Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MS Windows Defender and DeCSS

arch13.com

Post reply on HN
Print view View original

111–120 of 211 posts

Re: MS Windows Defender and DeCSS

#111

Post by dannyw »

eurasiantiger wrote: post #108
pwdisswordfish8 wrote: post #63

Earlier quoted context omitted.

Opcode sequences. Regular expressions may be applied to any formal language, not just ones based on human-readable alphabets.

That kinda makes sense, thanks. However, wouldn’t this kind of heuristic be extremely simple to counter by obfuscating the machine code, e.g. by inserting complex noops and using threaded subroutines which individually look innocuous? Or, are this kind of techniques looking at known syscall patterns or something like that, and ignoring the general program flow? To me, regex doesn’t seem applicable to static analysis…

antiviruses are composed of multiple systems and techniques. Regexp is just one.

Re: MS Windows Defender and DeCSS

#112

Post by dannyw »

encryptluks2 wrote: post #85

First, you are relying on Kaspersky which I don't think is that reliable of a source anymore give what we know. Second, I can definitely say there are something up with a lot of keygens and cracks. I thought a lot of big name scene groups were reputable and there is no way that they'd sneak in a trojan, but low and behold after ignoring a few Windows Defender warnings... I could literally hear my computer randomly sp…

No shit, cracks and keygen are at extremely elevated risk of malware lol.

Re: MS Windows Defender and DeCSS

#113

Post by AnIdiotOnTheNet »

nix23 wrote: post #71
foepys wrote: post #62

Earlier quoted context omitted.

We are using Defender at work, too. There is a group policy that lets Defender do a full system scan once a week. To not interfere with the user there allegedly is a group policy setting to limit the CPU usage and it is set to 15%. The thing is, it simply does not work. Every week my fans spin up to max, Defender hogs all my CPU cores, 25% of my GPU according to the Task Manager. Even typing becomes laggy. The only w…

Wait...your are local Admin on your machine?

Everyone at the company I work for has local admin on their machines. It is not the big deal people make it out to be.

1) Malware doesn't care. It is happy to eat the user's personal data or anything they have access to on the network.

2) The OS is easily replicable if it gets damaged or destroyed thanks to imaging.

3) Whitelisting applications is a bitch to implement properly and causes a lot of friction for users.

4) There is one PC per user, so there's absolutely no reason to protect the PC from it's user.

Re: MS Windows Defender and DeCSS

#114

Post by AnIdiotOnTheNet »

nix23 wrote: post #68
Fiahil wrote: post #52

I'm so happy to see a thread on Windows Defender, because my org recently switched antivirus software and I can't wait to tell you how bad it is ! There's a hidden feature in Defender, that will delight any user : it can turn your 15" MacBook Pro into a full breakfast machine. Want pancakes ? Start a zoom call. While you wait for your favorite video conference app to start, don't hope to finish your docker pull/save/…

Oh man....a mac with antivirus software...is your IT's mindset from the 90s?

People apparently disagree, but I'm with you. The idea that antivirus software is actually a worthwhile mitigation tool is a relic from the 90s. Malware defeats antivirus all the time, and sometimes even exploits it directly. Meanwhile, aggressive antivirus software is eating a percentage of every single task you do on your computer, actively impeding your work every second of your day.

The tradeoff is not worth it, in my professional opinion.

Re: MS Windows Defender and DeCSS

#115

Post by AnIdiotOnTheNet »

Santosh83 wrote: post #8

Do tech aware people like nearly everyone in this forum, need Defender (or another AV) to run at all? How many people here completely or partially stop it from running?

I will contend that antivirus is a net-positive to absolutely nobody. Not technically adept users, not office workers, not grandma, nobody.

It slows down literally everything you do with your computer in the best case. In the worst case it breaks things and is itself an exploitation avenue. Mostly it just isn't actually very good at its job and malware defeats it regularly.

This is a bad tradeoff and other mitigation strategies make more sense in every scenario I can conceive of.

Re: MS Windows Defender and DeCSS

#116

Post by AnIdiotOnTheNet »

bob1029 wrote: post #96

Maybe this is a good time to ask a dumb question.... how do yall disable windows defender? I spent a weekend on it last year and couldn't figure it out. Best I could surmise is that I need to wipe my hard drive and install a sketchy copy of "mad max edition" windows 10 enterprise, which I would have to download on TPB or some other Warez site.

O&O ShutUp10: https://www.oo-software.com/en/shutup10

Re: MS Windows Defender and DeCSS

#117

Post by DarkmSparks »

DarkmSparks wrote: post #54
rootw0rm wrote: post #37

Earlier quoted context omitted.

should only take a moment in the group policy editor. you can actually filter settings by name to zero in on things quickly. the only real cosmetic change i can see is for instance on the virus & threat protection page in windows 10, it says in red at the top of the window: Your Virus & threat protection is managed by your organization.

windows defender was one of the (many) reasons I gave up on windows and replaced the last windows machine I had with a Mac Mini. (FC33 on my main) Very similar experience here, coupled with windows defender randomly switching itself back on and quaranteening half my (completely benign) development folder. The last time it did that I spent an entire afternoon trying to get it disabled and get my files back onto the ma…

I assume by the downvotes its not a home vs professional issue?

In which case Im more glad i didnt waste money on the professional version, than I am sorry you would prefer my personal experience be kept quiet.

Re: MS Windows Defender and DeCSS

#118

Post by marcodiego »

I fear anti-virus and firewall software may in the near future be used to guarantee DRM features.

I fear the day when I try to play media I legally own from another region and can't play it because of region blocking and can't circumvent it because my "defense" software prevents me.

Another thing that scares me: services requiring said kinds of software. The mobile world is somewhat like this already and it is basically what bars users from using their mobile phones as full blown computers even though said phone are powerful enough for that.

Re: MS Windows Defender and DeCSS

#119

Post by marcodiego »

Fiahil wrote: post #52

I'm so happy to see a thread on Windows Defender, because my org recently switched antivirus software and I can't wait to tell you how bad it is ! There's a hidden feature in Defender, that will delight any user : it can turn your 15" MacBook Pro into a full breakfast machine. Want pancakes ? Start a zoom call. While you wait for your favorite video conference app to start, don't hope to finish your docker pull/save/…

I remember a few students using windows that took a very very long time to compile anything; even smallish single-file examples. Is is possible that this slowness is caused by windows checking the binaries that were just compiled?

Re: MS Windows Defender and DeCSS

#120

Post by mszcz »

formerly_proven wrote: post #81
nix23 wrote: post #80

Earlier quoted context omitted.

That's exactly the one single reason why no one should give a developer a Windows machine in a enterprise environment ;)

Well that and the shitty dev tools on Windows in general ;)

Care to elaborate? I'm using Windows as a primary dev machine for years and I've encountered no problems aside from the infuriating update-related restarts.

What am I missing? This is an actual, emotionless, genuine question? Always looking to find new ways to procrastinate by trying out new tools ;)

Post reply on HN