forum.vdsworld.com

jules · Posted: Fri Feb 04, 2005 11:21 am Post subject:

There may be a slight obstacle to releasing anything developed using this. I downloaded the standard Windows port of ClamAV today, which is not very nice as it uses the (large) CygWin Linux compatibility layer for Windows, and insists on being installed in two folders in the root directory.

The license agreement contains the following, as a preamble to the GNU GPL itself:

Dr. Dread · Posted: Fri Feb 04, 2005 11:47 am Post subject:

jules · Posted: Fri Feb 04, 2005 1:23 pm Post subject:

Thanks for that!

PGWARE · **Web Host** Joined: 29 Dec 2001 Posts: 1566

Personally I don't think I would ever attempt to release any software that has anything GPL in it. GPL is a way to make all software free and open source, while this is great and all it prevents companies from wanting to invest time and resources into developing products which may link off GPL'd code since their code would too have to become GPL.

When I release any sofware with source code it's almost always 100% open source, meaning people can do just about anything with it UNLESS I'm currently selling software similar to it - and it would be noted in the license that they would not be able to create competing products; otherwise they are free to sell, make modifications and do anything legal with the code. Asking someone else to open their source because their using portions of my code that I freely gave away is absolutely RIDICULOUS.

Jules I don't think you could really release any program that links with Clam unless you are willing to release your code as GPL as well. This is afterall the linux community and they are pretty resolute on the GPL. If you are using the app internally within your company it would be completely fine to do.

While I am on a rant let me continue:
I personally have grown sick of Linux and the community around it. Linux is still a very immature OS, there are far more security holes for linux and '3rd party' packages then there are for Windows while they make you believe otherwise. I can count atleast 4 sendmail patches and atleast 12 kernel updates I've had to apply to a Linux server because of root security vulnerabilities. I noted '3rd party' because there really aren't very many real companies developing for linux, you typically have a few people out there putting out patches for an OS and depend on them to get the code fixed when a major security issue arrises; which in some cases can take months.

I run both Windows 2003 Server and RedHat Enterprise servers, I've found (so far) Windows to be much more reliable and stable then I have with linux. Resource consumption and performance has also been more favorable for Windows then it has for Linux as well from what I have noticed.

jules · Posted: Fri Feb 04, 2005 7:03 pm Post subject:

It's okay to run a GPL program (.EXE) from a non-GPL one, and in fact there are several commercial mail servers that do this with ClamAV. But the GNU people have this absurd idea that calling a DLL is "linking" and therefore is the same as if you actually used GPL code in your program, despite the fact that it is simply a different kind of executable file.

I have changed my code to use the EXE instead of the DLL, which is in some respects simpler, although the performance is not as good. Since my program is just a GUI shell, and I won't even be distributing any GPL code with it (it will be downloaded and installed separately by the user) I think it is perfectly okay, as this is just what the other commercial programs that use this virus scanner are doing.

I quite agree with you about the Linux community. I have been looking in the forums related to ClamAV and the tone there is so different from this one. It seems full of people with no social skills whatever, who jump on any questioner who asks a (to them) obvious question with a sarcastic remark or even a tirade of abuse.

PGWARE · **Web Host** Joined: 29 Dec 2001 Posts: 1566

Yup I think you are completely fine by calling clam in that method. I was more worried about the actual distribution of the clam files then actual linking. Seems kind of ridiculous that they want to make everyone open their code as GPL just by linking to a library (code nazi's). When their actual program is linking to non-GPL code (windows libraries); Microsoft honestly should adjust their license to stipulate anyone linking to a Windows library must release their code as NON-GPL; if we're gonna get ridiculous then why not have it the reverse?

I was taking a look at ClamAV for commandline scanning of emails for my server but realized they were using a linux port which would have serious performance problems. Not so much a problem on a desktop but on a server it can be with hundreds-thousands of mails coming in per hour. That and when I found it was GPL I was put off, I particular try to stay away from any Linux related projects if I can.

I decided to just use Panda CommandLineSecure from PandaSoftware for my server email virus scanning needs. It's 100x better then Clam, you get daily virus updates and it actually can clean viruses and disinfect them; whereas clam cannot - it simply wants to delete the file. Yes when you have an infected file you don't want to keep it but there may be some data you can preserve before you want to delete it. What's better is its really tiny - about 300 kb in size and can be scripted from the commandline.

Clam is free yes but CommandLineSecure only cost me about $50 and honestly those few dollars are more important to me then dealing with Linux related software.

You are right about the community, anyone that raises a question in almost any linux related forum is considered a 'noob' or a moron for asking such a simple question. Then you have a few people who troll those forums looking to pounce on the 'noob'.

There obviously are alot of good people in the Linux community but I'd honestly have to say if you go to a Windows development related forum you'll find 99% of the people there are more friendly then a Linux development forum. This may be a little judgemental but most people who favor Linux typically are people who enjoy the 'freeloading' lifestyle.

