Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Developers Hate Antiviruses

blog.jitbit.com

Post reply on HN
Print view View original

31–40 of 87 posts

Re: Why Developers Hate Antiviruses

#31

Post by finnw »

InclinedPlane wrote: post #17
AdamTReineke wrote: post #8

Earlier quoted context omitted.

No, because if you visit a site that successfully exploits an unpatched vulnerability in your browser (or plugins) that allows for remote code execution, you WILL be infected. I'd label myself extremely savvy and I've been hit by what I think were ads loading a Java applet that somehow broke out of the JRE and ran an executable.

I always turn off Java on the browsers I use. It's a HUGE security hole that allows for drive-by infections and the cost of not having java applet support is something I can very much live with.

> It's a HUGE security hole

That's not entirely accurate. Most vulnerabilities do get patched quickly.

It's still not worth enabling it in your browser though, because so few sites use it.

Re: Why Developers Hate Antiviruses

#32

Post by finnw »

bwarp wrote: post #20

I've come to the conclusion that AV software gets more attrocious the more you pay for it or the more it requires advertising every 5 minutes on television. They push it on you via scaremongering every day at least once. HOWEVER, I've been using Microsoft's free security essentials package for Windows 7 for about 2 years. It never pokes you in the eye, never lets a single thing through and doesn't screw your system r…

The only trouble I've ever had with MSE is that if you edit your hosts file to block the Facebook "like" button, MSE will pop up a warning and delete the www.facebook.com entry.

Re: Why Developers Hate Antiviruses

#33

Post by malkia »

On Windows one can compile a DLL or EXE in such way that you can overwrite the executable while it's still running.

With the Microsoft Linker this is achieved by adding /SWAPRUN:CD,NET - it means that the image might be running of CD-ROM or Network - and both can lose media connection, so copy the image in memory beforehand.

This could be useful, only if it wasn't for certain Anti-viruses that treat a lot of my executables as viruses once any of these two flags are on (CD, NET or both).

You can actually edit the flags on existing executable, using EDITBIN (or LINK /edit - it's the same - linker is a bit like "busybox" here).

Another reason is that the antivirus we currently have installed at work slows down copying off the shared network. And because it's off the network, the antivirus has to check it everytime (unlike HDD, where it can keep some cache of what was checked).

Re: Why Developers Hate Antiviruses

#34

Post by Dylan16807 »

dangrossman wrote: post #11
bkyan wrote: post #5

Is there really a reason to even run anti-virus software all the time as long as you don't try to open executables and macro-containing documents that didn't come from a reputable source?

Yes, because you don't even have to be using the computer to acquire new malware -- if Windows isn't patched and you don't have a properly configured firewall in front of the system. Simply browsing the web with fully patched Windows behind a firewall is a risk as well. Among other things, I review orders for an advertising service, 20-30 a day. Some of these orders are purposely placed to advertise sites with malici…

So once a month something gets past the antivirus. How often does the antivirus block (not notice something that wouldn't work on your system, block) malware?

Re: Why Developers Hate Antiviruses

#35

Post by kijin »

finnw wrote: post #32
bwarp wrote: post #20

I've come to the conclusion that AV software gets more attrocious the more you pay for it or the more it requires advertising every 5 minutes on television. They push it on you via scaremongering every day at least once. HOWEVER, I've been using Microsoft's free security essentials package for Windows 7 for about 2 years. It never pokes you in the eye, never lets a single thing through and doesn't screw your system r…

The only trouble I've ever had with MSE is that if you edit your hosts file to block the Facebook "like" button, MSE will pop up a warning and delete the www.facebook.com entry.

I've had this happen, too. But after the first time I told MSE that it was a false positive, it never bothered me again about the hosts file. Good doggy.

Re: Why Developers Hate Antiviruses

#36

Post by dangrossman »

Dylan16807 wrote: post #34
dangrossman wrote: post #11

Earlier quoted context omitted.

Yes, because you don't even have to be using the computer to acquire new malware -- if Windows isn't patched and you don't have a properly configured firewall in front of the system. Simply browsing the web with fully patched Windows behind a firewall is a risk as well. Among other things, I review orders for an advertising service, 20-30 a day. Some of these orders are purposely placed to advertise sites with malici…

So once a month something gets past the antivirus. How often does the antivirus block (not notice something that wouldn't work on your system, block) malware?

If I had to estimate, at least 95% of the website malware gets caught by MSE. This is a typical day reviewing new ad placements: http://i.imgur.com/gvtY9.png

Re: Why Developers Hate Antiviruses

#37

Post by kgo »

danudey wrote: post #19
dangrossman wrote: post #11

Earlier quoted context omitted.

Yes, because you don't even have to be using the computer to acquire new malware -- if Windows isn't patched and you don't have a properly configured firewall in front of the system. Simply browsing the web with fully patched Windows behind a firewall is a risk as well. Among other things, I review orders for an advertising service, 20-30 a day. Some of these orders are purposely placed to advertise sites with malici…

I knew a university professor who was installing Windows XP onto a workstation that was connected to the university network. The machine ended up infected with Blaster before he'd even finished the installation.

Heh, I worked in big oil at the time, and they couldn't kill blaster because IT people kept on imaging new computers on internally exposed networks. We probably could have killed the outbreak a week or two earlier if everyone just stopped imaging for a day.

Re: Why Developers Hate Antiviruses

#38

Post by kijin »

johngalt wrote: post #29

IT guy here: Anti-virus tools are a net loss, but we can't remove them without appearing to be irresponsible.

Microsoft Security Essentials is a nice compromise if you need to appear responsible to individuals and small businesses. It gets the job done, and it's only minimally intrusive. It also comes from a company that most people tend to trust.

Norton, on the other hand, is pure evil. If Microsoft bundled Security Essentials with Windows and thereby pushed all those pathetic AV vendors out of business (just like they did with web browsers), I might turn a blind eye this time and call it the lesser of two evils.

Re: Why Developers Hate Antiviruses

#39

Post by bwarp »

finnw wrote: post #32
bwarp wrote: post #20

I've come to the conclusion that AV software gets more attrocious the more you pay for it or the more it requires advertising every 5 minutes on television. They push it on you via scaremongering every day at least once. HOWEVER, I've been using Microsoft's free security essentials package for Windows 7 for about 2 years. It never pokes you in the eye, never lets a single thing through and doesn't screw your system r…

The only trouble I've ever had with MSE is that if you edit your hosts file to block the Facebook "like" button, MSE will pop up a warning and delete the www.facebook.com entry.

That's MSE thinking that something has modified the hosts file and resetting it.

I'd go for an ad blocker rather than a hosts file hack.

Adblock plus works fine on Firefox and Chrome. There are TPL subscriptions for IE that block everything (google around for them).

Re: Why Developers Hate Antiviruses

#40

Post by bad_user »

johngalt wrote: post #29

IT guy here: Anti-virus tools are a net loss, but we can't remove them without appearing to be irresponsible.

Sure you can.

Replace it with a simple app that randomly shows fake notifications for threats, with a clickable button called "remove threat" that doesn't do anything. Upon clicking, show some stats on how many fake threats were dodged.

(1) you won't be seen as irresponsible anymore

(2) since users will constantly receive threat warnings, they'll be more careful than usual, improving security

Post reply on HN