Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MS Windows Defender and DeCSS

arch13.com

Post reply on HN
Print view View original

131–140 of 211 posts

Re: MS Windows Defender and DeCSS

#131

Post by hdjjhhvvhga »

AnIdiotOnTheNet wrote: post #114
nix23 wrote: post #68

Earlier quoted context omitted.

Oh man....a mac with antivirus software...is your IT's mindset from the 90s?

People apparently disagree, but I'm with you. The idea that antivirus software is actually a worthwhile mitigation tool is a relic from the 90s. Malware defeats antivirus all the time, and sometimes even exploits it directly. Meanwhile, aggressive antivirus software is eating a percentage of every single task you do on your computer, actively impeding your work every second of your day. The tradeoff is not worth it,…

Of course it's not worth it, but in many orgs it's required for compliance. It may change in the future as most people realize it's not that useful, just like NIST changed the rule about password updates.

On the other hand, it might seem useless because malware creators know it's there. Basically all functional pieces of malware have to go through VirusTotal otherwise they won't be effective. But if all orgs dump antivirus software it would be a bit like giving up MMR vaccination in children.

Re: MS Windows Defender and DeCSS

#132

Post by causi »

mszcz wrote: post #120
formerly_proven wrote: post #81

Earlier quoted context omitted.

Well that and the shitty dev tools on Windows in general ;)

Care to elaborate? I'm using Windows as a primary dev machine for years and I've encountered no problems aside from the infuriating update-related restarts. What am I missing? This is an actual, emotionless, genuine question? Always looking to find new ways to procrastinate by trying out new tools ;)

You don't use Windows Update Manager or timed firewall rules to make sure Update doesn't ever interfere with your work?

Re: MS Windows Defender and DeCSS

#133

Post by ddalex »

grishka wrote: post #129
marcodiego wrote: post #118

I fear anti-virus and firewall software may in the near future be used to guarantee DRM features. I fear the day when I try to play media I legally own from another region and can't play it because of region blocking and can't circumvent it because my "defense" software prevents me. Another thing that scares me: services requiring said kinds of software. The mobile world is somewhat like this already and it is basica…

As long as the hardware allows booting arbitrary code, this kind of DRM remains technically impossible. There's nothing to stop you from booting into another OS and deleting the files implementing the harmful functionality. If there are checks for the presence of these files in other parts of the OS, you can remove them. IMO it's a very dangerous attitude when people consider software immutable. You can achieve a lot…

> There's nothing to stop you from booting into another OS and deleting the files implementing the harmful functionality. If there are checks for the presence of these files in other parts of the OS, you can remove them

Encrypted disks with TPM-stored keys will certainly prevent unauthorised modification to a filesystem

> hardware allows booting arbitrary code

And this particular cat is already out of the bag with Win 11 REQUIRING TPM support with verified boot.

The war against general-purpose computing is in the final stages, and the garden-keepers have already won for almost everything that matters. Yes, you can still source open hardware and they will not fight against technical elites - a minority - but for the vast majority of users, it's over because they LIKE the closed apps holding data hostage.

Re: MS Windows Defender and DeCSS

#134

Post by nix23 »

causi wrote: post #130
tallanvor wrote: post #82

Earlier quoted context omitted.

Outside of highly regulated environments, technical staff usually have local admin rights. Is it a risk? Yes, although one that can be minimized. Letting people do what they need to do with minimal interference is an important part of keeping employees happy.

Even if they're not supposed to, most people do, or at least they know an admin login. All it takes is one frustrated person who knows someone higher up and the login is on a sticky note in a drawer. Technical security measures are not and will never be a substitute for proper training.

And proper training is never achievable in non IT Enterprise...because no one cares, whats left are technical restrictions.

Re: MS Windows Defender and DeCSS

#135

Post by jeroenhd »

sneak wrote: post #16
ooboe wrote: post #7

His comment in /r/sysadmin: "Setting a Windows Defender exception to the folder does not prevent the quarantine from occurring. I re-ran this test three times trying exceptions and even the entire NAS drive as on the excluded list." Windows Defender is overriding the user whitelist?

In addition, Windows also quarantines and deletes innocuous Windows activation crack tools that contain no malware whatsoever, but can be used to activate Windows independently of Microsoft. It's really amazing the attitude Microsoft takes regarding hardware that isn't theirs, including the nonconsensual forced autoupdate.

