Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Developers Hate Antiviruses

blog.jitbit.com

Post reply on HN
Print view View original

41–50 of 87 posts

Re: Why Developers Hate Antiviruses

#41

Post by tadfisher »

bwarp wrote: post #39
finnw wrote: post #32

Earlier quoted context omitted.

The only trouble I've ever had with MSE is that if you edit your hosts file to block the Facebook "like" button, MSE will pop up a warning and delete the www.facebook.com entry.

That's MSE thinking that something has modified the hosts file and resetting it. I'd go for an ad blocker rather than a hosts file hack. Adblock plus works fine on Firefox and Chrome. There are TPL subscriptions for IE that block everything (google around for them).

Privoxy works everywhere a proxy will, and can use Adblock filter lists.

Re: Why Developers Hate Antiviruses

#42

Post by joering2 »

jconley wrote: post #6

The business of antivirus, especially, has a huge incentive to shove it IN YOUR FACE that the software is detecting things whether they're false positives or not. This scares people into re-upping their subscription. Most computer users don't understand there can even be such a thing as false positive. For all those support calls you get, there are probably 10x that number that simply take the security software on it…

"Oh, the business of fear mongering."

couldnt agree more. I am using PC with XP/7 for years now and never had a virus. I go online into some questionable websites and downloads sometimes but if user uses a common sense, he wont open that AllPrinterDrivers.exe from unknown source just to install drivers to his printer.

I never needed and I think I never will need an AV.

Re: Why Developers Hate Antiviruses

#43

Post by learc83 »

When I worked at Geek Squad during college, we used to joke that Norton Internet Security had decided the internet was too dangerous and automatically disabled it.

You have no idead how many internet connection problems I solved with the Norton removal tool.

Re: Why Developers Hate Antiviruses

#44

Post by pnathan »

jgmmo wrote: post #7
jconley wrote: post #6

The business of antivirus, especially, has a huge incentive to shove it IN YOUR FACE that the software is detecting things whether they're false positives or not. This scares people into re-upping their subscription. Most computer users don't understand there can even be such a thing as false positive. For all those support calls you get, there are probably 10x that number that simply take the security software on it…

It's flat out wrong of you to say that antivirus companies don't care about FP's. There are over 25k new malware samples coming out daily, and everybody is just trying to cut through them as fast and efficiently as possible. Yes there are innocent casualties of this -- False positives -- but these are sincere mistakes . False positives are very embarrassing for the security company. It is something that can even caus…

I wrote a Windows program for my dad about a year ago. It would have worked great. I was thinking about selling it, actually!

Except, the antivirus flagged it. I called the AV vendor and they (probably the first-line tech support) said unless that my dad called the vendor, they could do nothing.

The only false positive that might be remotely reasonable is my executable name is identical to a virus. rte.exe or something similar, as I recall. Whatever. A binary difference should have demonstrated substantial difference between my exe and the virus.

So, my dad didn't get his program, and I got left with a renewed awareness that AV vendors are ruinously unhelpful, and I'd rather work on moving my family and friends to Linux or OSX.

Re: Why Developers Hate Antiviruses

#45

Post by Nelson69 »

I see this a couple ways. If you pull binaries off the internet, it's hard to say you can just ignore it and don't need any protection. That is exactly the kind of thinking that got us to where we are with malware in the first place. I just can't see a downside to scanning your system once a week after hours or something like that; most of the time it will find nothing but if it ever finds anything it's probably worth it.

Then I look at the products out there, there are a lot of them and they all seem terrible. We've got giant computers compared to 10 years ago and this software still takes them to their knees at times and you just want the crap to be invisible. In part I think it has to do with the all encompassing "security suite" concept where they try to be all things to all people. It does seem ripe for some disruption.

I mean, like maybe using some virtualization software to have multiple "zones" or something, trusted, suspect and untrusted and some clever reverting and snap-shotting to let you run programs in untrusted environments fairly seamlessly or something. Scan it with some uberscanner and then promote it to trusted. Or something, the OS vendors will have to help and MS has created an AV cesspool.

Re: Why Developers Hate Antiviruses

#47

Post by freehunter »

jasonkester wrote: post #9

Excellent timing. I just alt+tabbed away from writing an email to McAfee because one of my users sent me a screenshot of s3stat.com with a bright red "Dangerous Site Warning" from McAfee's SiteAdvisor. Evidently, "We tested this site and found it very risky". Even though it's the public site for a 5-year-established (and popular) SaaS product. Even though it has no downloadable executables of any description. Even th…

I work in information security for a company who uses McAfee products, and I share your irritation. It can be quite a chore to track down why WebWasher is blocking a site or why our SIEM has flagged a site as a botnet C&C or otherwise risky site.

It doesn't help when we get business groups or developers saying "we need this site unblocked in order to see a 1pm webinar!" and it's 12:59. Site Advisor is useless.

Re: Why Developers Hate Antiviruses

#48

Post by gus_massa »

jconley wrote: post #6

The business of antivirus, especially, has a huge incentive to shove it IN YOUR FACE that the software is detecting things whether they're false positives or not. This scares people into re-upping their subscription. Most computer users don't understand there can even be such a thing as false positive. For all those support calls you get, there are probably 10x that number that simply take the security software on it…

A false positive is very bad for the AV Company if the file is part of the OS of a lot of computes. For example;

AVG update bricks Windows 7 (Dec 2010): http://www.theregister.co.uk/2010/12/02/avg_auto_immune_upda...

McAfee update shutting down XP machines (Apr 2010): http://www.engadget.com/2010/04/21/mcafee-update--shutting-d...

Re: Why Developers Hate Antiviruses

#49

Post by freehunter »

joering2 wrote: post #42
jconley wrote: post #6

The business of antivirus, especially, has a huge incentive to shove it IN YOUR FACE that the software is detecting things whether they're false positives or not. This scares people into re-upping their subscription. Most computer users don't understand there can even be such a thing as false positive. For all those support calls you get, there are probably 10x that number that simply take the security software on it…

"Oh, the business of fear mongering." couldnt agree more. I am using PC with XP/7 for years now and never had a virus. I go online into some questionable websites and downloads sometimes but if user uses a common sense, he wont open that AllPrinterDrivers.exe from unknown source just to install drivers to his printer. I never needed and I think I never will need an AV.

Until you get hit with a zero-day browser exploit that doesn't need you to install an exe to run.

Re: Why Developers Hate Antiviruses

#50

Post by jff »

pnathan wrote: post #44
jgmmo wrote: post #7

Earlier quoted context omitted.

It's flat out wrong of you to say that antivirus companies don't care about FP's. There are over 25k new malware samples coming out daily, and everybody is just trying to cut through them as fast and efficiently as possible. Yes there are innocent casualties of this -- False positives -- but these are sincere mistakes . False positives are very embarrassing for the security company. It is something that can even caus…

I wrote a Windows program for my dad about a year ago. It would have worked great. I was thinking about selling it, actually! Except, the antivirus flagged it. I called the AV vendor and they (probably the first-line tech support) said unless that my dad called the vendor, they could do nothing . The only false positive that might be remotely reasonable is my executable name is identical to a virus. rte.exe or someth…

So you spent the time to write a program, one good enough to consider selling it even, but couldn't be bothered to try changing the executable name? Or ask your dad to call the AV vendor?

Am I mis-reading you?

Post reply on HN