Why Developers Hate Antiviruses • Hacker News Board

Re: Why Developers Hate Antiviruses

#11

Post by dangrossman » Wed, Jan 25, 2012, 7:54 PM UTC

bkyan wrote: post #5

Is there really a reason to even run anti-virus software all the time as long as you don't try to open executables and macro-containing documents that didn't come from a reputable source?

Yes, because you don't even have to be using the computer to acquire new malware -- if Windows isn't patched and you don't have a properly configured firewall in front of the system. Simply browsing the web with fully patched Windows behind a firewall is a risk as well.

Among other things, I review orders for an advertising service, 20-30 a day. Some of these orders are purposely placed to advertise sites with malicious code that installs malware. My fully patched Windows 7 system behind a firewall, running antivirus and the latest Google Chrome, gets infected with something or other on a regular basis -- at least once a month -- without me ever downloading any files.

Last week it was one of those fake antivirus programs that terminates all your real antivirus programs and pops up a window saying you're infected and need to upgrade for $29.99 every 20 seconds.

That one was probably a Java plugin vulnerability.

Re: Why Developers Hate Antiviruses

#12

Post by phzbOx » Wed, Jan 25, 2012, 7:56 PM UTC

For me it's not so much that it's not always accurate but more than it always make my computer soooo slow. And also, that I don't believe in antivirus.. Precaution is everything; One you've got the virus, unless it's a trivial or unoffensive one, better to format.

Re: Why Developers Hate Antiviruses

#13

Post by jconley » Wed, Jan 25, 2012, 8:06 PM UTC

jgmmo wrote: post #7

jconley wrote: post #6

The business of antivirus, especially, has a huge incentive to shove it IN YOUR FACE that the software is detecting things whether they're false positives or not. This scares people into re-upping their subscription. Most computer users don't understand there can even be such a thing as false positive. For all those support calls you get, there are probably 10x that number that simply take the security software on it…

It's flat out wrong of you to say that antivirus companies don't care about FP's. There are over 25k new malware samples coming out daily, and everybody is just trying to cut through them as fast and efficiently as possible. Yes there are innocent casualties of this -- False positives -- but these are sincere mistakes . False positives are very embarrassing for the security company. It is something that can even caus…

I didn't say the industry doesn't care. But, the business model relies on detecting as much as possible and shoving that in your face to get more bookings. I have no doubt you take false positives very seriously at an engineering level.

However, the bottom line impact of a false positive on some indie software has to be negligible.

Re: Why Developers Hate Antiviruses

#14

Post by naner » Wed, Jan 25, 2012, 8:22 PM UTC

Oh, man. I use Linux for my day job but keep a Windows 7 install should the need arise. An old friend sent me a link to try out a video game he and a buddy made in college. I downloaded the program, Norton deletes it immediately. It didn't recognize the application signature. (Actually, it recognized it but it wasn't popular enough -- about 100 people had apparently downloaded this game that also used Norton.) After dicking around with Norton for about 30 minutes (nearly drowning in a sea of check boxes and vaguely titled program options), and reaching the boundaries of my Google-fu I just gave up and removed Norton.

Problem solved.

I'm glad I'm not a startup or small company trying to ship Windows executables.

Re: Why Developers Hate Antiviruses

#15

Post by icehawk » Wed, Jan 25, 2012, 8:22 PM UTC

jgmmo wrote: post #7

jconley wrote: post #6

The business of antivirus, especially, has a huge incentive to shove it IN YOUR FACE that the software is detecting things whether they're false positives or not. This scares people into re-upping their subscription. Most computer users don't understand there can even be such a thing as false positive. For all those support calls you get, there are probably 10x that number that simply take the security software on it…

It's flat out wrong of you to say that antivirus companies don't care about FP's. There are over 25k new malware samples coming out daily, and everybody is just trying to cut through them as fast and efficiently as possible. Yes there are innocent casualties of this -- False positives -- but these are sincere mistakes . False positives are very embarrassing for the security company. It is something that can even caus…

All of this. False positives are horrible for both antivirus companies and their customers, and great care is typically taken to avoid them.

