llvm dev - Jun 2012 - [LLVMdev] Windows development and "virus" in LLVM test suite

1. I can't tell Microsoft Security Essentials to ignore anything.  Even if
I click Allow, it breaks the pull.
2. The issue is not me.  I don't download virus infested stuff and I
don't
visit dangerous sites so I rarely have a need for antivirus solutions.

The issue is the newcomer Windows user whom I have to instruct to disable
and/or remove his antivirus program if he or she wants to set up a Windows
buildbot slave.  A bit drastic, but that's life as it is now.

2012/6/15 Michael Spencer <bigcheesegs at gmail.com>
> On Fri, Jun 15, 2012 at 1:02 PM, Mikael Lyngvig <mikael at
lyngvig.org>
> wrote:
> > Hi,
> >
> > I just filed a bug because LLVM's test suite includes a virus. 
This is
> not
> > normally a problem on Unix (not even Linux), but as everyone know,
> Windows
> > is so vulnerable to vira, that Windows users have to have an antivirus
> > solution installed.  The problem is that the virus in:
> >
> >
> >
> 
projects/test-suite/MultiSource/Applicaations/ClamAV/inputs/rtf-test/rtf1.rtf
> >
> > BREAKS the SVN pull of the LLVM test suite: Once the file is read onto
> disk,
> > the antivirus solution aborts the SVN pull because SVN cannot access
the
> > file anymore.
> >
> > I filed a bug to have the offending file removed from LLVM, but it was
> > immediately closed with a WONTFIX flag.
> >
> > So, I am asking here, in the greater context of the LLVMdev mailing
list,
> > what can be done to fix the presence of a "virus" in LLVM
permanently?
> It is
> > not acceptable to have to ask people to uninstall their antivirus
> solution
> > if they want to use the test suite on Windows.
> >
> > The problem occurs with Microsoft Security Essentials (the poorest
> antivirus
> > solution in existence), so it is likely to occur with many antivirus
> > solutions.
> >
> > A quite from Wikipedia regarding the file:
> >
> >  A compliant virus scanner, when detecting the file, will respond in
> exactly
> > the same manner as if it found genuinely harmful code.
> >
> > So any compliant virus scanner will choke and panic upon encountering
> this
> > file!
> >
> >
> > Cheers,
> > Mikael
> >
> > _______________________________________________
> > LLVM Developers mailing list
> > LLVMdev at cs.uiuc.edu         http://llvm.cs.uiuc.edu
> > http://lists.cs.uiuc.edu/mailman/listinfo/llvmdev
> >
>
> Tell your AV to ignore that folder and program. I don't have an issue
> with it on Windows.
>
> - Michael Spencer
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20120615/af20aa74/attachment.html>

Okay, I can configure MSE to ignore certain places.  Just have to do it in
advance.  Thanks for the hint.

2012/6/15 Mikael Lyngvig <mikael at lyngvig.org>
> 1. I can't tell Microsoft Security Essentials to ignore anything.  Even
if
> I click Allow, it breaks the pull.
> 2. The issue is not me.  I don't download virus infested stuff and I
don't
> visit dangerous sites so I rarely have a need for antivirus solutions.
>
> The issue is the newcomer Windows user whom I have to instruct to disable
> and/or remove his antivirus program if he or she wants to set up a Windows
> buildbot slave.  A bit drastic, but that's life as it is now.
>
>
> 2012/6/15 Michael Spencer <bigcheesegs at gmail.com>
>
>> On Fri, Jun 15, 2012 at 1:02 PM, Mikael Lyngvig <mikael at
lyngvig.org>
>> wrote:
>> > Hi,
>> >
>> > I just filed a bug because LLVM's test suite includes a virus.
This is
>> not
>> > normally a problem on Unix (not even Linux), but as everyone know,
>> Windows
>> > is so vulnerable to vira, that Windows users have to have an
antivirus
>> > solution installed.  The problem is that the virus in:
>> >
>> >
>> >
>> 
projects/test-suite/MultiSource/Applicaations/ClamAV/inputs/rtf-test/rtf1.rtf
>> >
>> > BREAKS the SVN pull of the LLVM test suite: Once the file is read
onto
>> disk,
>> > the antivirus solution aborts the SVN pull because SVN cannot
access the
>> > file anymore.
>> >
>> > I filed a bug to have the offending file removed from LLVM, but it
was
>> > immediately closed with a WONTFIX flag.
>> >
>> > So, I am asking here, in the greater context of the LLVMdev
mailing
>> list,
>> > what can be done to fix the presence of a "virus" in
LLVM permanently?
>> It is
>> > not acceptable to have to ask people to uninstall their antivirus
>> solution
>> > if they want to use the test suite on Windows.
>> >
>> > The problem occurs with Microsoft Security Essentials (the poorest
>> antivirus
>> > solution in existence), so it is likely to occur with many
antivirus
>> > solutions.
>> >
>> > A quite from Wikipedia regarding the file:
>> >
>> >  A compliant virus scanner, when detecting the file, will respond
in
>> exactly
>> > the same manner as if it found genuinely harmful code.
>> >
>> > So any compliant virus scanner will choke and panic upon
encountering
>> this
>> > file!
>> >
>> >
>> > Cheers,
>> > Mikael
>> >
>> > _______________________________________________
>> > LLVM Developers mailing list
>> > LLVMdev at cs.uiuc.edu         http://llvm.cs.uiuc.edu
>> > http://lists.cs.uiuc.edu/mailman/listinfo/llvmdev
>> >
>>
>> Tell your AV to ignore that folder and program. I don't have an
issue
>> with it on Windows.
>>
>> - Michael Spencer
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20120615/a6c72484/attachment.html>