Garrett · Posted: Fri Feb 04, 2005 7:58 pm Post subject:

PGWARE · **Web Host** Joined: 29 Dec 2001 Posts: 1566

Yup the hackers are really having a good time messing with linux. Thats kind of the problem with open source and running it on servers, you basically allow hackers to see the source code and forumulate methods of attack. There is no guessing game for them on how to plan and launch an attack since they have the exact code to the application.

Open source is good and has it's place but for anything that is connected to the internet you're just asking for more trouble.

vdsalchemist · Posted: Sat Feb 05, 2005 3:29 am Post subject:

Well I guess I have been fortunate in that it has been my experience that if you ask the Author of the GPL'ed and or Open Source product for permission to use their software in your commercial product before you use it and you tell them how your using it then more than likely they will allow you to do so.
The main issue I have with GPL and Open Source is the fact that their lic. aggreements are not clear enough to determine if you can use the code or not free or otherwise. Also GPL and Open Source software is self limiting meaning "In the United States and most free countries if you can't sale it then what's the point?" Why work so hard on something and not get anything for it? Oh I understand if your retired and your just giving it away but then why put the restrictions? If it is "General Public Lic" then it should be open to everyone even commercial since after all the working man is the General Public too. This is like saying you can't have your company picnic at the local General Public park. Also another limiting factor with Open Source is the lack of support by some authors but not all so your taking a 50/50 chance when using Open Source.
I say that you study any example code and build your own but don't sale anything GPL or Open Source without at least asking and more important put their lic information and Copyright information in your software it will go a long way if the Author knows you are telling others where you got the idea and code from and that your not just simply claiming that it is your own. If your code is based on another product then just say it. There has really been very little original ideas in the Computer business and especially programming. It's sort of like the music world. You only have A-G in the musical alphabet so there is only so many different combinations. Just like in programming you have just a handful of constructs that you can use Branchs, Conditionals, Iterations, and assignments or definitions.

PGWARE · **Web Host** Joined: 29 Dec 2001 Posts: 1566

It appears (in my opinion) the GPL and many open source projects licenses are setup in that manner to protect against companies taking the code, putting patents on it and then claiming the whole thing is theres.

jules · Posted: Sat Feb 05, 2005 10:42 am Post subject:

PG: The direct Windows port of ClamAV includes a daemon that you can set to run like a service, and scan items whenever you want. From my tests that is a whole lot faster than loading a standalone instance of a command line scanner each time (as I have been doing with F-Prot, and you with Panda) because you avoid loading up the virus database every time. The updates seem to be issued two or three times a day.

I really agree with your thoughts on GPL, which I tend to regard as a virus (i.e. it infects all software that links with it.) It's just that I dislike all the current anti-virus products that are all going down the same road of feature-bloat, and want to create a low-resource alternative. Unfortunately there are really no other options, since I can't write my own from scratch, and the only other free to use scanner (F-Prot for DOS) now has too many problems running in an XP environment.

dragonsphere: Unfortunately the developers of ClamAV have not deigned to respond to my query regarding use of the DLLs. However, that paragraph that I quoted earlier from the readme right before the GPL itself suggests to me that they have already thought about this and come to an opinion on it. Using the EXEs avoids the problem, it's just a bigger download (because you need CygWin as well), it insists on installing in a couple of folders in the root directory (which is irritating), and it's technically not as elegant. But it seems to work just as well.

Skit3000 · Posted: Sat Feb 05, 2005 2:27 pm Post subject:

Julian, I can't find the freshclam.dll file in the package. Can it be downloaded from their site, or should I compile it myself?

PGWARE · **Web Host** Joined: 29 Dec 2001 Posts: 1566

Hi Jules,

Yes I was looking at Clam and was going to use it because of the ability for it to run as a service. However I'm not running a hotmail service so I think running a small commandline app on each mail instance is not going to hurt the performance of the server in anyway since it executes and closes itself and does not stay resident in memory the whole time. Obviously on a very high load server with tons of email coming in going the route of a service is the way to go since you don't spawn 8 mb+ instances on each virus scan.

I tested the performance and saw the server never jumps above 2% cpu usage while emails coming in and being processed by Panda. I had one really nice ISP in Canada that kept bouncing virus infected emails to me - about 10 per minute and the load or cpu usage never jumped higher then 5%, memory is also very good and always is around 600+MB free (1 gig total).

I just don't like the idea of running a port of a virus scanner. I've also heard many people claim that ClamAV for Windows won't even pickup the Eicar test virus which may be intentional or not on Clams part since it's not really a real 'virus' but a simulated one. Also who knows how long Clam is going to be around, it's an open source project but are they making $ to keep funding their effort? I'd rather pay a few bucks to go with a company that is viable and I can ensure my method of virus detection is stable for the next few years.

I run ClamAV on the RedHat Linux server for email virus detection and it's worked great, I'm just a bit hesitant to run it on a Windows server.

jules · Posted: Sat Feb 05, 2005 6:42 pm Post subject: