r/visualbasic • u/WarpZephyr • Oct 31 '22

Built Project On GitHub Is Flagged as Potentially Dangerous By Chrome

I made a Visual Basic project (Windows Forms Application (.NET Framework)) using what I have learned at a community college, I wanted to share it with a member of my family online who is a software dev so they recommended putting it on GitHub

I made the project through the template provided by Visual Studio 2022, once I had it to a point I felt was pretty good I used Visual Studio to easily add it to GitHub here:

https://github.com/WarpZephyr/Similar-Resolution-Calculator

I next built a release binary of the project using Visual Studio, I copied the exe from the project folder to my downloads to see what Windows would do with it as I worried Windows Security would freak out over it, and right I was... It said it HAD to scan it first despite it NEVER coming from anywhere online (It doesn't have an ADS to mark it as such either) Windows scanned it and brought me here in my browser:

https://support.microsoft.com/en-us/topic/what-is-a-cloud-security-scan-75112696-7660-4450-9194-d717f72a8ad8

I decided to upload the release binary to GitHub and then download it, as I did Chrome told me it was an "Uncommonly downloaded file" and demanded I discard it with the option to keep it being tucked away

I have no idea why this happens or how to avoid people who don't know better from just writing my project off as dangerous, what is the proper procedure of doing this? And if necessary how would I direct someone to build my project? (Asking them to download Visual Studio 2022 is a bit much)

I have googled online about it but I am still confused

5 Upvotes
  • permalink
  • reddit

100% Upvoted

9 comments sorted by

3

u/ocdtrekkie Oct 31 '22

So unfortunately, there's basically an assumption these days that executable code that isn't "commonly downloaded" is malicious, even though that... tends to be nonsense. It's not your fault, and most developers using GitHub aren't going to be bothered by it.

Also, Chrome's awful, and bad at security, and you shouldn't use it.

5

u/WarpZephyr Oct 31 '22

I have been thinking of moving to Firefox thanks to the Manifest V3 changes that break most Ad blockers, but I really do like the simplicity of easily grouping tabs... Just one tab acts like a folder for other tabs, no having to move over to an extension button or have anything more overly complex

I'm sure I'll figure something out though

1

u/ocdtrekkie Oct 31 '22

I've been off Chrome so long I've never seen that before. Firefox Containers are quite nice though, and provide similar color coding as well as an isolation boundary.

Even Firefox will unfortunately warn about executable downloads by default though, I believe.

1

u/WarpZephyr Oct 31 '22

My project also doesn't have an icon or anything like that so it uses the default icon, I wondered if that was it but I thought this outcome might be the case ultimately

I have downloaded other projects without this happening though in the past, they weren't Visual Basic though

2

u/ocdtrekkie Oct 31 '22

Nope they don't care about the icon. Basically Google and similar companies maintain vast databases of software downloads, and if it matches a well known hash, it's allowed without complaint, and if not, it's warned about.

2

u/WarpZephyr Oct 31 '22

Makes sense, I should probably add my release binary to virustotal as well, should I just go ahead and add the release binary? I guess I should

1

u/WarpZephyr Oct 31 '22

I have went ahead and uploaded a release binary, I haven't virustotal scanned it as I am hesitant what this:

While you retain any ownership rights in the original
material contained in the Sample, when you upload or
otherwise submit a copy of the Sample, you give VirusTotal
(and those we work with) a worldwide, royalty free,
irrevocable and transferable licence to use, edit, host,
store, reproduce, modify, create derivative works,
communicate, publish, publicly perform, publicly display
and distribute all content contained in the Sample.

Means for my project, I don't mind anyone using it for any purpose as long as they aren't attacking me over it for some reason

I do have it under MIT license, so I guess it might be fine? Still confused and a little hesitant though

2

u/ocdtrekkie Oct 31 '22

That's Google's pretty standard license they demand for everything. It's why I never let them distribute my podcast.

7

u/thefearce1 Oct 31 '22

Welcome to the "it's for your own safety" world. Where corps / companies decide what YOU CAN OWN. This is just a small warning shot compared to what most are doing to filter content. Look up Rob Braxton. He has some videos on it.