• approx. 1500+ copies sold since August 1 release
• I almost never have a 0-sales day. Usually sell at least 2 copies each day, some days a bunch more, especially when someone does a blog post mentioning me or whatever.
• 45 reviews on Amazon, mostly five stars
• something like 80% Kindle, 10% Nook, 10% paperback (guessing because I’m too lazy to go count the actual figures)
• DH was in the top 50 of Kindle Occult/Horror for about 3 months, dropped off recently as I’ve been doing less promoting while finishing up book two
• recently have started seeing more and more multi-copy orders showing up on BookScan from random indie bookstores/online sellers in various parts of the country. i get a tiny royalty on those ‘extended channels’ but it seems to indicate people out there are interested enough to ask their local store to get some copies. (Bookpeople in Austin, TX is already carrying it on both Local Author and Horror shelves)

From what I hear, this is all pretty damn good compared to most self-pubbed books, but it’s certainly not quitting-your-day-job revenue. But then, it’s also less than 6 months on market.

I’m hoping to see a significant sales bump when the second book releases in the spring.

Check out my tour schedule here.

Now, I’ll admit that some days I find music distracting and have to turn it off and write in silence. For whatever reason, this often seems more conducive to generating the quiet, carefully-plotted creepy scenes. It’s hard to concoct a moment where the protagonist is beset upon by silent, lurking shadows when you’ve got Lady Gaga blasting in the background.

But when the moment’s right and the scene is right, the perfect music accompaniment can draw out more nuanced emotion, more complicated behavior, and sometimes a surprise left turn when you were expecting the character to go right. It’s almost as though the characters themselves can hear the soundtrack, and respond accordingly.

For Devil’s Hand, several musicians had pretty direct influence on the story, even going so far as to actually suggest a major plot point with one lyric. Sister Machine Gun’s [R]evolution album figured heavily in the makeup of Trent’s character, especially songs like “Carbon Copy Man” and “Strange.” Albums by Evanescence and Tool were on frequent rotation when working on characters like Celia and the Prince of the Shadow Realms. And other artists snuck in too: Morphine, Beck, Nine Inch Nails, and Bonnie Prince Billy, to name a few.

But no musician influenced Devil’s Hand and it’s upcoming sequels as much as Johnny Cash.

As a child of the Appalachians, I have roots that stretch into the soil there and remain connected, even now that I live under the hot sun of Texas. The music of the mountain folk, the bluegrass, and the religion-hued old-style country still speak to some deeper part of me, and I find myself returning to them whenever digging into the world of Trent and Celia and Ramón and the demons. And, for my money, no man draws the listener into that musical world better than Mr. Cash.

From his classics like “Ring of Fire” to his more recent covers of powerful songs like “There Ain’t No Grave” and “Hurt,” Johnny’s voice and styling evoke a deep and complicated relationship between man and God, sin and redemption, and law and rebellion. Of course, these are all direct themes in Devil’s Hand. Johnny Cash’s songs, and indeed his own life, reflect the more difficult aspects of stories tied to the Judeo-Christian traditions. It’s simply not that easy to be a pure man of good in a world so dark. Every choice made has both light and dark repercussions. Every path taken can lead to Hell if you don’t pay attention to the road signs.

Johnny Cash understood this better than anybody. He walked those roads, turned around, came back, then found himself heading right back down them again. This personal struggle defined his life and music and, instead of burying it behind a glitzy mask and effervescent smile like so many other popular musicians, Cash brought it out, full and clear and uncompromising, in his songs. As far as I’m concerned, Johnny was the musical equivalent of Milton’s Paradise Lost and Dante’s Inferno.

The next time you lay fingers down on your keyboard, ready to build up your newest hero or villain, think about their personal soundtrack. What musician or song encapsulates your fiction in five minutes of tune and lyrics? What speaks to the incidents and decisions and personal demons that drive your character forward, hold them back, haunt their waking hours? What music would make them happy, giddy, jubilant, triumphant?

