Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MS Windows Defender and DeCSS

arch13.com

Post reply on HN
Print view View original

181–190 of 211 posts

Re: MS Windows Defender and DeCSS

#181

Post by naikrovek »

formerly_proven wrote: post #172
tomc1985 wrote: post #168

Earlier quoted context omitted.

Most of Windows itself is written in C/C++...

Yet Microsoft's tools for C/C++ don't hold up. Visual Studio is stuck in the early 2000s (and frankly the UX is horrendous), everything is packaged in weird GUI tools, the entire environment is practically hostile to automation. The VS debugger is probably one of the best pieces, everything else is simply outclassed. Debuggers have also been supplanted for many uses by other tools, of which Microsoft has few and all…

> Windows coping very badly with development workloads like reading/writing many small files (which is a design flaw in the NT kernel and will not be fixed, ever).

Not the kernel, but ntfs.sys. It is a design limitation of NTFS and was a tradeoff for something else. At the time NTFS was designed, high frequency reading and writing to small files was not at all common.

This does not exist on FAT/32/64 partitions, though there is always a per-file overhead on any filesystem, and FAT filesystems have their own problems.

IO performance tools don't seem to test reading and writing to a large number of small files; they tend to want a single large file and they test performance to and from that file. That's by design, and that means those tools don't find filesystem design limitations, or allow you to measure certain types of performance on a per-filesystem basis.

> Edit: It shouldn't be a surprise that Visual Studio is essentially abandoned by Microsoft.

Again, not true.

No one can know everything that MS is doing, of course, but the number of people who think they do is quite high. I am not referring to the person who made the comment I am replying to, by the way. Generally I just see a lot of things about MS or MS tools that are stated as fact and are entirely incorrect.

Re: MS Windows Defender and DeCSS

#182

Post by formerly_proven »

naikrovek wrote: post #181
formerly_proven wrote: post #172

Earlier quoted context omitted.

Yet Microsoft's tools for C/C++ don't hold up. Visual Studio is stuck in the early 2000s (and frankly the UX is horrendous), everything is packaged in weird GUI tools, the entire environment is practically hostile to automation. The VS debugger is probably one of the best pieces, everything else is simply outclassed. Debuggers have also been supplanted for many uses by other tools, of which Microsoft has few and all…

> Windows coping very badly with development workloads like reading/writing many small files (which is a design flaw in the NT kernel and will not be fixed, ever). Not the kernel, but ntfs.sys. It is a design limitation of NTFS and was a tradeoff for something else. At the time NTFS was designed, high frequency reading and writing to small files was not at all common. This does not exist on FAT/32/64 partitions, thou…

It's not (just) a NTFS problem, but larger design issues around the centralized object handling in NT, (intentional) lack of a caching VFS layer [1] and of course filter drivers (which are a public kernel API and enjoy a lot of use). There's a fairly lengthy explanation of these issues with Windows I/O somewhere on one of the WSL bug trackers.

> Again, not true. No one can know everything that MS is doing, ...

You're right of course - there is a number of releases yet to come. What I meant is that the focus is elsewhere (VS Code) and that the platform isn't going anywhere.

[1] In the design of typical unixen the file system is central and the kernel does a lot (central VFS, kernel resolves paths to inodes by itself if cached, in Linux the FS can even tell the kernel the extents of an inode to delegate that IO entirely etc.), while the NT design is a "generic tree of objects" (combined with "every action is an IRP, which can traverse any number of filters and such") where file systems are nothing really special; file system stuff is the file system's problem.

Re: MS Windows Defender and DeCSS

#183

Post by ASalazarMX »

Flow wrote: post #121
Fiahil wrote: post #52

I'm so happy to see a thread on Windows Defender, because my org recently switched antivirus software and I can't wait to tell you how bad it is ! There's a hidden feature in Defender, that will delight any user : it can turn your 15" MacBook Pro into a full breakfast machine. Want pancakes ? Start a zoom call. While you wait for your favorite video conference app to start, don't hope to finish your docker pull/save/…

Our company just switched from Symantec to Windows Defender and so far I'm very pleased. On my Windows laptop the fans were running more or less all the time when we had Symantec. With Defender the computer is nearly dead silent. When looking in Task Manager before, it seemed that Symantec used more CPU than even Visual Studio and related processes.

We had Symantec too, also switched to Windows Defender. Symantec was an awful piece of software for something that should be invisible until needed.

Re: MS Windows Defender and DeCSS

#184

Post by ASalazarMX »

nix23 wrote: post #77
dirkf wrote: post #75

Earlier quoted context omitted.

We even have McAfee on our Linux machines... And yes, doing a build is impacted by this...

Holy caracho!! I understand if you have it on a file-server (bad rep if you send a MS-Word-Macrovirus to a Customer) but on a linux build server?? That's just madness!

Depending on the use, the server could be immune to malware and still transmit it to their clients.

Re: MS Windows Defender and DeCSS

#185

Post by dreamlayers »

userbinator wrote: post #6

It's packed, which for some reason that tends to trigger a lot of AVs... although the fact that it's a packer from roughly 2 decades ago and one that any respectable AV should be able to easily unpack by now certainly doesn't inspire confidence. Then again, AVs detecting things as innocent as freshly-compiled "Hello World" programs is not new, and certainly makes one wonder just what exactly they are trying to detect…

I'm guessing that some virus signatures detect packers instead of unpacking the code and detecting malware code there.