On Fri, Jun 15, 2012 at 1:53 PM, Mikael Lyngvig <mikael at lyngvig.org>
wrote:
> 1. I can't tell Microsoft Security Essentials to ignore anything.  Even
if
> I click Allow, it breaks the pull.
> 2. The issue is not me.  I don't download virus infested stuff and I
don't
> visit dangerous sites so I rarely have a need for antivirus solutions.
>
> The issue is the newcomer Windows user whom I have to instruct to disable
> and/or remove his antivirus program if he or she wants to set up a Windows
> buildbot slave.  A bit drastic, but that's life as it is now.
>
At a fundamental level, I don't see easy ways to fix this.

A major user of LLVM is an anti-virus software suite.

A reasonable test case for them is to detect, well, a virus.

A reasonable use of the test suite (which note is *not* part of the primary
LLVM repository!) is to include tests that are a bit tricky to include with
LLVM by default either because they take too long to run, have too many
host dependencies, have weird license restrictions, etc etc.

It's not clear to me that making this optional test suite easier to install
on restrictive platforms like Windows with this security software you
mention is worth neutering the ClamAV tests run...
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20120615/48409278/attachment.html>

Solution found (instruct the user to add an ignore directory to his or her
antivirus solution).  It works too :-)  And Windows users ought to suffer a
little bit for having chosen that platform ;-)

And me who couldn't for the life of me figure out why the heck a compiler
needed to include an antivirus testcase.  Well, there are greater wonders
under the sky than anyone can ever imagine.

2012/6/15 Chandler Carruth <chandlerc at google.com>
> On Fri, Jun 15, 2012 at 1:53 PM, Mikael Lyngvig <mikael at
lyngvig.org>wrote:
>
>> 1. I can't tell Microsoft Security Essentials to ignore anything. 
Even
>> if I click Allow, it breaks the pull.
>> 2. The issue is not me.  I don't download virus infested stuff and
I
>> don't visit dangerous sites so I rarely have a need for antivirus
solutions.
>>
>> The issue is the newcomer Windows user whom I have to instruct to
disable
>> and/or remove his antivirus program if he or she wants to set up a
Windows
>> buildbot slave.  A bit drastic, but that's life as it is now.
>>
>
> At a fundamental level, I don't see easy ways to fix this.
>
> A major user of LLVM is an anti-virus software suite.
>
> A reasonable test case for them is to detect, well, a virus.
>
> A reasonable use of the test suite (which note is *not* part of the
> primary LLVM repository!) is to include tests that are a bit tricky to
> include with LLVM by default either because they take too long to run, have
> too many host dependencies, have weird license restrictions, etc etc.
>
> It's not clear to me that making this optional test suite easier to
> install on restrictive platforms like Windows with this security software
> you mention is worth neutering the ClamAV tests run...
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20120615/92112914/attachment.html>

