5 ms·

It's hilarious how such a huge industry has become of something that has soberly assessed very little value or effect. In fact, considering the massive vulnera

It's hilarious how such a huge industry has become of something that has soberly assessed very little value or effect. In fact, considering the massive vulnerabilities in AV software discovered by e.g. Googles Zero project, I'm pretty sure the security gain has already slipped into "negative effect" territory five years ago.

viraptor 10y ago
Without knowing the rates of use of each kind of malware it would be hard to tell. Since the issues in AVs were published by Zero, rather than found in the wild, there's a good chance they were not known, or used only for specific targets. AVs are still useful for "we're employing 1000s of people, some of them are bound to open that bad word document in the email". Useless for targeted attacks, but useful for worms with signatures known for weeks. If you can't deal with the issue in some other way, AVs still give you something.
- cptskippy 10y ago
  Anything that's been known for weeks can be stopped at the point of ingress such as the email server. They don't require a process actively taking up resources on your machine monitoring disk activity.
  - viraptor 10y ago
    What about attachments with passwords? Or https? (assuming we're not using stupid ideas like ssl unpacking proxy)
    - cptskippy 10y ago
      Blocking and filtering email attachments is pretty easy. There's plenty of email gateways that remove attachments from unknown/unsafe senders and replace it with hoops a user has to jump through to get the attachment. This is enough to discourage users from opening most malware. For websites, malware hosts can be easily blocked at the gateway level. This won't protect you if someone manages to host malware on a common site like yahoo.com but will catch the vast majority. These days it's pretty easy to circumvent or disable Antivirus or obfuscate your malware form it. If malware manages to get itself onto a user's machine then you've already lost.
    - penguinduck 10y ago
      Some systems will scan the email content and try to guess the password; if they can't, they'll block the attachment.
ht85 10y ago
I keep seeing this point of view around IT communities, and I think it shows how out of touch most people are with the average user capabilities, or just being pedantic. AV software isn't there to prevent ingenious hackers to take control of random computers. Yes, it actually might create more surface for that purpose. It exists because most users do not have any understanding of the platform, and will just click on "accept", "yes" and "ok" hoping things will turn out well. AV are pretty decent at mitigating that. At the cost of some performance loss, you'll avoid having a bunch of ads and popups take over your computer, or at least mitigate the phenomenon.
- penguinduck 10y ago
  But for such a user the choice is not third-party AV or nothing - Windows comes with AV software - so the true benefit of an AV product is only in how much better it is than the integrated one. That difference needs to be more significant than the product's drawbacks AND price.

viraptor 10y ago

Without knowing the rates of use of each kind of malware it would be hard to tell. Since the issues in AVs were published by Zero, rather than found in the wild, there's a good chance they were not known, or used only for specific targets. AVs are still useful for "we're employing 1000s of people, some of them are bound to open that bad word document in the email". Useless for targeted attacks, but useful for worms with signatures known for weeks. If you can't deal with the issue in some other way, AVs still give you something.

cptskippy 10y ago
Anything that's been known for weeks can be stopped at the point of ingress such as the email server. They don't require a process actively taking up resources on your machine monitoring disk activity.
- viraptor 10y ago
  What about attachments with passwords? Or https? (assuming we're not using stupid ideas like ssl unpacking proxy)
  - cptskippy 10y ago
    Blocking and filtering email attachments is pretty easy. There's plenty of email gateways that remove attachments from unknown/unsafe senders and replace it with hoops a user has to jump through to get the attachment. This is enough to discourage users from opening most malware. For websites, malware hosts can be easily blocked at the gateway level. This won't protect you if someone manages to host malware on a common site like yahoo.com but will catch the vast majority. These days it's pretty easy to circumvent or disable Antivirus or obfuscate your malware form it. If malware manages to get itself onto a user's machine then you've already lost.
  - penguinduck 10y ago
    Some systems will scan the email content and try to guess the password; if they can't, they'll block the attachment.

ht85 10y ago

I keep seeing this point of view around IT communities, and I think it shows how out of touch most people are with the average user capabilities, or just being pedantic. AV software isn't there to prevent ingenious hackers to take control of random computers. Yes, it actually might create more surface for that purpose. It exists because most users do not have any understanding of the platform, and will just click on "accept", "yes" and "ok" hoping things will turn out well. AV are pretty decent at mitigating that. At the cost of some performance loss, you'll avoid having a bunch of ads and popups take over your computer, or at least mitigate the phenomenon.

penguinduck 10y ago
But for such a user the choice is not third-party AV or nothing - Windows comes with AV software - so the true benefit of an AV product is only in how much better it is than the integrated one. That difference needs to be more significant than the product's drawbacks AND price.