Yours doesn’t have to be dark and brooding like Cash; that works for me because of the story I’m writing. But maybe your heroine sashays to the sultry sounds of Norah Jones. Perhaps your hero rolls on waves of bass beneath the Los Angeles sun. Your mad scientist works feverishly against the violent, building crescendo of a great symphony. And when an important character dies, is a full military band playing taps, or is a lone vocalist standing just out of sight, her song quiet and forlorn?

When I sit down to write the more challenging, nuanced parts of Trent Hawkin’s journey through the dark reality of the Drawing Thin series, I find myself associating his fictional trials and tribulations to those real ones that faced The Man in Black and the characters that figured in his lyrics. Trent struggles, like Cash and his subjects, with the repercussions of terrible mistakes, with the realities of an imperfect nature, with Faustian choices where the road leads into darkness either way, with the struggle between doing what’s right and doing what must be done. Yet, through it all, Trent never forgets where he came from or who is important to him. The music of Johnny Cash never fails to echo that with grace and perfection and that signature gritty toughness. With The Man in Black backing him up, Trent won’t forget who he really is, no matter what situation I send him into.

With the right soundtrack, there ain’t no grave that can hold Trent down.

M. E. Patterson is an author of horror, sci-fi, and fantasy. His first novel, Devil’s Hand, frequently ranks as a Kindle Top 50 bestseller in Horror/Occult. He lives in Central Texas with his wife and dog.

(originally guest-posted on the Jagged Edge blog)

In the month of September, I have now sold well over 100 copies of the e-book this month alone. I crossed the 100 mark on the 13th. For the month of September, Devil’s Hand’s worst Amazon rank was #20,910 for one day…it’s been better than 20k for every other day, and it cracked #10,000 for 3 days, once reaching #38 in Horror/Occult. All with a book that’s less than 2 full months on the market.

I know a lot of you are probably asking, “How?”

I’m writing this because, two months ago, I was asking that question too (really, I still am, for months 3, 4, and beyond). But when I went Googling around for other people’s experiences, I was surprised that I couldn’t really find anyone sharing their early experiences.

Sure, you get the heavyweights like John Locke (who has a lot of great insights) and Amanda Hocking and Michael R. Hicks (who also has a great book on the subject). I highly encourage you to read their blogs and their books… they have a lot to teach. Also check out folks like Joanna Penn and Ania Ahlborn and numerous others who have been doing well and blogging about their findings. Reading their experiences is a great start.

In talking to other self-pubbed authors, I’m hearing that many people struggle to hit 100 books sold total. Some have had their books on sale for months and haven’t cracked 100. So I figured, for whatever it’s worth, I’ll share my early self-pubbing experiences because I like the idea of being open and contributing to the greater community of writers. And for the folks not having huge success, but would like to hear about how they might be able to bump 1 – 2 sales a day up to 5 – 6, maybe this will help.

Note that I’m not saying that doing any of this is guaranteed to work for you nor am I saying that it will continue to work for me, even. These are just my experiences in the first 2 months of selling Devil’s Hand, what has worked well and not so well, and what has gotten me to a pretty solid sales clip for a debut book by an unknown author.

So, here’s what I’ve found:

Facebook Ads kinda work. Maybe. I’ve built up a pretty good 2,000-person following on Facebook. I’m starting to see more and more engagement there, and that’s awesome. I really like my Facebook fans. A good portion of that 2k figure is from running a lot of Facebook Ads just to make people aware of the book and the fan page. This can get expensive, and my sales numbers definitely don’t get me anywhere close to breaking even on the ad cost, though I’m getting closer.

VERDICT: Try it if you have some cash to burn, I guess, but I’m betting your mileage may vary depending on the book you’re selling and your audience. Plus you end up essentially ‘buying’ a ton of Likes that never actually result in a sale. In marketing-speak, the conversion rate here seems to be pretty low, but it does convert and builds some awareness and finds you some people that do buy and may be willing to champion the novel.

