mjard

I've found it useful to purge my Youtube history every once in a while. If I click on random Youtube links on irc, they always get opened in a private/incognito session. I'm annoyed this is something that I think about.

Somebody already wrote an emulator: https://github.com/eviltrout/tis-100

Another z80 kit: https://www.tindie.com/products/Semachthemonkey/rc2014-homeb...

2014RC Computerphile video: https://www.youtube.com/watch?v=lU2NKHJygD8

I'd really like to see a statue somewhere (not in the road) that'd show these changes over time.

How friendly do you want? https://support.apple.com/kb/PH19145?locale=en_US&viewlocale...

Not exactly health related, but an example of a large company not updating a smart refrigerator, breaking features it was sold with: https://news.ycombinator.com/item?id=10732423

It's still not fixed.

Even worse, if it's a worm, it's likely it would come from somebody you know.

Or in pulseaudio as a master troll.

Verify package signatures via air-gapped machine prior to install, they did mention downloading to usb using another machine.

Updates without rebooting.

Being disinterested in a problem mixed with a bad environment (technical debt, bad documentation, things that just don't make sense) tends to shut me down completely.

Meetings, task switching, and status updates will frustrate me but I can generally get back on task fairly quickly.

...So it was added to ports. Got it.

I ride a motorcycle to work. I'm extremely vulnerable to mistakes and bad habits (my own as well as other drivers). I would really appreciate if you'd rethink your priorities as we share our commute.

nest them: [sic[sic]]

Argh, that's rough, submit a few mention there are more, the team will be able to vet the entire collection.

Afraid not, which is pretty annoying. There are free trial versions, if you are willing to install NIS or 360.

> Is it actually possible for everyone to sign their executables? Last time I did it, I had to fork over something like $250/yr for a signing key along with providing copies of various documents. This seems a little high for someone who just, say, wants to make free utilities available to the world.

No, it's not. If you sell programs, then forking over the $250 a year makes sense. If you give away programs, well, is it a loss if a user is scared off? (Serious question)

> In the case of Firefox, one would think it would be possible for you guys to do something about it on your end.

In the end, this is what we did. But it is impossible to do this for everybody.

> because you're the ones who added this reputation system that's causing users grief.

Oh boy. We did keep stats on this. Files that the reputation system scored to be "bad" and were later vetted. All in all, the reputation system works really well. There are some false positives and those do cause grief, but a majority of the time, the system blocks legitimately bad software.

> Secondly, the error message that users are presented with SCARES THEM.

Antivirus customers are they type of users that are scared, they are typically users that don't know what to trust. I feel you, I really do.

> It took us quite a while to figure out where that "false positive" link was.

This was a huge peeve of mine, the form is pretty impossible to find unless you use a search engine.

> When we finally did discover the issue, it wasn't clear what to do. It took us quite a while to figure out where that "false positive" link was, and we weren't even sure that it was the right place to send it to. Even worse, you claim that they "should" have the programs whitelisted within a few business days. This is patently false and never happens that quickly. It took a month before the executable we submitted was whitelisted and you know what? It didn't help one bit.

Normal turn around time is a few days, it shouldn't take a month. Was this around Christmas? Were the files served via https? Are files unique between downloads? Were the files mirrored to different domains? Did the team have actual executables to vet?

I understand your frustration and I am sorry it feels like Symantec is working against you. Please continue to fill out false positive reports, the team takes those seriously. With false positives, it shows the system is flawed and they'll take a deeper look at fixing the fundamental problems, otherwise they think the system is working perfectly.

Version control products wont have to deal with the reputation engine.

> Is there a way to speed things up?

Afraid not, the team will manually vet your executables so it takes some time. Fill out the forms, I wouldn't be surprised if they responded by monday. Make sure you list the possible locations to download your software.

I'd mention on your download page that Norton is currently vetting your software, so a WS.Reputation.1 message can be expected. Users are able to pull the file out of quarantine, if they read the popup message, so it'd help if they are expecting it.

>> Second: sign your executables. Well - now I know. But I just leaned it because I got complaints from my users.

ALL DEVELOPERS SHOULD SIGN THEIR EXECUTABLES / PACKAGES: it's not just for antrivirus products, its a way for your customers to verify they are getting the expected product from you.

> So you say that it will help 1) To place the downloads on the "old" domain? 2) Sign the executables 3) Move the downloads back to the new domain / cdn?

I wouldn't change anything at this point, you have the downloads working as you want, let Symantec fix its reputation for how your system works.

I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message.

First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight")

This goes directly to the team and they should have your programs whitelisted within a few business days.

Second: sign your executables. This goes a long way. And no, it doesn't have to be Verisign.

Third: don't change domains. This wiped out your known reputation. (Would have been acceptable if your binaries were signed)

Symantec is not out to squish the little guy. Sometimes you do have a few more hoops that you are required to hop through. Symantec should have better transparency on how this process works, it's something I pushed for pretty heavily but never had the power to get done.

Don't worry, you're not alone. Example: We weren't able to get Mozilla to sign their beta or developer builds that are shared on multiple mirrors (domains not related to mozilla). We'd get lots of angry (understandably) reports of reputation issues on these builds.

If anybody has any questions within reason, I'll be glad to answer them.