----- Original Message -----
> From: "Chandler Carruth" <chandlerc at google.com>
> To: "Mikael Lyngvig" <mikael at lyngvig.org>
> Cc: "LLVMdev Mailing List" <llvmdev at cs.uiuc.edu>
> Sent: Friday, June 15, 2012 5:00:03 PM
> Subject: Re: [LLVMdev] Windows development and "virus" in LLVM
test suite
> On Fri, Jun 15, 2012 at 1:53 PM, Mikael Lyngvig < mikael at lyngvig.org
>
> wrote:
> 
> 
> 1. I can't tell Microsoft Security Essentials to ignore anything. Even
> if I click Allow, it breaks the pull.
> 2. The issue is not me. I don't download virus infested stuff and I
> don't visit dangerous sites so I rarely have a need for antivirus
> solutions.
> 
> 
> The issue is the newcomer Windows user whom I have to instruct to
> disable and/or remove his antivirus program if he or she wants to set
> up a Windows buildbot slave. A bit drastic, but that's life as it is
> now.
> 
> 
> At a fundamental level, I don't see easy ways to fix this.
> 
> 
> A major user of LLVM is an anti-virus software suite.
> 
> 
> A reasonable test case for them is to detect, well, a virus.
> 
> 
> A reasonable use of the test suite (which note is *not* part of the
> primary LLVM repository!) is to include tests that are a bit tricky to
> include with LLVM by default either because they take too long to run,
> have too many host dependencies, have weird license restrictions, etc
> etc.
> 
> 
> It's not clear to me that making this optional test suite easier to
> install on restrictive platforms like Windows with this security
> software you mention is worth neutering the ClamAV tests run...
Might we also have problems with virus-scanning firewalls? Would it work if we
XORed the ClamAV test's inputs with something, and then modified the test to
XOR the results of its reads (to undo the transformation). If that is sufficient
to get around this issue, then it might be worthwhile.

 -Hal
> _______________________________________________
> LLVM Developers mailing list
> LLVMdev at cs.uiuc.edu http://llvm.cs.uiuc.edu
> http://lists.cs.uiuc.edu/mailman/listinfo/llvmdev

On 15.06.2012, at 22:53, Mikael Lyngvig wrote:
> 1. I can't tell Microsoft Security Essentials to ignore anything.  Even
if I click Allow, it breaks the pull.
> 2. The issue is not me.  I don't download virus infested stuff and I
don't visit dangerous sites so I rarely have a need for antivirus solutions.
> 
> The issue is the newcomer Windows user whom I have to instruct to disable
and/or remove his antivirus program if he or she wants to set up a Windows
buildbot slave.  A bit drastic, but that's life as it is now.
The intersection of "people using the LLVM test-suite" and
"people who don't know how to disable their antivirus" may not be
empty, but it's really too small to care about. The test-suite isn't
meant to be used by end-users, we can expect anyone who wants to try the
testsuite to be smart enough to put "eicar" in the search engine of
their choice and then then disable their antivirus after finding out what it is.

I'm also strongly suggesting to disable any kind of antivirus guard on a
machine that builds and tests llvm because it slows down builds significantly
and has the tendency to make testing more unstable. Racing file handle locks on
windows are a big pain, and antivirus solutions tend to create these conditions
all the time. We have seen bogus, hard to reproduce test failures because of
this in the past.

- Ben

I admit I belong to a small group of not-too-bright people who still aspire
to use LLVM.  But I kind of see that as a highly valuable feature, insofar
I convert this fact into something constructive (such as FAQ writing) :-)

I actually did recommend people to disable their antivirus solution for two
reasons - the aforementioned "virus" and the speed slowdown that
they'll
experience, but then somebody (can't remember who) reacted and said it
wasn't a good idea to recommend people to disable their antivirus solution.

However, I see a nifty compromise visualising behind my eyes: Ask the user
to add the LLVM source and build directories to their virus ignore list.
 This will solve both issues.

-- Geez, sometimes I'm smarter than I am.

2012/6/15 Benjamin Kramer <benny.kra at googlemail.com>
>
> On 15.06.2012, at 22:53, Mikael Lyngvig wrote:
>
> > 1. I can't tell Microsoft Security Essentials to ignore anything. 
Even
> if I click Allow, it breaks the pull.
> > 2. The issue is not me.  I don't download virus infested stuff and
I
> don't visit dangerous sites so I rarely have a need for antivirus
solutions.
> >
> > The issue is the newcomer Windows user whom I have to instruct to
> disable and/or remove his antivirus program if he or she wants to set up a
> Windows buildbot slave.  A bit drastic, but that's life as it is now.
>
> The intersection of "people using the LLVM test-suite" and
"people who
> don't know how to disable their antivirus" may not be empty, but
it's
> really too small to care about. The test-suite isn't meant to be used
by
> end-users, we can expect anyone who wants to try the testsuite to be smart
> enough to put "eicar" in the search engine of their choice and
then then
> disable their antivirus after finding out what it is.
>
> I'm also strongly suggesting to disable any kind of antivirus guard on
a
> machine that builds and tests llvm because it slows down builds
> significantly and has the tendency to make testing more unstable. Racing
> file handle locks on windows are a big pain, and antivirus solutions tend
> to create these conditions all the time. We have seen bogus, hard to
> reproduce test failures because of this in the past.
>
> - Ben
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20120615/d4c03efe/attachment.html>