Why Developers Hate Antiviruses
blog.jitbit.com
Why Developers Hate Antiviruses
1–10 of 87 posts
Re: Why Developers Hate Antiviruses
#2I was expected the article to discuss how much the HDD on your machine thrashes (and the fans sound like a jet engine) from scanning every .class and .jar file on your machine, of which there are usually tens of thousands.
And I wish I had a Euro for every client site we've had to manage where some javascript scanner thinks it's so smart and drags the performance of a web-app to a crawl.
Re: Why Developers Hate Antiviruses
#3Hahahahaha. --> EVERY. FUCKING. WEEK.
Re: Why Developers Hate Antiviruses
#4Oh, and all your EXE-files will also be marked as viruses by the way (since you're most likely using a "self-executing-unpacker-code + data" architecture, which is considered a risk-factor by most antiviruses, no idea why).
Because most malware does this exact thing to obfuscate its payload. Here's a good example of the relative entropy distribution of malware executables versus non-malware executables on page 26 and 27: http://www.virusbtn.com/pdf/conference_slides/2007/CaseyShee...
Re: Why Developers Hate Antiviruses
#5Is there really a reason to even run anti-virus software all the time as long as you don't try to open executables and macro-containing documents that didn't come from a reputable source?
Re: Why Developers Hate Antiviruses
#6The business of antivirus, especially, has a huge incentive to shove it IN YOUR FACE that the software is detecting things whether they're false positives or not. This scares people into re-upping their subscription. Most computer users don't understand there can even be such a thing as false positive. For all those support calls you get, there are probably 10x that number that simply take the security software on its word and let it delete/block your application.
An aptly timed popup from the antivirus vendor will appear shortly thereafter asking the user to pre-purchase 2 more years of complete computer protection! Oh, the business of fear mongering. . .
EDIT: This is one of those very hard problems startups should be solving.
Re: Why Developers Hate Antiviruses
#7The business of antivirus, especially, has a huge incentive to shove it IN YOUR FACE that the software is detecting things whether they're false positives or not. This scares people into re-upping their subscription. Most computer users don't understand there can even be such a thing as false positive. For all those support calls you get, there are probably 10x that number that simply take the security software on it…
It's flat out wrong of you to say that antivirus companies don't care about FP's.
There are over 25k new malware samples coming out daily, and everybody is just trying to cut through them as fast and efficiently as possible. Yes there are innocent casualties of this -- False positives -- but these are sincere mistakes .
False positives are very embarrassing for the security company. It is something that can even cause people their jobs. Don't you think for a second that these are not looked at.
I make malware definitions for a living, and you can trust me when I say that I check the FP reports first thing every morning, several times during the work day, & I check our forums every night at home to make sure we don't have any FP's rolling in.
At most security software companies, FP's taken very seriously & I know that personally I would love to be able to educate Indie developers about what triggers detections and ways we can both work together to reduce them. It's easier said then done, however, and also it is delicate info that you don't really want to yell off the rooftops - because malware creators could really use the same info to their advantage.
Re: Why Developers Hate Antiviruses
#8Is there really a reason to even run anti-virus software all the time as long as you don't try to open executables and macro-containing documents that didn't come from a reputable source?
No, because if you visit a site that successfully exploits an unpatched vulnerability in your browser (or plugins) that allows for remote code execution, you WILL be infected. I'd label myself extremely savvy and I've been hit by what I think were ads loading a Java applet that somehow broke out of the JRE and ran an executable.
Re: Why Developers Hate Antiviruses
#9Excellent timing. I just alt+tabbed away from writing an email to McAfee because one of my users sent me a screenshot of s3stat.com with a bright red "Dangerous Site Warning" from McAfee's SiteAdvisor.
Evidently, "We tested this site and found it very risky". Even though it's the public site for a 5-year-established (and popular) SaaS product. Even though it has no downloadable executables of any description. Even though it has no non-moderated user-generated content.
But it's got this: http://www.siteadvisor.com/sites/www.s3stat.com
... which is a page saying that their automated somethingorother scraped the internet and decided that my site is crazy dangerous, listing reasons such as... well, nothing actually. But look at it. It's RED! Must be bad.
So even if you don't actually write software that could possibly contain viruses, you can still end up on the wrong side of the antivirus companies.
nice.
Re: Why Developers Hate Antiviruses
#10Is there really a reason to even run anti-virus software all the time as long as you don't try to open executables and macro-containing documents that didn't come from a reputable source?
No, because if you visit a site that successfully exploits an unpatched vulnerability in your browser (or plugins) that allows for remote code execution, you WILL be infected. I'd label myself extremely savvy and I've been hit by what I think were ads loading a Java applet that somehow broke out of the JRE and ran an executable.
This. The days of needing to allow or execute malicious executables has passed. Drive-by downloads are extremely common, they use a vulnerability - and bam they can download whatever they want to your PC -- which in turn, will download more stuff.