Re: MS Windows Defender and DeCSS

#186

Post by marcosdumay »

mszcz wrote: post #176
marcosdumay wrote: post #144

Earlier quoted context omitted.

More specifically, Windows is an horrible environment for C, C++, or Rust, Haskell, or any kind of language where most developers do not like IDEs. Bad for Python, Ruby, PHP, Perl where IDEs do exist, but it's not a given that they are better than simple editors. Not really good for Javascript or any language with extensive use of dependencies and configuration. It's not better than Linux for any language, but it com…

Years ago I did some C++ development using Borland C++ Builder on Windows and couldn't find any problems or annoyances. I've been doing web dev (both front and backend) for a decade or so and can't really complain about anything really. Developing in JavaScript and dealing with node_modules/node_modules/node_... is platform agnostic problem I think ;) EDIT: What I like about developing on Windows is it's stability (u…

Yes, once there was a time when C++ was an IDE-oriented language.

I don't know if it was because the good IDE sellers went bankrupt or if it's the change that caused their failure, but it isn't anymore.

About the dependency tracking, Windows isn't good for dealing with lots of files. It's performance isn't great (but improved a lot recently), it has locking and time based inconsistencies, and it brings a load of helper tools (like anti-virus) that will assist you in destroying your file hierarchy. The same applies for holding a VCS repository.

About stability, you are the first person ever that I see claiming to prefer Windows instead of Linux for it. It's such an alien idea that I wonder what non-usual stuff you do with your computers.

Re: MS Windows Defender and DeCSS

#187

Post by jcrawfordor »

eurasiantiger wrote: post #58
jcrawfordor wrote: post #23

Earlier quoted context omitted.

The source code in question appears to have been obfuscated (possibly just for brevity). I'd guess the Defender signature in question was written around the packer/obfuscator.

Wanna bet the signature is the hex key?

yeah, that'd be my guess. It's going to be in different representations in the source and the executable but if I was writing a signature for it straight up I'd probably add the C escape representation as well for good measure.

Re: MS Windows Defender and DeCSS

#188

Post by alyandon »

IIRC, there is a group policy setting called "Turn off routine remediation" to stop defender from auto-removing stuff.

There is also a setting to permanently disable automatic sample reporting. I enabled that on all my Windows machines after the first time I caught Defender exfiltrating sensitive files like places.sqlite database out of my FF profile directory.

Re: MS Windows Defender and DeCSS

#189

Post by mszcz »

marcosdumay wrote: post #186
mszcz wrote: post #176

Earlier quoted context omitted.

Years ago I did some C++ development using Borland C++ Builder on Windows and couldn't find any problems or annoyances. I've been doing web dev (both front and backend) for a decade or so and can't really complain about anything really. Developing in JavaScript and dealing with node_modules/node_modules/node_... is platform agnostic problem I think ;) EDIT: What I like about developing on Windows is it's stability (u…

Yes, once there was a time when C++ was an IDE-oriented language. I don't know if it was because the good IDE sellers went bankrupt or if it's the change that caused their failure, but it isn't anymore. About the dependency tracking, Windows isn't good for dealing with lots of files. It's performance isn't great (but improved a lot recently), it has locking and time based inconsistencies, and it brings a load of help…

I actually do pretty mundane, boring stuff with computers - web dev, some finance & trading, lots of backend. It isn't all that exciting to an average person but I'm fine with it, it gives me pleasure to do it and I don't care what anybody says about it ;)

Again, genuine question, what instability do you imply there is in the Windows environment? Since Win 10 I don't recall ever being fucked by updates (again, not including mandatory restarts).

What I don't like about Windows is the configuration. On Linux I can just copy over the configs and scripts from another system and that's usually that. On Windows, out of necessity, I've made a lengthy checklist of things I need to do on a new Windows machine in order to set it up to my needs. It's a pain, but once that's done I rarely have to fidget with it.

I think that my preferences have to do with getting older. When I started I happily spent days configuring Linux Desktop, compiling Gentoo with just the right flags and didn't get so upset when apt-get dist-upgrade fucked up my system. Now, I just don't care that much. I just want things to work so I can do work I want.

Just one thing to be extra clear about - I use Windows as a daily driver desktop. I'd never ever use Windows as a server, ever. I've had that experience once, in college, and I'll never ever make that mistake again ;)

Re: MS Windows Defender and DeCSS

#190

Post by bob1029 »

Wowfunhappy wrote: post #106
bob1029 wrote: post #96

Maybe this is a good time to ask a dumb question.... how do yall disable windows defender? I spent a weekend on it last year and couldn't figure it out. Best I could surmise is that I need to wipe my hard drive and install a sketchy copy of "mad max edition" windows 10 enterprise, which I would have to download on TPB or some other Warez site.

To turn it off permanently, there's a registry entry: https://itty.bitty.site/#Disable_Real_Time_Protection_Perman... I'm not sure whether or not it works on non-pro versions of Windows.

This does not work anymore.

https://www.pcgamer.com/permanently-disabling-windows-10s-bu...

Post reply on HN