Blocked by Chrome and Windows Defender

[gotoarchi]

Hello again

Currently this package is blocked by Chrome and Windows Defender.

Chrome:
Radiance_c1700d56_Windows.exe
From https://github.com

Chrome blocked this download because the file is dangerous

Discover enhanced protection to get Chrome's highest level of security for downloads

Window Defender:
Malicious file

This app may cause damage to your device. Sensitive personal data may also be at risk.

Application: Radiance_c1700d56_Windows.exe
Publisher: Unknown publisher

Ignore Windows malware warning and run anyway.

Don't run

Could you digitally sign your code? A open code certificate for open source costs 25 USD.

[gotoarchi]

The latest version Radiance 6.1a (2026-03-13) , does not have the that error.

[SpaceArchitecture]

same here, last version solved it, thanks

[Gregungory]

Well, this is probably just dumb luck. They must be scanning for bit patterns that show up in some packages and not others. We don't have funds to pay Microsoft or whoever to handle the package-signing subscription, sadly.

[Sonderwoods]

Hi, I just got my work pc locked for this for at least some days, and IT is threatening to wipe it as they are afraid it is malware that will spread on the network (Cortex XDR and Windows Defender). I ran epw2wea in the newest release Rad6R0P2.

@Gregungory

Best, Mathias

[Sonderwoods]

I was jamming with Claude AI on the topic and it proposed that users use a proper installer (Inno Setup) which can exclude some subfolders of the scan. Only caveat is it requires admin elevation while installing.

Installer should run this;
Add-MpPreference -ExclusionPath

[Gregungory]

What would excluding some subfolders accomplish? Wouldn't you need some way to know what Cortex XDR and Windows Defender are looking for? It's a different executable that gets flagged each time, randomly. Who knows what their malware algorithm is based on, but it's not based on actual vulnerabilities. It seems to be based on whether-or-not the installer has been blessed by a subscription. In the case of freeware, this amounts to a form of extortion.

Are there any other solutions?
-Greg

P.S. I'm really sorry this happened to you. It shouldn't happen to anyone!

[Sonderwoods]

To be honest i have no clue. they unblocked the pc but i am still waiting for diagnostics and guidance. it works well when shipped through ladybug/honeybee/pollination, and climate studio, so I think i just have to ship it in an installer for my colleagues rather than fetching it from github on-the-fly and executing (very trojan like workflow i made ... )

I'll share my findings...

[Sonderwoods]

Cortex XDR (PaloAltoNetworks antivirus) turned out to be a false positive, so nothing has infiltrated the radiance builds. And luckily my laptop survived quarantine before they wiped it! :-)

Unfortunately they couldnt share anything about "why" it was triggered (probably some black box ai BS).
But my pattern was really bad: On the fly, download some "random" zip from github (newish release so they havent seen it on that many pc's), unzip to a random temp folder and firing up a lot of parallel processes.

I'll try to make an "Inno Setup", even though I can't sign it either, and see if this can ship radiance for enterprise. To be continued...

[Sonderwoods]

@Gregungory this might be a solution for opensource software; https://signpath.org/ .. i havent tested it though

[Gregungory]

Yes, well we don't really incorporate any third-party libraries in Radiance, nor do we update the few third-party modules we have assimilated, so the attack surface is non-existent. Also, I'm the only one with check-in authority, though that doesn't mean I pore over every piece of code submitted. I just know (and trust) the submitters.

The SignPath organization does sound like it could be a solution. I'll ask the people who help me with GitHub to see what they think. Thanks for flagging it, and I hope your week goes smoother!

-Greg