Live data from Hacker News

Firefox engineers discover a Windows Defender bug that causes high CPU usage

bugzilla.mozilla.org

181–190 of 223 posts

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#181
post #77

Is Windows Defender even worth enabling? It eats up a lot of CPU. It doesn’t seem like much help in a default update enabled system where you are using a regular user account instead of an administrator account. In addition, anti-virus and real time scanning is itself potential surface area for an exploit (for example a few years back there was an exploit based on Norton antivirus email scanner).

Yes. It uses next to no system resources (issues like this aside), it integrates perfectly with Windows (it comes from Microsoft, after all), it's reasonably effective (to the chagrin of AV vendors the world over), and it isn't intrusive.

Yes. If you exclude all the issues with resource use, it uses none.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#182
post #67

Earlier quoted context omitted.

I'm curious how much excess energy has been consumed, and won't be consumed any longer, as a result of this improvement - even just limited to reduced CPU usage on Windows machines using Firefox to watch Youtube. I love thinking about the impacts of tiny improvements at scale like this, might do some napkin math on it later and see if I can come up with something in the right order of magnitude.

Next: Canadian cars and their daytime running lights.

Next: internal combustion engines doing more heat than torque.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#183
post #85

Earlier quoted context omitted.

In my experience (as a former Firefox dev), antivirus / antimalware software are really poorly behaved. They tend to: - require admin rights (which means that if they have vulnerabilities, it can take control of the entire machine, even if Firefox itself is sanboxed); - monkey-patch the Firefox executable in memory, which works (when it does) as long as the version of the software tracks closely the version of Firefo…

This almost reads like Defender makes machines less secure on purpose. Makes me wonder: Does windows Defender just double as another deliberate NSA backdoor?

Pretty sure Defender is one of the few anti malware/edr that doesn’t need to do this, because it’s so tied to the platform. 3rd party antimalware and EDR are much more likely to inject hooks and dlls into other processes

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#184
post #4

TL;DR: Windows Defender had a bug that made certain system calls expensive on CPU cycles when Defender's Real-time Protection feature is enabled. After discovery, Mozilla reported this issue to Microsoft. Microsoft is releasing a patch that should result in lower CPU usage when using Firefox on sites like YouTube (a ~75% CPU usage reduction was noted when browsing YouTube in Firefox with the fixed version of Defender…

The biggest surprise for me was Microsoft actually fixing it.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#185
post #85

Earlier quoted context omitted.

I have malwarebytes premium and defender CPU usage is nearly 100% at times bringin Firefox to a halt. Chrome works fine..I've been blaming Firefox so far.

In my experience (as a former Firefox dev), antivirus / antimalware software are really poorly behaved. They tend to: - require admin rights (which means that if they have vulnerabilities, it can take control of the entire machine, even if Firefox itself is sanboxed); - monkey-patch the Firefox executable in memory, which works (when it does) as long as the version of the software tracks closely the version of Firefo…

> - install encryption certificates that are actually less trustworthy than Mozilla's, hence decreasing the security of https;

Given that in many industries insurances and, in some cases like banking, the law requires companies to monitor HTTPS traffic of browsers for compliance, it might be better if browsers had a dedicated filter / monitor API.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#186
post #106

It used to be possible to disable real-time protection but know it’s not. The UI toggle is only for a limited time and the Group Policy option doesn’t work anymore.

It appears you would like to take a trip into the windows dark forest.

Complete removal of windows defender on retail OS is feasible if you can figure out how to elevate a prompt to trusted installer. Alternatively, if you run Windows Server, you can use Remove-WindowsFeature to get it gone for good.

I have a script that accomplishes this, but I hesitate to share it because I don't want some asshole at Microsoft to patch it.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#187

Earlier quoted context omitted.

>There are such better options available. Meh, I see Ubuntu black screens in public appliances as well.

All options are bad. As a species, we're incapable of making a good operating system.

[deleted]

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#188

Is Windows Defender even worth enabling? It eats up a lot of CPU. It doesn’t seem like much help in a default update enabled system where you are using a regular user account instead of an administrator account. In addition, anti-virus and real time scanning is itself potential surface area for an exploit (for example a few years back there was an exploit based on Norton antivirus email scanner).

> Is Windows Defender even worth enabling?

For me, no.

I grew up in the era of internet wild-west and I understand why some of us still feel the need to operate with multiple levels of (perceived) safety even today.

That said, I think most of it is really foolish crap now. The sorts of exploits that are out in the wild that you should actually worry about will go right through defender like a modern bunker buster.

It's really upsetting to me when you think about how much performance/energy/UX latency/frustration/et. al. is being spent in hopes of achieving a minor incremental improvement in security. Windows defender == TSA for your PC.

If you know to not download & run executable files from sketchy websites, you are basically already at the limits of what defender is effectively achieving on your local machine.

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#189
post #81
post #67

Earlier quoted context omitted.

I'm curious how much excess energy has been consumed, and won't be consumed any longer, as a result of this improvement - even just limited to reduced CPU usage on Windows machines using Firefox to watch Youtube. I love thinking about the impacts of tiny improvements at scale like this, might do some napkin math on it later and see if I can come up with something in the right order of magnitude.

firefox browser share is teeny tiny these days

It's 200 million people, with 80% on Windows.

https://data.firefox.com/dashboard/user-activity

https://data.firefox.com/dashboard/hardware

Re: Firefox engineers discover a Windows Defender bug that causes high CPU usage

#190
post #100
post #65

Earlier quoted context omitted.

windows users will also happily "run as administrator", while a lot of linux users know not to do that in my experience

Yes, I have an absolutely pristine record and I have never, ever copy-pasted a script from the internet with sudo, or piped curl into bash because I'm lazy and I trust most github READMEs. Never.

I usually double check before running stuff as sudo, and piping into bash i dont really ever need (AUR). My heart goes out to those on distros where thats the way to distribute software.
Post reply on HN