Google Adsense. A big question mark. Ran some for a while. Didn’t seem to be working as well as Facebook even. All I know is when I shut off the Google Ads, I didn’t see any dip in sales, so…

VERDICT: Didn’t seem to have much effect. 

Twitter. Yes! Not only have I gotten quite a few direct sales on Twitter just by connecting with people and tweeting about the book, but I’ve also actually connected with people. I’ve found other authors whose books I’m now reading, fans that I would never have targeted but who communicate with me regularly, etc. And it brightens my day when I get to talk one-on-one with awesome people.

VERDICT: Totally worth the time. Costs nothing. But you have to work to actually connect with people. Don’t be an ass and just spam your book link over and over every 10 minutes… at least put a few hours in-between. Work to make real connections. Talk to people about your book. Ask them about theirs. Comment on the weather. Share fun photos of you doing strange things. Whatever. Be personal, not a sales-bot, even while you’re selling. 

Blogging. Well, you’re reading this blog, which means you’ve seen the book links all over the place. Since Amazon doesn’t tell you about each individual purchaser of your book, there’s no clear way to know exactly how many people are buying based on their visit here, but when I post a new post, I usually get a small bump in sales the next day or two, so…

VERDICT: You should probably be blogging anyway, if for no other reason than to build your brand. Did it directly influence 100 sales in 13 days? Not sure. But sales go up as blog traffic goes up.

Book Website. On day one, I launched devils-hand.com as the “official” virtual face of the book. The idea was to pattern it a bit after the sites the big studios throw up to tease interest for upcoming movies. In my Google Analytics, I see a definite upwards trend in traffic to that site coinciding with increasing sales. Of course, it’s also where all my tweets about the book direct people, so that’s to be expected.

VERDICT: You should do this. It doesn’t necessarily guarantee any sales increase, but it makes your book into a thing that has an anchor in the virtual world beyond the Amazon page – one that you can use when telling people to go check out the book. I’ve gone off to investigate new author friends’ books only to find that they exist solely in Amazon’s world and may even be hard to find there. Bad!

Reviews. We all want positive reviews, and for good reason. With each new review posted, I see an overall sales increase a few days later. With 14 reviews now, all 4′s or 5′s, it’s that much harder for someone interested in the concept of the book to turn down a $0.99 price point.

VERDICT: Do what you can (ethically) to get reviews. Get bloggers to read and review the book. Do a book tour. Talk to other writers and see if they’d be willing to read your book and give an honest review. Convince a book club to read it. I’ve gotten reviews by hand-selling the book to people in a billiards hall I frequent and by giving it away on Goodreads to people on the other side of the country. They didn’t have to write a review, but they read the book, reviewed the book, and are waiting for the sequel. 

Price Point. Joanna Penn has dissected this far better than I will bother to here. Just read her post. I did, gave the $0.99 price point a try, and it’s sold well so far. Next month I’ll put it back to the regular $2.99 and measure to see what effect that has. Definitely a YMMV situation. What’s right for her, you, or me may be completely different in all cases or even on a book-by-book basis.

Messaging. This is crucially important. Make sure you know how to talk about your book. Is it a book “for people who love John Grisham?” Don’t just show people a book and say, “Hey, umm, do you mind buying this?” That doesn’t work. You need to give people a reason to want your book. Of course, be honest. Don’t say, “J.K. Rowling told me personally that mine was the best book ever” unless that’s true, or you will face the wrath of angry reviewers.

Okay, so that’s a bunch of stuff to think about. And seriously, go read the million-sellers’ books too. They’re useful and full of good advice. Read Joanna’s blog.

But hopefully this should give you some sense of what *I* have done to sell 100 books in less than two weeks. Will my sales continue like this? Have I made huge mistakes that will bite my ass later? Did I forget to put my leftover curry from the Thai place in the fridge (oh, shit)?