Not to mention that if you start alerting the user too much, they'd start tuning out the alerts; that becomes a big problem if and when they're infected with something.

Re: Why Developers Hate Antiviruses

#16

Post by InclinedPlane » Wed, Jan 25, 2012, 8:23 PM UTC

phzbOx wrote: post #12

For me it's not so much that it's not always accurate but more than it always make my computer soooo slow. And also, that I don't believe in antivirus.. Precaution is everything; One you've got the virus, unless it's a trivial or unoffensive one, better to format.

I don't run anti-virus, the cons are too big and it's not actually a good protection over just taking common sense precautions. I've only been bitten by infections on 2 occasions over 20+ years, and anti-virus wouldn't have helped with either.

Re: Why Developers Hate Antiviruses

#17

Post by InclinedPlane » Wed, Jan 25, 2012, 8:25 PM UTC

AdamTReineke wrote: post #8

bkyan wrote: post #5

Is there really a reason to even run anti-virus software all the time as long as you don't try to open executables and macro-containing documents that didn't come from a reputable source?

No, because if you visit a site that successfully exploits an unpatched vulnerability in your browser (or plugins) that allows for remote code execution, you WILL be infected. I'd label myself extremely savvy and I've been hit by what I think were ads loading a Java applet that somehow broke out of the JRE and ran an executable.

I always turn off Java on the browsers I use. It's a HUGE security hole that allows for drive-by infections and the cost of not having java applet support is something I can very much live with.

Re: Why Developers Hate Antiviruses

#18

Post by danudey » Wed, Jan 25, 2012, 8:33 PM UTC

naner wrote: post #14

Oh, man. I use Linux for my day job but keep a Windows 7 install should the need arise. An old friend sent me a link to try out a video game he and a buddy made in college. I downloaded the program, Norton deletes it immediately. It didn't recognize the application signature. (Actually, it recognized it but it wasn't popular enough -- about 100 people had apparently downloaded this game that also used Norton.) After…

My first call when doing tech support at a local ISP was someone who couldn't get online. It said he was connected, his network device was working fine, he was on the WiFi and it said he had great signal, but nothing worked.

I walked him through getting to Add/Remove Programs and asked him if he saw Norton Internet Security. Told him to uninstall it. Everything works.

He asked if that made his computer less secure. I said 'Technically yes, but only because you can actually use the internet now.'

I worked at that ISP for a week, had the same problem come up three times. My mother had the same issue, and I've had two other friends who had it. Thankfully, I knew how to deal with it because it had happened to me when I bought a Dell laptop years ago.

Re: Why Developers Hate Antiviruses

#19

Post by danudey » Wed, Jan 25, 2012, 8:38 PM UTC

dangrossman wrote: post #11

bkyan wrote: post #5

Is there really a reason to even run anti-virus software all the time as long as you don't try to open executables and macro-containing documents that didn't come from a reputable source?

Yes, because you don't even have to be using the computer to acquire new malware -- if Windows isn't patched and you don't have a properly configured firewall in front of the system. Simply browsing the web with fully patched Windows behind a firewall is a risk as well. Among other things, I review orders for an advertising service, 20-30 a day. Some of these orders are purposely placed to advertise sites with malici…

I knew a university professor who was installing Windows XP onto a workstation that was connected to the university network. The machine ended up infected with Blaster before he'd even finished the installation.

Re: Why Developers Hate Antiviruses

#20

Post by bwarp » Wed, Jan 25, 2012, 8:41 PM UTC

I've come to the conclusion that AV software gets more attrocious the more you pay for it or the more it requires advertising every 5 minutes on television. They push it on you via scaremongering every day at least once.

HOWEVER, I've been using Microsoft's free security essentials package for Windows 7 for about 2 years. It never pokes you in the eye, never lets a single thing through and doesn't screw your system resources. It just keeps out of your way. As I said, it's $0 which is how much it should cost and is supplied by the vendor which knows their own security problems the best.

With respect to Linux or MacOS X, I never have installed an AV package ever.