'm just not interested in things that narrow on the topic.

What you're doing is a good thing. But you're simply excluding people in my position. Not that there's anything wrong with that. It's just that I don't really have anything to add to that discussion. I'm more interested in the bigger picture.

And as for starting my own site, that won't happen. I've not found time for it in the last few years, and I doubt that I will any time soon.

Good luck with things. I hope that you can get the AV companies to stop dropping the ball so much.

Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: wraith808 on September 24, 2011, 02:23 PM
I disagree- a false positive is a false positive
-wraith808 (September 24, 2011, 12:33 PM)

This is FALSE, because they detected OpenCandy as OpenCandy. It is a classification issue, which is different than a false positive. We can NOT get into classification debates, period.

Those who believe bundles are a non-deceitful practice are welcome to start their own site ... However, they will not be part of THIS site because we need only the most EGREGIOUS and CLEAR CUT examples of harm. I said it all above. I will not repeat further. Reference my explanation. We simply can not allow borderline cases, because the system would not work. I discussed and thought about this for a hell of a long time with security vendors, so do not tell me that it is short-sighted. I *KNOW* bundles help you pay you bills, but ... they are deceitful in nature, in my opinion, and considered 'borderline' cases. Even though the user can opt-out, since almost nobody wants the bundled software, the clear intent is to 'get' those few who miss the checkbox.

I understand they pay you $$$... so you bundle supporters will never agree with this, so I invite you to start your own site. Argue no more, because this policy WILL NOT CHANGE. Read my first post, I explain it quite clearly. If we allow borderline cases, the whole system degrades into nothing but debate about what is good and what isn't. Instead, we want a site that demonstrates OBVIOUS mis-ratings and false positives... not debated classifications.

Again, the developer has the option to NOT include that bundle.. so it *is* Open Candy's fight, and they have plenty of power to fight.
-db90h (September 24, 2011, 12:34 PM)

I am not a bundle supporter, nor am I paid for anything, so classifying such in an aggressive post against what I said seems a bit out there.  I do tend to post in support of Renegade on such things, because he gets so much crap for stuff, i.e. the unaddressed issue of posting that it was his fault that an AV company decided not do business with you, rather than placing the blame with them for their own decision.  And if a third party component in your software does something that the AV program detects as malicious activity, then that becomes your problem, also.  Libraries *can* do the same thing, and result in the same sort of false reporting, i.e. the use of AutoHotKey.  It's not the program itself, its what it was made with in that case.  And the developers of the programs that are in AHK can't argue the point of their program?  I call BS.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 24, 2011, 02:27 PM
@wraith808 - Thanks for the voice of support. Greatly appreciated.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Jibz on September 24, 2011, 02:53 PM
You are comparing libraries and software components to installer bundles? Come on ... Components/libraries have a FUNCTIONAL PART of the software, installer bundlers are SEPARATE products that are there to get installed into the PC as a separate product (and for commercial purposes, that is why you get paid).  
-db90h (September 24, 2011, 01:46 PM)

We're not going to see eye-to-eye on this.

Yes. They have a functional part. It's called putting food on the table.
-Renegade (September 24, 2011, 02:23 PM)

That is not a functional part of the software though, it is a functional part of your business. The software would run just the same if there was no adware in the installer.

I have no experience with OC, so I can in no way comment on whether it is fair to detect it as .. well .. OC. But to me there is a difference between components used in software, and adware bundled with it.

Also, just for the record, writing good signatures for malware is not as easy as it may seem :).
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: app103 on September 24, 2011, 03:48 PM
I have been talking quite a bit with db90h and it is very likely that I will be assuming the role of community relations for this project.

The purpose of this project is to identify and address the issues of false positives. It is not to identify and address issues with misclassifications. We are going to stay focused on false positives. We are not going to address misclassifications unless a website is misclassified as containing something it does not.

For example, if Wikipedia were misclassified as a phishing site and it resulted in it being blocked, that would be acceptable to file a report of a false positive, since there is nothing on the site that could be considered phishing. But if they were hacked and code injected that popped up a form asking for someone's banking info, then that wouldn't be a false positive until they cleaned up the site.

Feel free to start your own similar project to address misclassifications, if you wish, if you can not accept the idea that we will not be addressing them.

A detection of OC is not a false positive unless your software or installer does not contain OC. If it contains OC you may not file a report of a false positive. If it does not contain OC then you may file a report. It is as simple as that. That will be the rule going forward and there will be no compromising on this.