Who knows?

But I didn’t title this post, “How I’m going to get rich and sell exponentially more every week.”

This is what I’ve done to get off to a nice start. My plan is to keep doing what works until it stops working, then adjust.

“But,” you say, “I’ve done all that stuff and it’s still not working, months later!”

Well, I’d say go back to my previous post on self-pubbing as a business and putting in your due diligence. Is your book really, truly ready to be out there? Does it stand up well against other books in its niche/genre? Does it look professional? Do you use mostly active sentences instead of passive? Have you, as Stephen King advises, cut out all the adverbs? Answering these truthfully may help you see why it’s not selling as well as you might have hoped.

Otherwise, your guess is as good as mine.

Keep trying different things! Report back if you find something that works great! Report back if you find a blog on this subject that I missed in my Googling! And feel free to catch up with me here, in the comments, and on Twitter – @mepatterson

Good luck and great sales!

PUT IN YOUR DUES

Okay, so what I’m not going to spout is the oft-repeated advice about never publishing your first manuscript. If you think you have a good first novel, by all means, try and sell it! It probably is garbage and you probably should completely rewrite it from scratch (I did with mine), but just because it’s your first manuscript doesn’t mean you have to shelve it. But before you put it out there, put in your dues first.

What do I mean?

I mean you need to be honest with yourself and subject your work to the same forces that authors have been doing since before we had this whole self-publishing game. It’s become faddish to bitch and moan about the big publishers being ‘evil’ and agents being ‘gatekeepers,’ but the reality is that it’s all just business. Those folks know business. They know (generally) what is good enough quality to sell (note I didn’t say ‘great’). And you, Mr. Selfpublisher, are about to jump into the business world as a solo entrepreneur. Don’t be that guy running around town trying to sell your goofy invention that looks stupid, doesn’t benefit anyone, and doesn’t actually work.

• Submit to agents and/or editors. Get form rejections. Make edits. Get more form rejections. Make edits. Get some personal rejections with assorted kudos.
• Get to know the publishing biz, because you’re about to be part of it. Understand how books are made, from initial concept to objects on shelves to remaindering to six-figure deals.
• Maybe hire a professional editor. They cost money, and you should avoid any that “guarantee” that they will get you published, but the good ones know their shit and will tell you when your stuff is shit. Accept it, shed a tear, and go back to the drawing board. Because your initial stuff is shit. 

Don’t assume that you have a brilliantly original story idea (you don’t), that you are the Next Big Thing (you’re not), or that you “don’t need other people to validate your talent.” Maybe you don’t, but you’re not going to sell any books either, jackass.

Put in your dues, even (read: especially) for your very first manuscript.

The goal is not to refine your product into the most beautiful and elegant piece of fiction ever crafted (mine is certainly not). The goal is to make something that can be sold and enjoyed by a reasonably-sized audience, and that will, over its lifespan, create a net positive for your brand (aka You) so that you can sell more books. Neal Stephenson’s first book was not great, by any means, but it was good enough to make people willing to publish/read more of his work. Now he’s a bestselling author.

WRITING GROUPS

There have long been posts about the various Types of writing groups. “Puff” groups where no one ever says a critical thing about your work (avoid like the plague!). Killer groups where the game is to one-up each other with nastier and more soul-crushing criticisms (sometimes useful, but generally teaches you more about the commenter than about your book). But since this post is about self-publishing, I’m going to discuss a new split in the world of writing groups:

“There’s only one way to be a real author” groups vs. “Brave new world” groups.

Maybe controversial, but here goes–

My own experiences, plus those of others I’ve talked with, suggest that this split is becoming more and more prevalent. That group of really wonderful people you’ve joined gives you awesome criticism, helps you refine the hell out of your work, and then when you triumphantly announce the existence of your self-pubbed book on all the major e-stores and they cluck their tongues and chide you for “cheating” or “taking the easy way out” or “giving up.”

