4 ms·

If you've been following Tavis Ormandy's work, you already know this: Anti-Virus software is a trash-fire. You can't buy security, but you can learn it: h

If you've been following Tavis Ormandy's work, you already know this: Anti-Virus software is a trash-fire. You can't buy security, but you can learn it: http://decentsecurity.com/#/introduction/ http://decentsecurity.com/#/introduction/ I've long argued that the only sustainable security strategy is education. If you're a developer/engineer/consultant/rockstar/ninja/etc. and never bothered to learn how to write secure software, start here: https://paragonie.com/blog/2015/08/gentle-introduction-application-security https://paragonie.com/blog/2015/08/gentle-introduction-appli...

lqdc13 10y ago
I don't personally use AVs but they're useful for people who cannot be taught security. There is a good amount of intuition that goes into it. Such vulns are relatively rare compared to the things they run into multiple times a day.
- CiPHPerCoder 10y ago
  > I don't personally use AVs but they're useful for people who cannot be taught security. Attackers agree. Even outside of the context of remotely exploitable ring-0 vulnerabilities that require no user interaction, they provide people with a false sense of security. > Such vulns are relatively rare compared to the things they run into multiple times a day. That's because criminals are fat and happy with lower hanging fruit. Why bother exploiting AV software when you can just trick people and the AV software is already ineffective at stopping e.g. ransomware?
hndl 10y ago
>> "You can't buy security, but you can learn it: http://decentsecurity.com/#/introduction/" http://decentsecurity.com/#/introduction/" I think that's an incorrect standpoint to take when you factor in how technologically agnostic most folks are. I would better think of it as "security is default, but you can disable it if you really, really want it that way."
- CiPHPerCoder 10y ago
  Security isn't the default, though. Specific example: SMTP.
ghshephard 10y ago
Couldn't agree with you more. Every tool in the world won't help you defend against a user with privileges being phished into doing something inappropriate. And, even for those of us who are somewhat savvy, having refreshers to remind you things like never, ever, click on a link in an email, navigate through the website instead. Be hyper cautious about opening every attachment, period. Ensure that your system firewall is set to default deny, and think twice about opening up rules when an application demands them - and consider making them temporary rules. (Little snitch is great for that). Make sure the OS is updated routinely.... With that said, operating systems could help us out a little by reducing the almost infinite number of threat surfaces that exist so that we can more easily audit our system. The sheer number of places that an auto-launching/malware/kernel extension can hide in OS X makes it next to impossible for me to figure out whether my system has been compromised - particularly if something is able to hide itself from Little Snitch. And I won't even go into the insane number of network accesses that most applications want these days... But yes, the only sustainable security strategy is education.
coredog64 10y ago
decentsecurity.com is an effort of InfoSec Taylor Swift (@SwiftOnSecurity). If you can deal with the occasional Cortana fanfic & some Linux trolling it's definitely worth a follow.

lqdc13 10y ago

I don't personally use AVs but they're useful for people who cannot be taught security. There is a good amount of intuition that goes into it. Such vulns are relatively rare compared to the things they run into multiple times a day.

CiPHPerCoder 10y ago
> I don't personally use AVs but they're useful for people who cannot be taught security. Attackers agree. Even outside of the context of remotely exploitable ring-0 vulnerabilities that require no user interaction, they provide people with a false sense of security. > Such vulns are relatively rare compared to the things they run into multiple times a day. That's because criminals are fat and happy with lower hanging fruit. Why bother exploiting AV software when you can just trick people and the AV software is already ineffective at stopping e.g. ransomware?

hndl 10y ago

>> "You can't buy security, but you can learn it: http://decentsecurity.com/#/introduction/" http://decentsecurity.com/#/introduction/" I think that's an incorrect standpoint to take when you factor in how technologically agnostic most folks are. I would better think of it as "security is default, but you can disable it if you really, really want it that way."

CiPHPerCoder 10y ago
Security isn't the default, though. Specific example: SMTP.

ghshephard 10y ago

Couldn't agree with you more. Every tool in the world won't help you defend against a user with privileges being phished into doing something inappropriate. And, even for those of us who are somewhat savvy, having refreshers to remind you things like never, ever, click on a link in an email, navigate through the website instead. Be hyper cautious about opening every attachment, period. Ensure that your system firewall is set to default deny, and think twice about opening up rules when an application demands them - and consider making them temporary rules. (Little snitch is great for that). Make sure the OS is updated routinely.... With that said, operating systems could help us out a little by reducing the almost infinite number of threat surfaces that exist so that we can more easily audit our system. The sheer number of places that an auto-launching/malware/kernel extension can hide in OS X makes it next to impossible for me to figure out whether my system has been compromised - particularly if something is able to hide itself from Little Snitch. And I won't even go into the insane number of network accesses that most applications want these days... But yes, the only sustainable security strategy is education.

coredog64 10y ago

decentsecurity.com is an effort of InfoSec Taylor Swift (@SwiftOnSecurity). If you can deal with the occasional Cortana fanfic & some Linux trolling it's definitely worth a follow.