You can argue about it all you want in a million ways, but the fact remains that OC is being detected as OC and if it is malware or not isn't the issue here. So whether you feel OC is malware or not is irrelevant.

Now, Renegade, does your installer that is being detected as containing OC actually have OC in it, or not? If it doesn't, you may make a report about a false positive. If it does, then you may not.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: tomos on September 24, 2011, 04:30 PM
^ re the last line there:
it's good to be clear, but jeez app, give the man a break :)
he's already made his point and wished the site good luck:

[...]
Good luck with things. I hope that you can get the AV companies to stop dropping the ball so much.
-Renegade (September 24, 2011, 02:23 PM)
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: wraith808 on September 24, 2011, 05:07 PM
^ re the last line there:
it's good to be clear, but jeez app, give the man a break :)
he's already made his point and wished the site good luck:

[...]
Good luck with things. I hope that you can get the AV companies to stop dropping the ball so much.
-Renegade (September 24, 2011, 02:23 PM)
-tomos (September 24, 2011, 04:30 PM)

That's sort of my point.  Renegade is a pretty respected member of the site, and is pretty level headed and logical in his arguments.  He's also done quite a bit of research into the OC thing, even before using it.  However, whenever this comes up, he gets piled on, either in a passive aggressive manner or just an aggressive aggressive manner.  I know this is a hot point, but it seems like we can agree to disagree without the strife that seems to come up on these threads- I mean, its obvious that its in his software; he's even said as much, openly.  He's not trying to hide anything.  But the negative feelings towards the malware seems to spread out onto him, as if he's part of the problem.  That's my big problem with the whole thing.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: app103 on September 24, 2011, 07:38 PM
This has nothing to do with anyone's feelings about OC. It's about focus and what is best for this project at this time. There may come a time in the future where that focus may change, but right now is not it.

Even if I shared Renegade's views on OC I would still hold the same position about not focusing on misclassifications at this time.

And Renegade knows I do not hold anything personal against him. I consider him my friend, both here and outside of DC, and not just merely a fellow DC member. If we lived near each other and I was the type that liked to drink, we'd be drinking buddies.  :)
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: KynloStephen66515 on September 24, 2011, 09:41 PM
Lets try get back on a more focused topic shall we.

OpenCandy is OpenCandy, its a tool like any other...and regardless of your stand on the matter, it's NOT the point of discussion within THIS topic.

Personal attacks on members of DonationCoder cannot, and will not be tolerated.

If you wish to Discuss OC and NOT, please visit: https://www.donationcoder.com/forum/index.php?topic=18297.0

That is the end of any more OC discussion or personal attacks within this topic.

.........

For those wishing to continue the ACTUAL discussion topic...Please continue.

Topics can be very easily de-railed...
See here for proof ;)

https://www.donationcoder.com/forum/index.php?topic=27936.msg261275#msg261275

Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 25, 2011, 12:46 AM
That is not a functional part of the software though, it is a functional part of your business. The software would run just the same if there was no adware in the installer.
-Jibz (September 24, 2011, 02:53 PM)


Whether it's OC or DevExpress or Infragistics or whatever, they all just seem like components to me. They all have a purpose. Saying that it's not a functional part of the software is only expressing an opinion on what level of utility one perceives in it.

To be the Devil's Advocate:

* Help files aren't a functional part of software because they describe the software. i.e. Descriptions are not functions.

* Playlists in my MP3 player aren't a functional part of the player because I don't use them, and get no value out of them.

* Graphic embellishments and decorations that make a program look nice aren't functional parts of the program because they don't "do" anything.

* A GUI is not a functional part of the software because anything that you can do through a GUI can be done through a command line. (Oh god... can you imagine how difficult some software would be with no GUI? Nightmarish...)

While some of those may seem utterly silly, they are just following down that slippery slope to one degree or another.

Basically, it boils down to whether or not you "like" or "want" or "use" some set of functionality.



...there is a difference between components used in software, and adware bundled with it.
-Jibz (September 24, 2011, 02:53 PM)


The word "bundle" is interesting as it can mean a few things. I think that we'd all agree that "bundle" implies packaging together several discrete pieces of software that do not interact with each other in any meaningful way, and that those pieces of software are not related in the way that a piece of software is related to a component/library.

I don't think that "adware" is really relevant. Whether you're bundling a toolbar, or a browser, or a pro version, or a related product, or a 3rd party product, or whatever, a bundle is a bundle.

What I'm NOT clear on though, is whether or not facilitating a download and installation constitues "bundling".