As a soccer-playing friend of mine used to say: this is utter horseshit.

Nobody told Steve Jobs he was “giving up” because he decided to build his own idea of a computer instead of just joining one of the big boys and working on mainframes.

Now I’m not saying you’re Steve Jobs because you self-pubbed your dumb story. Sorry. But you should take pride in the fact that you are now an author. Maybe a failing author. Maybe a terrible author with no fans. But you’re an author. If you put in your dues (see above), there’s a reasonable chance you’ve got good enough work that will be a toehold to building a brand.

Your “one real way” group can go to Hell if they’re not interested in supporting you as a published author. And I don’t mean to say that these groups are entirely composed of “one real way”-ers. It’s usually a couple bad apples with chips on their shoulders. But don’t let anyone tell you that you shouldn’t try self-publishing. You should let them tell you that your story is boring, or your character is shit, or your prose isn’t up to snuff. They’re probably right, and you should listen.

But if you’ve put in the time and have something that agents are telling you is publishable, publish it! Don’t let the holier-than-thou group members try to convince you that your work isn’t publishable until an agent/editor contract is signed. One of those things is quality of creative work… the other is business. Don’t confuse them, and don’t let others confuse them for you.

On the other side of the coin, you’ve got the “Brave new world” groups. They can be equally useful in critiquing your work and telling you when you’re missing the mark. And, compared to the previous group, they’ll happily support you when you decide to self-publish. They’ll trade tips on self-publishing price points, experiences, and marketing efforts, pat you on the back when you announce your 100th sale, etc. etc..

But the downside to some of these groups is that they might be too willing to go indie. It’s all fine and good to say that now anyone can be an author, but not everyone who joins a writing group with some convoluted scrawl vomited onto parchment should be self-pubbing. They’re just heading for hurt and embarrassment when those 1-star reviews start rolling in (see the recent guy who self-promoted his ‘novel’ on Digg and it became a shooting gallery of criticism… though he probably sold quite a few books…hmm…).

Conclusion: take what you can from both types of groups, but again, Put In Your Dues before you chuck anything out there into the ether. Be sure you have a solid product to sell, not some embarrassing screed that will make your mama cry.

MARKETING, ADVERTISING, AND SELF-PROMOTION

Marketing is a plan. You have a plan for how to sell your stuff, you refine the plan, then execute the plan, then measure the plan’s effectiveness.

Advertising is when you pay money to someone else and they promise to put your stuff in front of lots of people’s eyeballs.

Self-promotion is when you, valiant businessman, try to put stuff in front of people’s eyeballs all by your lonesome.

And what’s weird is that some people will bitch and bitch about you using advertising or self-promotion. I don’t get it. Business is business. If 100 people see your paid advertisement or self-promotion, 5 people bitch about it, and 10 people buy the thing, then those 5 people can go bite themselves because you just hit 10% sales conversion, which is awesome.

Sure, there are rules in the various advertising forums out there. Be polite. Don’t spam the same thing over and over. As Wil Wheaton says, “Don’t be a dick.” But that doesn’t mean you need to be a shrinking violet either and avoid advertising or self-promotion because it seems ‘unclean’ or ‘rude.’ Hell, Wil Wheaton himself spammed my Google+ stream recently with a self-promoting post about his sci-fi novel. (and he’s certainly not lacking in audience already; his @wilw twitter persona has 1.8 million followers)

That said, notice I mentioned that a marketing plan measures it’s effectiveness. Seriously. You need to get numbers. If you do a $1,000 ad buy, you damn well better know if it converted 10 people to sales or 100 people. For the former, you’re spending $100 to get 1 sale. Your book better cost more than $100 in that case. For the latter, you’re spending $10 to get 1 sale. Better, especially if it’s your $12 paperback version, but maybe not good enough if you’re only selling e-books at $2.99. It’s okay to spend a bunch of ad money just growing awareness for your product, too. In that case, maybe the $1,000 ad buy was worth it (doubtful, though). But you need to have the numbers so you know what you’re getting. And if your current ad platform isn’t doing jack for you, dump it and find one that does.

