4 ms·

I do not understand how this is a response to the article, which doesn't make a comparison so much as claim that all AV suck.

Natsu 11y ago
It seems to say that just because something passes virustotal with 0/56 doesn't necessarily mean it would pass every AV in a real attack.
- JoachimSchipper 11y ago
  Does the comment actually say that, though? It would make sense if the comment said that, but e.g. > perform antivirus comparative analyses is not what is happening here.
  - wmt 11y ago
    If you just read the reasons why you shouldn't use it for comparisons, you should also understand why it's pointless to use VT for testing if you bypass AV or not. To quote: -VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc. -In VirusTotal desktop-oriented solutions coexist with perimeter-oriented solutions; heuristics in this latter group may be more aggressive and paranoid, since the impact of false positives is less visible in the perimeter. It is simply not fair to compare both groups. -Some of the solutions included in VirusTotal are parametrized (in coherence with the developer company's desire) with a different heuristic/agressiveness level than the official end-user default configuration.
  - grub5000 11y ago
    > -VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc. It says right in the parent comment that the VT results may not actually reflect how the product performs in the real world.

Natsu 11y ago

It seems to say that just because something passes virustotal with 0/56 doesn't necessarily mean it would pass every AV in a real attack.

JoachimSchipper 11y ago
Does the comment actually say that, though? It would make sense if the comment said that, but e.g. > perform antivirus comparative analyses is not what is happening here.
- wmt 11y ago
  If you just read the reasons why you shouldn't use it for comparisons, you should also understand why it's pointless to use VT for testing if you bypass AV or not. To quote: -VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc. -In VirusTotal desktop-oriented solutions coexist with perimeter-oriented solutions; heuristics in this latter group may be more aggressive and paranoid, since the impact of false positives is less visible in the perimeter. It is simply not fair to compare both groups. -Some of the solutions included in VirusTotal are parametrized (in coherence with the developer company's desire) with a different heuristic/agressiveness level than the official end-user default configuration.
- grub5000 11y ago
  > -VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc. It says right in the parent comment that the VT results may not actually reflect how the product performs in the real world.