For example, say you download the ACME Web Browser. They bundle in the ACME Browser Switcher toolbar for other browsers that lets you seamlessly switch from another browser into the ACME Web Browser. So that's a bundle... But, if they also include an option in the installer for you to download and install the ACME MP3 Player, then is that bundled? It's not "in" the installer, and you have to download it still... I'm thinking that I'd have to say "no" for traditional standalone installers, and that the question then moves on to what constitues a bundle in a connected world with web installers... There I think I'd have to say "yes".



Also, just for the record, writing good signatures for malware is not as easy as it may seem :).
-Jibz (September 24, 2011, 02:53 PM)


I'm quite certain writing signatures for malware is very difficult.

But we don't excuse doctors for killing people on the operating table because they misdiagnosed a cough for brain cancer. Oh... Ooops... Yes we do. But whatever. :) :P

It seems to me that labeling an innocent piece of software as malware is libelous.

http://en.wikipedia.org/wiki/Defamation

Defamation—also called calumny, vilification, traducement, slander (for transitory statements), and libel (for written, broadcast, or otherwise published words)—is the communication of a statement that makes a claim, expressly stated or implied to be factual, that may give an individual, business, product, group, government, or nation a negative image. It is usually a requirement that this claim be false and that the publication is communicated to someone other than the person defamed (the claimant).

To prove libel:

The person first must prove that the statement was false.
Second, that person must prove that the statement caused harm.
Third, they must prove that the statement was made without adequate research into the truthfulness of the statement.


In the context of db90h's definition of false positive, these conditions are all met.

1) By definition, this is satisfied (false positive).
2) Again, this is trivially true.
3) It is well known that signatures can have multiple matches, so making a claim without verification satisfies this condition.

I suppose that I'm surprised that the AV companies haven't been sued more, because they're obviously guilty. If they have, I'm unaware of those suits.


The purpose of this project is to identify and address the issues of false positives. It is not to identify and address issues with misclassifications. We are going to stay focused on false positives. We are not going to address misclassifications unless a website is misclassified as containing something it does not.
-app103 (September 24, 2011, 03:48 PM)


I think the general issue would be better served by a less highly-focused approach to the technical side of signatures with multiple matches. But I suppose you do what you can.



For the record -- No offense take here. This is just a case of two different understandings of what "false positive" means.

Which is a general problem in a lot of discussions. And especially with acronyms... Quite often my eyes just glaze over when reading some materials where an author starts off using some acronym and never expands it for clarity.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Jibz on September 25, 2011, 03:06 AM
Since I agree with Stephen66515, I will refrain from commenting on this reply, but instead congratulate him on his 1000'th post

[ You are not allowed to view attachments ]

 ;D :Thmbsup:
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: worstje on September 25, 2011, 03:47 AM
I don't care too much for the details of this discussion as I am really tired, but I need to reply to one question asked...

* A GUI is not a functional part of the software because anything that you can do through a GUI can be done through a command line. (Oh god... can you imagine how difficult some software would be with no GUI? Nightmarish...)
-Renegade (September 25, 2011, 12:46 AM)

It would likely be easy to use, given some time to get used to the interface. Why? Because they would use a PBAD interface. Right, 'pretty bad' by todays standards. But I think a Physical Button And Dial interface works wonders for many applications. Ask DJs and soundmixers, toy racing cars/planes/boats operators, your olde TV set, or the TARDIS. Buttons and dials are epic and timeless. :D
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: wraith808 on September 25, 2011, 08:58 AM
This is just a case of two different understandings of what "false positive" means.
-Renegade (September 25, 2011, 12:46 AM)

Agreed on that point.


Whether it's OC or DevExpress or Infragistics or whatever, they all just seem like components to me. They all have a purpose. Saying that it's not a functional part of the software is only expressing an opinion on what level of utility one perceives in it.
-Renegade (September 25, 2011, 12:46 AM)

To help drive this point along, in many installers there is the bit about disabling your AV software.  I used to work at a company where we had a pretty tight licensing system, that used an implementation of a third-party licensing component.  I had to write a lot of code to get it to work and integrate with the product.  But apparently some AV programs looked at the licensing as virus-like activity.  In that case, would it not have been the company that was affected and so the company that should have a right to pursue remedies, instead of waiting for the developers of the licensing component?
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 25, 2011, 09:46 AM
To help drive this point along, in many installers there is the bit about disabling your AV software.  I used to work at a company where we had a pretty tight licensing system, that used an implementation of a third-party licensing component.  I had to write a lot of code to get it to work and integrate with the product.  But apparently some AV programs looked at the licensing as virus-like activity.  In that case, would it not have been the company that was affected and so the company that should have a right to pursue remedies, instead of waiting for the developers of the licensing component?
-wraith808 (September 25, 2011, 08:58 AM)

Good point about installers recommending that people turn off AV software. (I don't think it should be necessary, but that's just what I think.)

