Tldr: Netflix is dumping old antivirus for new antivirus
Netflix Is Dumping Anti-Virus, Presages Death of an Industry
11–20 of 75 posts
Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry
#12In general anti-virus is more useful for less educated users. For example, I'd never escalate (sudo, UAC, etc.) a process that I wouldn't expect to need the escalation. This severely limits the control a virus can take (stopping most in their tracks). The only people who really need AV are the type of idiots who run as root, or turn off UAC. The real concern are advanced worms. Most of these would likely infect a mac…
Many, many security patches are way late. AV software is nice when a vendor can't be bothered to update their software.
Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry
#13I guess we're going to debate the merits of statements in a thinly-veiled bit of PR now? There's almost no news about this company until about a month ago (http://www.networkworld.com/article/2955017/security/endpoin...).
They recently hired a new PR company (http://www.mgpr.info/) who's been spamming articles to Reuters on SentinelOne's behalf (https://www.google.com/?gws_rd=ssl#q=site:reuters.com+sentin...), and then reaching out to hacks to write submarine articles (http://paulgraham.com/submarine.html) about the death of anti-virus -- which just happens to be the marketing lede of SentinelOne's endpoint protection product.
Then they landed a big contract with Netflix and got a sucker at Forbes to write some PR like it was news, and now it's been picked up by HN and being discussed as though it had some substance.
Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry
#14I wonder how the equivalence is shown for the certification. Do they use something similar to bioequivalence tests (TOST etc.) over the mean number if infections/issues detected?
Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry
#15I guess we're going to debate the merits of statements in a thinly-veiled bit of PR now? There's almost no news about this company until about a month ago ( http://www.networkworld.com/article/2955017/security/endpoin... ). They recently hired a new PR company ( http://www.mgpr.info/ ) who's been spamming articles to Reuters on SentinelOne's behalf ( https://www.google.com/?gws_rd=ssl#q=site:reuters.com+sentin... ),…
Good thing is, people will Google for SentinelOne, find this thread, read the comments and learn a bit what HN thinks about it...
Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry
#16The real question is why Netflix needs anti-virus at all. Whether it be the old signature style or the new (as of about 2002) heuristic analysis style. Presumably they're turning off UAC, giving out admin privs to everyone, disabling automatic updates, and hiring delinquents that run every .exe email attachment?
Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry
#17Anti-virus software is a scourge that I'd be happy to see disappear. For the most part, its business model is to prey on the ignorant - I can't even count how many times I've been asked why a computer is running slowly, only to discover that there are three or more competing anti-virus products running, every one of them hooked into every single file read or write. Just yesterday I had to turn off Windows Defender real-time scanning, because it had gone out to lunch and leaked memory to the tune of 2.1 GB. Hot garbage.
It seems like the popular thing lately is to bitch and moan and question the morality of using ad-blockers, but using an ad-blocker is the single most important thing you can do to improve security on your machine for the average user. Blocking Flash, or, should you happen to still encounter it, Java, from autoplaying comes in second. Blacklisting SourceForge in your hosts file might be up there, if they are still bundling crapware with the few legitimate downloads that haven't moved elsewhere.
Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry
#18A more nuanced title would be: " To continue its fight against new viruses, Netflix is dumping classical disk-scanning-fingerprints software for newer technologies such as statistical analysis of anomalies. " Netflix and whoever they hire (e.g. SentinelOne) is still fighting viruses . They're just doing it using more sophisticated algorithms instead of fingerprints. Traditional anti-virus software trying to match fil…
PCI-DSS applies to Netflix very much, they probably still will have traditional AV in their CHD environment and any other system in scope of the certification (e.g. the desktops the sysadmins use to administer servers within the CHD environment).
Also the PCI council doesn't define which AV is compliant or not, only states that you need anti-virus protection on all systems commonly affected by malicious software.
It's up to the QSA and acquirer(if that one gets really bored) to accept the solution, neither of which care really. You can use Windows Defender, Clam or the most super duper expensive AV out there it's all the same for them.
The requirement is also worded very carefully "on all systems commonly affected by malicious software" so people could make a case against installing AV on things that AV solutions are not common for, such as Mac's, Linux box's, and even Mainframes (yes there are mainframes in certain PCI-DSS scope's because the QSA wasn't smart enough to find a loop hole to keep it out of scope or the costumer is dumb enough to actually process or store credit cards on it).
Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry
#19In general anti-virus is more useful for less educated users. For example, I'd never escalate (sudo, UAC, etc.) a process that I wouldn't expect to need the escalation. This severely limits the control a virus can take (stopping most in their tracks). The only people who really need AV are the type of idiots who run as root, or turn off UAC. The real concern are advanced worms. Most of these would likely infect a mac…
Many, many security patches are way late. AV software is nice when a vendor can't be bothered to update their software.
> Many, many security patches are way late.
My main point was: a virus that uses a 0-day (or unpatched/unfixed 0-day) is likely going to cause problems for an AV:
> AVs, typically, would struggle to catch an e.g. malicious BIOS flash resulting from an escalation vulnerability.
Over-exaggerating to clarify: AVs are like bringing a knife to a gunfight. You might just be actually able to eliminate the weaker opponents (who also brought knives), but you're going nowhere against the veterans.
Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry
#20Earlier quoted context omitted.
Many, many security patches are way late. AV software is nice when a vendor can't be bothered to update their software.
> Many, many security patches are way late. My main point was: a virus that uses a 0-day (or unpatched/unfixed 0-day) is likely going to cause problems for an AV: > AVs, typically, would struggle to catch an e.g. malicious BIOS flash resulting from an escalation vulnerability. Over-exaggerating to clarify: AVs are like bringing a knife to a gunfight. You might just be actually able to eliminate the weaker opponents (…
It takes about 5min to refactor the code of existing malware to avoid detection, heck playing around with compiler settings is enough in many cases.
I've recompiled Netcat probably 200 times by now, small refactoring playing with compiler flags (compile with x64 profile, debug on, add some symbols etc..) and every time it avoids every AV out there.
I usually use Virustotal which means that it will be short lived but i can do it over and over and over again ;)