CONCLUSION

So that’s three broad areas where hopefully I’ve given you some food for thought. If there’s a theme to this post, it’s that you have to keep remembering that writing a novel is storytelling, editing a novel is product refinement, but selling a novel is business. You can do the first two all day long without spending a penny, and there are groups of like-minded people out there willing to help in return for your help with their product.

But once you hit #3, you’re an entrepreneur. Don’t be afraid of acting like one.

Lest this turn into a self-promoting, self-congratulating garbage post, I should probably get to the point why I’m listing all this: To succeed in today’s digital world, I believe you need to learn to do more than one thing. Hit the jump for more…

When I was a kid, I was going to be a scientist someday. Then a writer. Then a movie director. Then a computer programmer. Given my proclivity for pushing plastic keys and messing with calculators, the latter came pretty naturally. But then college: the computer engineering program I entered was focused on compilers and shrink-wrapped software; this whole ‘internet’ and ‘hypertext’ thing seemed a bit faddish. But that’s what I was interested in. So I switched to English where, not only did I get to read books and write, but the profs there were actually psyched about HTML — they saw it as a new future where everyone in the world would read their manifesto on “British colonial attitudes between the years of 1862 and 1864.”

Yeah, so, fast-forward to today.

Film industry is changing.

Music is changing.

And now publishing is changing.

Not to mention newspapers, magazines, and everything else related to the printed word. So the question you have to ask yourself, as a programmer, or a writer, or a graphic designer is: am I learning new things that will help me leverage my top skills in other verticals (to use some biz-speak)?

To come at it another way — you can do one of the aforementioned things, and that’s great, and you can probably get people to pay you to do it. But if you’re a programmer, why not learn to write and kick out a self-pubbed book on programming related to your particular specialty? Or polish up some design skills: at the least, learn some color theory and basic front-end HTML 5. If you’re a graphic designer, you damn well better be learning HTML and CSS or you’re sunk as the ad agencies all start going digital/interactive. If you’re a writer and you’re still poking your typewriter and ignoring the world of social media, internet publishing, and design, then you’re going to end up spending a lot of money paying guys like me to do stuff for you when you either (A) self-publish or (B) your Big Publishing publisher tells you “do the marketing your damn self because we’re cutting budgets.”

And I’m not saying that this secondary or tertiary skill you pick up needs to be polished to diamond clarity. You don’t need to become Mario Llosa to add some oomph to your programming skills. You don’t need to become Van Gogh to learn to make website designs that are better than this. And you don’t need to know the ins-and-outs of Ruby’s eigenclass if you want to improve your ability to do internet marketing for your book.

But you do owe it to yourself to push the boundaries of your comfort zone and go beyond your expertise. It will pay off in dividends.

It’s a supernatural thriller about demons, angels, poker, and armageddon, set in Las Vegas. If you like Tim Powers or Dean Koontz, you’ll probably dig this.

It’s only $2.99 for e-readers. $11.95 if you want a for-reals paperback.

ebook for Kindle/Kindle App: http://amzn.to/dhkindle
ebook for Nook: http://bit.ly/dhnook
paperback: http://amzn.to/qxQEgw

And if you buy it, read it, and like it, please drop by Amazon and give it a quick review. Every review helps get it more exposure to readers that might not otherwise ever hear about the novel. Thanks!

In my opinion, this debate is like having a debate about cars vs. pickup trucks. There are valid pros/cons to buying cars and valid pros/cons to buying pickup trucks. In fact, it’s totally valid for one person to own both a car and a pickup truck! Gasp! I know, it’s mind-blowing!

I’ll add that, as a proponent of MongoDB, I definitely think the right NoSQL database is a better solution in many ways for much of the web-app databasing that was previously handled by relational DBs. But my saying that in no way indicates that I think SQL is dead, relational is dead, or anything of that sort. This is a classic ‘right tools for the job’ discussion.