In the past, most of the problems I've had with false positives have been rooted in either compression or encryption. Was the licensing issue you had due to network traffic or encryption/compression?
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 25, 2011, 09:58 AM
BACK ON TOPIC

April is the spokesman, but I wanted to quickly say that software sites who support this project may soon have a logo to display, helping us spread the word. It will take TIME for this project to propagate. Do not give up. Be patient. Until we have a logo, feel free to link to The False Positive Report at http://falsepositivereport.com

@wraith/renegade: Licensing/protector/compressor/installer system false positives have long been a problem and are being addressed by a separate project called the Taggant project. It is embedded a signature into compressed/protected EXEs so security companies can identify the license used, and if it is a legitimate license that hasn't been abused before.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: wraith808 on September 25, 2011, 01:22 PM
Good point about installers recommending that people turn off AV software. (I don't think it should be necessary, but that's just what I think.)

In the past, most of the problems I've had with false positives have been rooted in either compression or encryption. Was the licensing issue you had due to network traffic or encryption/compression?
-Renegade (September 25, 2011, 09:46 AM)

I think it was due to encryption, but I couldn't say that with 100% certainty.  From the work I had to do, I know that compression wasn't used, and I don't *think* there was any network traffic associated with the solution; it was put in place to replace the dongle solution that they used before, and they called it 'software dongle emulation', though in retrospect, it was more like software license management, where you have a licensing server that validates keys against the keys that are on the DVDs of the connected computers, so the DVD itself acted as a sort of dongle.  Really complicated (and complicated the mastering process) and really pointless IMO.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Stoic Joker on September 25, 2011, 03:18 PM
Wraith, Renegade, I understand where you're coming from ... I really do. But you're not helping.

I also get where db90h is coming from. He's got a good idea, a means to implement it, and a narrow window of opportunity ... To catch and hold the AV companies attention. And the only way to do that is to keep it simple. Clear cut. black & white. UnArguable-ly, blatantly fucking obvious. Anything that is, or could be debatable, requires one risk taking a side ... Which is not something the AV companies are willing to do ... Just because they are them. Corporate facades protecting an image.

In keeping with this theme, anything that is, was, could, or might be... put up for debate. Must, be removed from the table. Or the corporate monkeys will simply run shrieking right back up their trees. Where they'll then happily continue their life-as-usual banana squeezing rituals.

They've been coaxed out of the trees, solely with the anticipation of getting a shiny bauble of black and white simplicity ... That any 4 year old could understand. I.e.:

James Earl Jones, is unarguably, obviously, black.
Tom Cruise, is unarguable, obviously, white.

-and-

Rae Dawn Chong, is (incredibly hot, but...) flat out just not going to (S-I-M-P-L-Y) fit into either of the two above categories. Dig?

Don't be so eager for the end game, "the kill" can wait... ;)
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 26, 2011, 08:58 PM
I sure hope this anti-FP action will go well.  :up:

However, already been told that the thread will move to another domain, I am not inclined to register at Bitsum's, in order to upload a post or two. I think more people than me may have had a similar thought.

-Curt (September 24, 2011, 05:00 AM)

It has been moved already -- http://falsepositivereport.com
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 26, 2011, 09:17 PM
I am also TRYING to turn this over to the COMMUNITY at large .... I'm trying to force April into the job ;). She is level-headed enough to be fair, act with integrity, and there be no conflicts of interest. This MUST be non-profit and not promoting any particular site other than itself.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 27, 2011, 01:34 AM
See if you can post it in the ASP and JoS. They're good places where devs hang out.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 27, 2011, 06:41 AM
Thanks Renegade, we're working on proliferation. I've had to get to my day job though, so we need more volunteers. I've spent the last week on nothing but this effort. Meanwhile, I have a real business to run, lol ;p. That said, maybe this saves my business one day (amongst thousands others), so it is a worthy cause.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Renegade on September 27, 2011, 07:14 AM
Just musing...