That's not just a Windows feature, though. My experience with _every other antivirus_ has always been that anything related to cracking or keygens is flagged as a virus.

In my opinion, Windows Defender is still the best antivirus software for consumers. That's not a compliment to Windows Defender, that's an insult to antivirus companies all over the world.

Re: MS Windows Defender and DeCSS

#136

Post by grishka »

ddalex wrote: post #133
grishka wrote: post #129

Earlier quoted context omitted.

As long as the hardware allows booting arbitrary code, this kind of DRM remains technically impossible. There's nothing to stop you from booting into another OS and deleting the files implementing the harmful functionality. If there are checks for the presence of these files in other parts of the OS, you can remove them. IMO it's a very dangerous attitude when people consider software immutable. You can achieve a lot…

> There's nothing to stop you from booting into another OS and deleting the files implementing the harmful functionality. If there are checks for the presence of these files in other parts of the OS, you can remove them Encrypted disks with TPM-stored keys will certainly prevent unauthorised modification to a filesystem > hardware allows booting arbitrary code And this particular cat is already out of the bag with Wi…

So this might be a dumb question, but what's there to prevent someone emulating a TPM? What's there to prevent someone nop'ing out the code that implements the TPM functionality in Windows? Where does the root of trust (or, rather, distrust) come from?

Re: MS Windows Defender and DeCSS

#137

Post by nix23 »

hdjjhhvvhga wrote: post #131
AnIdiotOnTheNet wrote: post #114

Earlier quoted context omitted.

People apparently disagree, but I'm with you. The idea that antivirus software is actually a worthwhile mitigation tool is a relic from the 90s. Malware defeats antivirus all the time, and sometimes even exploits it directly. Meanwhile, aggressive antivirus software is eating a percentage of every single task you do on your computer, actively impeding your work every second of your day. The tradeoff is not worth it,…

Of course it's not worth it, but in many orgs it's required for compliance. It may change in the future as most people realize it's not that useful, just like NIST changed the rule about password updates. On the other hand, it might seem useless because malware creators know it's there. Basically all functional pieces of malware have to go through VirusTotal otherwise they won't be effective. But if all orgs dump ant…

Compliance for the sake of Compliance is just to protect ones ass and has nothing todo with security (aka no one gets fired for buying IBM)

Re: MS Windows Defender and DeCSS

#138

Post by arthur2e5 »

AnIdiotOnTheNet wrote: post #115
Santosh83 wrote: post #8

Do tech aware people like nearly everyone in this forum, need Defender (or another AV) to run at all? How many people here completely or partially stop it from running?

I will contend that antivirus is a net-positive to absolutely nobody. Not technically adept users, not office workers, not grandma, nobody. It slows down literally everything you do with your computer in the best case. In the worst case it breaks things and is itself an exploitation avenue. Mostly it just isn't actually very good at its job and malware defeats it regularly. This is a bad tradeoff and other mitigation…

Oh no, it certainly helps grandmas and the one-per-classroom public computers (China, 2008-). You get all the USB sticks coming in and out, and before you know it you get that one obnoxious virus that hides all folders and replaces them with a .exe of the same name.

And yeah they do boot from a readonly C: with some magic to make it appear writable per session. But re-infection is quick, especially when you have extra writable data partitions.

Re: MS Windows Defender and DeCSS

#139

Post by jakogut »

causi wrote: post #132
mszcz wrote: post #120

Earlier quoted context omitted.

Care to elaborate? I'm using Windows as a primary dev machine for years and I've encountered no problems aside from the infuriating update-related restarts. What am I missing? This is an actual, emotionless, genuine question? Always looking to find new ways to procrastinate by trying out new tools ;)

You don't use Windows Update Manager or timed firewall rules to make sure Update doesn't ever interfere with your work?

If your OS defaults to interrupting your work with its update policies, it's doing it wrong. Just because you can delay it doesn't make it acceptable.

Re: MS Windows Defender and DeCSS

#140

Post by nix23 »

ocdtrekkie wrote: post #109
gspr wrote: post #76

Earlier quoted context omitted.

I'd quit my job if work didn't let me be root on my work machine.

And anywhere with a good IT department would say "bye". From my experience, people with reasonable technical skills are the most likely people to defy IT policies, even without admin rights.

>people with reasonable technical skills are the most likely people to defy IT policies

Absolutely true...aka "i know computers since the C64 nothing bad will ever come from my machine...bumm ransomware...but my Antivirus never said anything"

Post reply on HN