If there’s any debate at all, maybe it’s around what, specifically, the best use cases are for each type of database, but I’d prefer that we stop referring to that as a debate and instead just see it as an ongoing evolution and discussion. Creating conflict where there doesn’t need to be any solves nothing and makes us all look bad.

• Linux Malware Detector on a daily scan
• mod_security for Apache
• moving /tmp to a non-executable partition
• daily scan with ClamAV’s clamscan utility
• moving SSH to a nonstandard port
• removing the ability for root to login through SSH
• (even better) making SSH auth-key-based only, so no user/password logins at all!

This setup will at the very least harden your server against the bulk of irritating script-based assaults.  There’s lots more that can (and should) be done, but I’m starting to think that most of the things I’ve just listed are required nowadays (certainly the SSH ones are).

First, you gotta setup Mongoid with Carrierwave and all that junk.  I’m not going to explain how all that works.  It’s not terribly difficult.  Figure it out.  The salient point is that you should go ahead and get your model and controller all wired up so that Carrierwave processes the file upload and attaches it to your Mongoid model correctly.  For now, ignore the virus-scanning bit and just get that working.  Once you’re there, read on…

THE CONTROLLER

The first trick is that you don’t want to just attach the file to the model anymore, since you want to verify it’s cleanliness first.  So we need to shunt it to the file system in a temp directory where we can scan it.

Your ‘create’ method on the controller might look something like this (using InheritedResources here for simplicity):

So what we’re saying is that we shunt the manuscript off before we create the project and save the object to mongo. Obviously.

Here’s that method (I’ve removed some extra code that’s not relevant to the discussion):

Okay, so that last line takes us to the next awesome. We’ve got a project. It has a manuscript. We’ve shunted it off and written to the filesystem, then deleted the param so it doesn’t get attached via Carrierwave (yet). Now we call process_manuscript_upload for that project against that file. (NOTE: obviously we call this same shunt method in the update action on the controller too)

CLAM AV

Before we can go about willy-nilly virus-scanning things, we ought to have a virus scan solution. Enter ClamAV for Linux. Suppose you could use any virus scanner you want here, as long as it can be called via command-line and returns reasonable exit codes that differentiate between success (clean) and failure (has virus).

I’ll leave it up to you to figure out how to install ClamAV on your system.

THE MODEL

So in our Project model, we’ve added an instance method that gets called after someone has attempted to upload a file through our projects controller. It does our dirty work using the virus scanner we just installed.

Seriously, this is not really complicated at all. I’ll break it down:

1. figure out the path to file we want to scan. scan it using system() shelling out to the ‘clamscan’ executable and giving it the tmp path of our file.
2. if it’s clean, assign it to manuscript by just opening up the file (carrierwave takes over here — in my case, I have it write the file to cloud storage, but you could write it locally, or to the database, or whatever), change the Project object so it doesn’t think it has a pending manuscript anymore, and save
3. if it’s got a virus, similarly update the pending attribute, but instead of attaching, we log a big warning, send the user a nasty email, and delete the filthy thing from our filesystem.

Easy, right? And if you don’t know what that very last line is all about, it’s DelayedJob. I like the fork from collectiveidea. Really, you want to background this somehow. Generally ClamAV is fast as hell, but you don’t want that process blocking the saving of the user’s Project. And that’s what the ‘pending’ attribute is all about. On my Project new form, I only show the manuscript upload file field if pending is false. If it’s true, I instead show a message with a little spinner saying “Your manuscript is being scanned for viruses” or something like that.

So hopefully that wasn’t too tough to follow. I was delighted at how straightforward it ended up being. And I’m sure there’s some variations on the theme you could use, or wrap all this up in a nice include that just gets stuck on the model (i.e. include VirusScanner or something). But this is my quick-and-dirty implementation.

Enjoy!