If you've not considered it before, have a think through whether you want to advertise it. I think "The Code Project" would be a prime place.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 27, 2011, 07:15 AM
Yes... I've got move back to my business, I *hope* enough people care to keep this going. I've put in my share already, and will continue to... if I am the only one who cares, it won't work. So... ;)
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 27, 2011, 07:37 AM
What I mean to say is --- please, everyone, help spread the word ;). I would also like to reiterate that no profit, or even exposure is being generated for me. I am not even using my company or real name, nor linking to my site, nor anything - as I do not want there to be any doubt this is for the good of ALL OF US. In fact, I am trying to get out of the site, leaving it to volunteers, though ...

Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: tomos on September 27, 2011, 09:00 AM
I sure hope this anti-FP action will go well.  :up:

However, already been told that the thread will move to another domain, I am not inclined to register at Bitsum's, in order to upload a post or two. I think more people than me may have had a similar thought.

-Curt (September 24, 2011, 05:00 AM)

It has been moved already -- http://falsepositivereport.com
-db90h (September 26, 2011, 08:58 PM)

my login doesnt work for this site (just reporting, not bitching!)
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 27, 2011, 09:03 AM
my login doesnt work for this site (just reporting, not bitching!)
-tomos (September 27, 2011, 09:00 AM)

Stephen from DC here admins and hosts the site... but I will check into it and see if I see the issue. Sorry for this. It is new, so there are kinks ;)
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on September 27, 2011, 09:08 AM
my login doesnt work for this site (just reporting, not bitching!)
-tomos (September 27, 2011, 09:00 AM)

If you can elaborate, perhaps it might be helpful too... ;). Sorry again.

EDIT: We did NOT migrate accounts, as I thought we would. The reason being is that the new site is using SMF 1.1.15, while I use SMF 2.0.1 .. so it would have been a harder issue.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: tomos on September 27, 2011, 03:03 PM
my login doesnt work for this site (just reporting, not bitching!)
-tomos (September 27, 2011, 09:00 AM)

If you can elaborate, perhaps it might be helpful too... ;). Sorry again.

EDIT: We did NOT migrate accounts, as I thought we would. The reason being is that the new site is using SMF 1.1.15, while I use SMF 2.0.1 .. so it would have been a harder issue.
-db90h (September 27, 2011, 09:08 AM)

no worries - I made a new account and posted already earlier :up:
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Deozaan on September 30, 2011, 09:14 PM
Microsoft Security Essentials is/was incorrectly saying Google Chrome is malware and removing it from users' PCs.

http://chrome.blogspot.com/2011/09/problems-with-microsoft-security.html

http://techcrunch.com/2011/09/30/microsoft-accidentally-tags-chrome-as-malware/
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: KynloStephen66515 on September 30, 2011, 09:24 PM
Microsoft Security Essentials is/was incorrectly saying Google Chrome is malware and removing it from users' PCs.

http://chrome.blogspot.com/2011/09/problems-with-microsoft-security.html

http://techcrunch.com/2011/09/30/microsoft-accidentally-tags-chrome-as-malware/
-Deozaan (September 30, 2011, 09:14 PM)

 ;D

j/k ofc lol
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on October 05, 2011, 06:28 AM
The False Positive Report
First week results = 2 of 3 reported FPs fixed on, and at, our forum

In our first week of operation (actually merely days), we had 3 real-time false-positive reports. *2 OF THOSE 3 WERE FIXED _AT_ OUT FORUMS* (one by Trend Micro, the other by Symantec).

We are very proud of the security companies who have stepped up to the plate to mitigate collateral damage wherever they can.

Many or most major security companies are monitoring the forum. The concept is working. All we need now are for more people to report any unresolved false positives or site mis-ratings. Consider our site a safety net in this way, though its uses are far beyond that.

Ever wondered which security product has the lowest false positive rate? Not just in a lab, in the real world? Especially with so many heuristic and behavioral based detections, what is the true FP rate? What about site mis-ratings? How do they figure in?

Answer all this and more by participating ... or spreading the word, so people know 'where to go'

This is a non-profit, all volunteer organization that accepts no monetary donations.

http://falsepositivereport.com (http://falsepositivereport.com)
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: tomos on October 05, 2011, 06:59 AM
Congrats db90h :Thmbsup:
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on October 05, 2011, 07:05 AM
Congrats to all those who helped in any way. It was not just me, it was also April and Stephen who dedicated their time to this project too. Stephen got us a nice looking web site going fast, hosted it even. April is doing everything that needs doing, including the logo at the top. Certain security vendors helped by encouraging early support, etc... Lastly, those who simply spread the word are doing as important a job as any.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: mouser on October 05, 2011, 07:11 AM
In our first week of operation (actually merely days), we had 3 real-time false-positive reports. *2 OF THOSE 3 WERE FIXED _AT_ OUT FORUMS* (one by Trend Micro, the other by Symantec). We are very proud of the security companies who have stepped up to the plate to mitigate collateral damage wherever they can. Many or most major security companies are monitoring the forum.


