Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Avoid Non-Microsoft Antivirus Software

robert.ocallahan.org

Post reply on HN
Print view View original

191–200 of 388 posts

Re: Avoid Non-Microsoft Antivirus Software

#191

Post by AntivirusExpert »

WhiteSource1 wrote: post #14
owenwil wrote: post #7

This is my advice to everyone I know that gets a new Windows PC. Windows 10's built-in protection is more than adequate, and catches the majority of bad software - anything more is unnecessary, and many of the AV vendors are predatory.

Which AV vendors are predatory? (Though Kaspersky makes me nervous). What do you think about ESET?

I recommend going by test results and by the features that interest you most.

Kaspersky, BTW, has the best scores (See here: https://bestantivirus.reviews/tools/test-results-calculator) but Bitdefender and Avira are also great according to these tests, and Bitdefender is my choice, personally.

Re: Avoid Non-Microsoft Antivirus Software

#192

Post by erelde »

neko_koneko wrote: post #133
lmns wrote: post #113

Earlier quoted context omitted.

That's exactly what I had in mind when I read the GP. If third party AVs have a large and complex codebase with unknown or even known security flaws, they won't help much against targeted attacks or make them even easier. On the other hand, AV usability is so bad you can't expect it to help "normal" people. All those popups do more harm than good when people start ignoring them.

Well, I agree that AV most likely wouldn't protect you against targeted attacks - but most of the attacks that we investigated were targeted quite broadly - phishing email campaigns targeting financial organizations (with address lists based on some hacked legitimate resources for accountants, for example). And usually these attack succeeded because of insecure infrastructure, poorly trained admins, old, non-updating…

> most of the attacks that we investigated

Isn't that a case of the survivorship bias? Or at least the broader case of selection bias?

Re: Avoid Non-Microsoft Antivirus Software

#193

Post by gravypod »

How about we avoid all antivirus software, integrate virtualization as a key feature of the UI of our operating system, and completely sandbox all apps. We have the technology to do this (Qubes does it now) but it's not going mainstream. I don't know why but I think this would be the end goal of computing. Completely segregate your work from your machine and only give it access to things that make sense. (Chrome doesn't need to see /etc/nginx or be able to run systemctl).

I also don't think we should trust Microsoft to not use similar exploits as other AV products in the future and I think the biggest problem here is primarily an issue for proprietary software.

One example is "Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security"

I have a hard time beliving that a libre-AV would have this problem. I've never seen bad architecture prevent security fixes and I've never seen bad architecture stay for long when it's only one rewrite away from being fixed. (I'm making no comments about compatability because no doubt even the command arguments will be renamed and their order will be changed)

Re: Avoid Non-Microsoft Antivirus Software

#194

Post by hsivonen »

tokenizerrr wrote: post #178
hsivonen wrote: post #129

Earlier quoted context omitted.

That's for the Wireshark debugging use case.

Indeed it is, yet it can be used for other things as well. Such as an AV that would want to MITM everything without supplying its own CA.

Is some AV product using it for that?

Re: Avoid Non-Microsoft Antivirus Software

#196

Post by bad_user »

illys wrote: post #176
bad_user wrote: post #150

Earlier quoted context omitted.

Not true. Google collects your searches. They don't sell your searches, they sell whatever they infer from your searches (your compiled and quite vague profile and I know, because I interacted with their AdSense platform), because they'd be stupid to sell your actual searches, since that's their most valuable property. Does anybody else know your search history? Besides the NSA, whom I assume have access to all US-ho…

Actually, I still have a problem when all my "actual searches" becomes someone else's "most valuable property". Of course there are some other less intrusive search engines (DuckDuckGo, maybe Qwant), but unfortunately they still are less efficient than Google for fine or rare searches.

Well, I have a problem with that too, but then I'm talking about the average user, which is never going to install Tor in order to connect to DuckDuckGo. And to tell you the truth, I don't trust DuckDuckGo that much either, as they can always turn around and start collecting data without me knowing it. But for us, the technically inclined and privacy aware, there are always solutions.

But for the average user, until a better Google comes along, I think it's OK to trust Google with their searches. And compartmentalization is paramount to information security, my point being that trusting some other company besides Google with that data is not acceptable, which is why I find that intercepting HTTPS connections is simply wrong and evil, regardless of reasons. This besides the fact that intercepting HTTPS traffic increases the attack surface, making users less secure.

Re: Avoid Non-Microsoft Antivirus Software

#197

Post by barrkel »

yAnonymous wrote: post #69
zamalek wrote: post #27

As always, it depends on the product that you are referring to. Purely by coincidence, I installed [product] again a few weeks ago, after having used Defender since Windows 10 launched. > see bugs in AV products listed in Google's Project Zero All software has vulnerabilities, including Defender. Searching for [product] in Project Zero shows that only 3 vulnerabilities have been discovered (which is arguably a bad th…

Avira won the speed test? It reliably made every PC I installed it on 2-3 times slower and adds a few minutes to the boot time compared to MSE or whatever it is now called.

The real-time scanning mode of Windows Defender completely destroyed the performance of Cygwin Setup when accessing a mirror stored on my NAS, to take one example. I'm not talking about a few minutes extra; it issued loads of network requests for every signature verification Setup tried to do, the process was still non-responsive after several hours. Turned off realtime scanning, and it immediately finished.

Realtime monitoring has the biggest risk of performance degradation.

Re: Avoid Non-Microsoft Antivirus Software

#199

Post by w8rbt »

bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

Many corporations do this on their networks so that they can inspect traffic for security purposes and outbound loss prevention. It's not uncommon today and seems to be gaining in popularity.

Edit: I don't mean to imply that it's the right or the wrong thing to do (it probably depends on the situation). Just stating what I have seen in industry.

Re: Avoid Non-Microsoft Antivirus Software

#200

Post by Klathmon »

gravypod wrote: post #193

How about we avoid all antivirus software, integrate virtualization as a key feature of the UI of our operating system, and completely sandbox all apps. We have the technology to do this (Qubes does it now) but it's not going mainstream. I don't know why but I think this would be the end goal of computing. Completely segregate your work from your machine and only give it access to things that make sense. (Chrome does…

>We have the technology to do this (Qubes does it now) but it's not going mainstream.

It is starting to go mainstream. Most mobile phones do a lesser form of this, most "web apps" do a very similar form of this, even new windows 10 UWP apps are pushing in this direction.

Everyone knows it's needed, and many see how good of a solution it is, and how much MORE can be done once there is a good baseline, but that line needs to be walked very carefully.

Once apps stop being able to do their job because of un-escapable restrictions, it becomes a problem. And once it becomes a problem, people (both developers and users) will start actively trying to get around it, which means it's not going to work at all.

Post reply on HN