Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German Government Agency warns about using Kaspersky

bsi.bund.de

Post reply on HN
Print view View original

91–100 of 147 posts

Re: German Government Agency warns about using Kaspersky

#91

Post by viraptor »

charcircuit wrote: post #41
kevingadd wrote: post #25

Earlier quoted context omitted.

It's definitely reasonable at this point to just skip using AV. It won't protect users from bad security habits and it tends to make your system performance worse even if it doesn't have vulnerabilities. I have Windows Defender enabled on my machines since it comes with the OS (and work policy requires it), but I definitely had to exclude most of my work folders to be able to get work done. It would be nice to have s…

Malware writers make sure their malware is undetected by most antivirus software. Antivirus will not save you.

This is the case only for the first few hours. Sure, the new releases are checked against the current AV engines. But there's no magic that will prevent them from being detected in a week. And unless you're being actively targeted or extremely unlucky, that means AV will catch most things for you.

Re: German Government Agency warns about using Kaspersky

#92

Post by Wavelets »

montzark wrote: post #2

Little bit worried about Jetbrains products as well. I think they have development centers in Russia? Not worried about company, but rather some disgruntled employee, for example put this USB stick to your computer or otherwise we will prosecute you or your close one for participating in protests or some fabricated accusation.

I’m worried about JetBrains too. From what I can tell, only a small portion of their team (including the founders) are located outside Russia. That’s a lot of people left inside Russia to be pressured, manipulated, and abused into compliance.

Re: German Government Agency warns about using Kaspersky

#93

Post by _the_inflator »

This ban on Kaspersky in software is similar to the US ban on Chinese Huawei for 5G.

What I am really waiting for is a ban on cloud services like Github. Since Russia is now basically even more rogue than Iran, I bet something like this here is in the making: https://techcrunch.com/2019/07/29/github-ban-sanctioned-coun... And it's reversal till this day: https://github.blog/2021-01-05-advancing-developer-freedom-g...

Cybercrime is still a thing in Russia.

Re: German Government Agency warns about using Kaspersky

#94

Post by lizardactivist »

waihtis wrote: post #38

It’s been interesting to note how Kaspersky has been responding to the scrutiny. It’s almost always the same - ”we have been audited a huge amount of times and no-one has ever found anything!” It’s suspicious because as someone who is a vendor of risk management, they’re leaving out the gaping hole fact which is that software is updateable and oftentimes AV will do so automatically. Potent risk is pretty huge. Same a…

How else should they respond? And almost all software today is updateable, and many do so automatically per default. What is your argument here exactly?

Re: German Government Agency warns about using Kaspersky

#95

Post by vladvasiliu »

t43562 wrote: post #20

It's curious to look on at this situation from Linux. Perhaps I shouldn't be too comfortable but it's really a different world. I suppose that one should take care which distribution one uses as that is also an effective entry point for software from the outside but at least a bit more obvious and open than some AV company.

The potential issue I see on Linux is the spread of third party distribution channels, like npm / pip / etc, which also tend to undergo much less scrutiny than official packages.

Sure, if someone gets root on my Linux PC, they could do a lot of damage. But my most important things are parked in my home folder, which any old script running as my user can access without any problem. No need for privilege escalation or other fancy things.

AppArmor and SELinux can probably mitigate this, but I don't think they see particular widespread use in "default deny" mode.

Re: German Government Agency warns about using Kaspersky

#96

Post by phendrenad2 »

t43562 wrote: post #20

It's curious to look on at this situation from Linux. Perhaps I shouldn't be too comfortable but it's really a different world. I suppose that one should take care which distribution one uses as that is also an effective entry point for software from the outside but at least a bit more obvious and open than some AV company.

Linux is very secure by default, if you stick to open-source software and install it from the distro package managers. What I worry about is when Linux becomes more popular, and commercial software is ported over, and people start pirating it. The door is wide open when people start typing their root passwords into keygens. I expect the Linux world will have a revelation where they discover the power of AV.

Re: German Government Agency warns about using Kaspersky

#97

Post by f1refly »

tonyedgecombe wrote: post #48
hutzlibu wrote: post #30

Earlier quoted context omitted.

The client is open source, so should be quite safe and the company is not based in russia. But I think some servers are? In either case, it is not a medium for secure communication anyway. I use it more as a open forum software.

>In either case, it is not a medium for secure communication anyway. The problem is it is running on your machine.

Why would that be a problem? The source is open, there are public builds by f-droid that are definetly not tempered with. I trust the fdroid maintainers.

Re: German Government Agency warns about using Kaspersky

#98

Post by ekianjo »

autoexec wrote: post #78
ho_schi wrote: post #56

Earlier quoted context omitted.

Good work! The only "correct" approach is telling Adobe that they need to provide native ports of their software or switching to other software. Regarding laptops, buy business laptops (Lenovo ThinkPad, Dell Developer Edition) or laptops made from vendors with a focus on Linux (Purism, System 76, Tuxedo) and stick with internals from AMD or Intel. So it boils down to knowing things before and giving the right compani…

Lenovo gets a lot of love from linux users for their laptops, but they've repeatedly shipped malware infested systems. Sometimes they did it in exchange for money, sometimes they wrote the malware themselves. I wouldn't recommend anyone go near them. I mean, hardware that'll play nice with linux is nice, but we're not lacking for alternatives these days. If a company who acts as horribly as Lenovo does can still be r…

They never shipped a malware that would resist a fresh install. Nobody should ever use an OEM provided OS.

Re: German Government Agency warns about using Kaspersky

#99

Post by Ensorceled »

jacquesm wrote: post #65
dspillett wrote: post #36

Earlier quoted context omitted.

> to have backups With the usual additional notes: unless you include an off-site, an off-line (or at least soft-offline) backup, and your backups get tested regularly enough, you don't have a backup system, you have aspirations & hopes! ---- For your valuable information anyway. For most individuals the core “it would really inconvenience my life if I lost it” data is surprisingly small¹, and the next layer (“losing…

"With the usual additional notes: unless you include an off-site, an off-line (or at least soft-offline) backup, and your backups get tested regularly enough, you don't have a backup system, you have aspirations & hopes!" This should be posted in every place where people are involved with IT operations.

It gets posted on HN EVERY SINGLE TIME. Usually the words "have backups" triggers multiple lectures on offsite backups and testing and multiple factors and ...

Re: German Government Agency warns about using Kaspersky

#100

Post by phendrenad2 »

nivenkos wrote: post #47

Why are they even using Windows? The US is not an ally either.

Germany is one of the oldest NATO countries. Of course the US did supposedly intercept the Chancellor's phonecalls or emails or something, but it seems like not much ill-will was generated as a result.
Post reply on HN