That really is a huge achievement and fantastic news.  :up:
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: Stoic Joker on October 05, 2011, 08:11 AM
Outstanding news! :)
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: tomos on October 15, 2011, 02:51 PM

I presume this report of IE suggesting deletion of FARR (as it is "not commonly downloaded" lol) would fit in the forum?

FARR not a commonly downloaded program? (https://www.donationcoder.com/forum/index.php?topic=28365.new#new)
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on October 15, 2011, 07:36 PM
I presume this report of IE suggesting deletion of FARR (as it is "not commonly downloaded" lol) would fit in the forum?

FARR not a commonly downloaded program? (https://www.donationcoder.com/forum/index.php?topic=28365.new#new)
-tomos (October 15, 2011, 02:51 PM)

No, because it is your fault for not having a digital cert... which costs YEARLY 1/4 of your reported MONTHLY operational costs. It is not 1996 anymore, the reality is every developer should have a cert. Sorry to be so harsh, just telling it like it is.

This is just a cost of doing business. To represent unsigned software as potentially more risky is ok because it is true.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: wraith808 on October 15, 2011, 10:06 PM
I presume this report of IE suggesting deletion of FARR (as it is "not commonly downloaded" lol) would fit in the forum?

FARR not a commonly downloaded program? (https://www.donationcoder.com/forum/index.php?topic=28365.new#new)
-tomos (October 15, 2011, 02:51 PM)

No, because it is your fault for not having a digital cert... which costs YEARLY 1/4 of your reported MONTHLY operational costs. It is not 1996 anymore, the reality is every developer should have a cert. Sorry to be so harsh, just telling it like it is.
-db90h (October 15, 2011, 07:36 PM)

For free software?  Really?  And it's the person's fault?  I'd think that for software that doesn't make money, there would be an option that's doesn't incur a yearly cost.  And that's how it is IMO.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on October 16, 2011, 01:35 AM
..
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on October 16, 2011, 01:48 AM
It is not 1996 anymore, the reality is every developer should have a cert. Sorry to be so harsh, just telling it like it is.
-db90h (October 15, 2011, 07:36 PM)
For free software?  Really?  And it's the person's fault?  I'd think that for software that doesn't make money, there would be an option that's doesn't incur a yearly cost.  And that's how it is IMO.
-wraith808 (October 15, 2011, 10:06 PM)


Well, it is DonationWare. In the end, you can debate with Microsoft if you want.  Or blame the malware authors. That's how it has been since Windows Vista. You can protest, protest, protest and I wish ya luck with it.

Throughout history there is the requirement that certain things be done to establish trust with consumers. This does sometimes means that the cost of goods produced is above 0, and thus must be sold for something other than 0..
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: wraith808 on October 16, 2011, 08:09 AM
I release as donationware on the offchance that someone decides to give something, more than with any expectation that this will happen.  Even though I get a lot of downloads, I've gotten very few donations.  Heck, I released as postcardware (without requiring a postcard even... just an e-mail) before finding this site and putting the donation part in there, and received exactly 3 e-mails.  If people won't send e-mails, why would they pay?
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on October 21, 2011, 02:44 AM
I release as donationware on the offchance that someone decides to give something, more than with any expectation that this will happen.  Even though I get a lot of downloads, I've gotten very few donations.  Heck, I released as postcardware (without requiring a postcard even... just an e-mail) before finding this site and putting the donation part in there, and received exactly 3 e-mails.  If people won't send e-mails, why would they pay?
-wraith808 (October 16, 2011, 08:09 AM)

I know, I author a lot of freeware, that I ask for donations for too. Few donate. Better to just call it freeware, my mistake on that.
Title: Re: The False Positive and Improperly Rated Site Epidemic
Post by: db90h on October 21, 2011, 03:57 AM
I would like to apologize again for sounding a little abrasive in my tone. Sometimes I do come off that way. Believe me when I say I am a big supporter of this site, and mouser. I was one of the first here, and have always supported this site and his endeavors -- and always will.