Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arrogant Anti-virus Doesn't Appreciate Your Choices

rants.effu.se

Post reply on HN
Print view View original

21–30 of 37 posts

Re: Arrogant Anti-virus Doesn't Appreciate Your Choices

#21

Post by nolok »

justinschuh wrote: post #17

AV software bothers me so much. It's not just that it's generally ineffective. It's that when you bother dissecting it, you usually find it make users less safe (e.g. non ASLR/NX injected binaries, dangerous root certs, vulnerable hooks and format handlers, etc.). That said, Avast has caused me unique pain, and my personal experience correlates with the author's. Chrome's sandbox blocks all access to system resources…

Microsoft Security Essentials does so much right. When they put their mind into it, Microsoft really does great software.

Re: Arrogant Anti-virus Doesn't Appreciate Your Choices

#22

Post by ambrop7 »

nolok wrote: post #21
justinschuh wrote: post #17

AV software bothers me so much. It's not just that it's generally ineffective. It's that when you bother dissecting it, you usually find it make users less safe (e.g. non ASLR/NX injected binaries, dangerous root certs, vulnerable hooks and format handlers, etc.). That said, Avast has caused me unique pain, and my personal experience correlates with the author's. Chrome's sandbox blocks all access to system resources…

Microsoft Security Essentials does so much right. When they put their mind into it, Microsoft really does great software.

You have to take into account that Microsoft can modify their own OS and implement what needs to be done in a proper way. On the other hand, third-party vendors can only use the public interfaces exposed by the OS, or resort to unreliable and/or undocumented methods that may break at any time.

There probably is no solution to that, any third-party software that needs tights integration with the OS is going to have that problem.

Re: Arrogant Anti-virus Doesn't Appreciate Your Choices

#23

Post by nolok »

ambrop7 wrote: post #22
nolok wrote: post #21

Earlier quoted context omitted.

Microsoft Security Essentials does so much right. When they put their mind into it, Microsoft really does great software.

You have to take into account that Microsoft can modify their own OS and implement what needs to be done in a proper way. On the other hand, third-party vendors can only use the public interfaces exposed by the OS, or resort to unreliable and/or undocumented methods that may break at any time. There probably is no solution to that, any third-party software that needs tights integration with the OS is going to have th…

MSE for windows XP had no associated patch or service pack, was using the same api as every other AV out there, and was about a thousand time better.

One could argue Microsoft doesn't need to turn a profit so they can afford to be less intrusive, but the truth is that I would pay for MSE. I wouldn't pay for any of the others.

Re: Arrogant Anti-virus Doesn't Appreciate Your Choices

#24

Post by revelation »

I don't get it. You use an Anti-Virus software to protect you from threats, a common threat vector is email, so the software scans emails to detect such threats. All consideration of how well that actually works aside, it's doing exactly what you wanted it to do.

The software needs elevated privileges to do that, and you granted them. You have given it the keys to the castle and now you complain it's using them to install an extra certificate? That might come as a shocker to you, but all security is compromised if the system ensuring it is. They don't have to install that certificate; they can patch software and APIs all day and it wouldn't show up in any fancy GUI. You don't have to break the crypto or MITM it if you have exclusive control over the software performing it. Nobody tries to break disk encryption; they sneak into your room and replace the TrueCrypt bootloader on your laptop with one that looks the same but phishes the password.

Re: Arrogant Anti-virus Doesn't Appreciate Your Choices

#25

Post by eli »

RyanZAG wrote: post #2

It's unfortunate that more people don't understand just how serious a breach it is to install special root certificates. This actually does a complete home run around the entirety of web-based security. It's very close to having every physical lock sold by a company having a special key that can open all of the locks they sell. Even if you trust that company to buy your lock from them, it's going much too far in allo…

Sure, if you don't trust your AV. But if you don't trust your AV, you've already got problems.

Re: Arrogant Anti-virus Doesn't Appreciate Your Choices

#26

Post by simonh »

nolok wrote: post #21
justinschuh wrote: post #17

AV software bothers me so much. It's not just that it's generally ineffective. It's that when you bother dissecting it, you usually find it make users less safe (e.g. non ASLR/NX injected binaries, dangerous root certs, vulnerable hooks and format handlers, etc.). That said, Avast has caused me unique pain, and my personal experience correlates with the author's. Chrome's sandbox blocks all access to system resources…

Microsoft Security Essentials does so much right. When they put their mind into it, Microsoft really does great software.

So true, every third party AV I've installed on Windows has been a pain in the arse, but MSE just works.

It's a crazy mixed up world in which they're actually afraid to ship MSE with the OS, because a third party application industry relies on the default OS release to be insecure.

Edit: I didn't realise MSE was included in Win8.

Re: Arrogant Anti-virus Doesn't Appreciate Your Choices

#27

Post by T-hawk »

nolok wrote: post #23
ambrop7 wrote: post #22

Earlier quoted context omitted.

You have to take into account that Microsoft can modify their own OS and implement what needs to be done in a proper way. On the other hand, third-party vendors can only use the public interfaces exposed by the OS, or resort to unreliable and/or undocumented methods that may break at any time. There probably is no solution to that, any third-party software that needs tights integration with the OS is going to have th…

MSE for windows XP had no associated patch or service pack, was using the same api as every other AV out there, and was about a thousand time better. One could argue Microsoft doesn't need to turn a profit so they can afford to be less intrusive, but the truth is that I would pay for MSE. I wouldn't pay for any of the others.

That argument is indeed the core of it. Every other antivirus needs to be in your face constantly so you think you're getting value out of the purchase. They all suffer from the "this rock keeps tigers away" problem, that their enemy shows up too infrequently to justify their own existence. So they need to noisily invent enemies.

MSE's existence makes a ton of sense when you realize the reason for its creation. It was developed to reduce Microsoft's own support workload, as a significant proportion of Windows support tickets are caused by both malware and belligerent antimalware. MSE justifies its existence by reducing OS support costs rather than by annoying users into paying for antivirus. So Microsoft's incentive is simply to have users use MSE, which is nicely aligned with delivering a clean quiet positive user experience.

Re: Arrogant Anti-virus Doesn't Appreciate Your Choices

#28

Post by lambada »

revelation wrote: post #24

I don't get it. You use an Anti-Virus software to protect you from threats, a common threat vector is email, so the software scans emails to detect such threats. All consideration of how well that actually works aside, it's doing exactly what you wanted it to do . The software needs elevated privileges to do that, and you granted them. You have given it the keys to the castle and now you complain it's using them to i…

You're missing the point. The author can understand it doing these things by default. But it appears to be regularly loosing / ignoring his opt-out.

Something with full privileges, ignoring your specified preferences? That's far worse than something that has them by default but allows you to change it.

Re: Arrogant Anti-virus Doesn't Appreciate Your Choices

#29

Post by criley »

nolok wrote: post #23
ambrop7 wrote: post #22

Earlier quoted context omitted.

You have to take into account that Microsoft can modify their own OS and implement what needs to be done in a proper way. On the other hand, third-party vendors can only use the public interfaces exposed by the OS, or resort to unreliable and/or undocumented methods that may break at any time. There probably is no solution to that, any third-party software that needs tights integration with the OS is going to have th…

MSE for windows XP had no associated patch or service pack, was using the same api as every other AV out there, and was about a thousand time better. One could argue Microsoft doesn't need to turn a profit so they can afford to be less intrusive, but the truth is that I would pay for MSE. I wouldn't pay for any of the others.

a thousand times better

I was under the impression that MSE routinely did OK in AV benchmarks and rarely even ever held the top spot. How is it a thousand times better?

Or does it's ability to keep you safe not really factor into your analysis of the software?

Re: Arrogant Anti-virus Doesn't Appreciate Your Choices

#30

Post by nolok »

criley wrote: post #29
nolok wrote: post #23

Earlier quoted context omitted.

MSE for windows XP had no associated patch or service pack, was using the same api as every other AV out there, and was about a thousand time better. One could argue Microsoft doesn't need to turn a profit so they can afford to be less intrusive, but the truth is that I would pay for MSE. I wouldn't pay for any of the others.

a thousand times better I was under the impression that MSE routinely did OK in AV benchmarks and rarely even ever held the top spot. How is it a thousand times better? Or does it's ability to keep you safe not really factor into your analysis of the software?

To be honest with you, my point of view is that no antivirus is going to protect me 100%, I always have to care about what I open, where it's coming from, ...

What I want from my AV then, is to catch the most obvious (and thus numerous) ones, and do so in a way that doesn't bother me. MSE just doesn't get in the way. It updates silently. It scans silently. It detects silently, ask you for something but take the safe course by default. You are in a full screen app ? It doesn't crash everything trying to take control, it just deals with the threat and show a red icon in the tray.

It doesn't make my computer safer than the other, but it makes me lose way less time when it does its job.

Post reply on HN