7 ms·
Two well-respected people who seem to take diametrically opposed views. All I can do is get some popcorn and dream of knowing who's right.
by blowski 10y ago
Two well-respected people who seem to take diametrically opposed views.
All I can do is get some popcorn and dream of knowing who's right.
- 0xfeba 10y agoWell, I see his point. 3rd Party AV vendors have hacky hooks into the kernel to do what they need to do. And at that point they become kernel-level so they are a juicy target. Symantec and other AV vendors have had stupid flaws (someone else linked to it in the comments) that allowed remote access and privileged escalation from just knowing the host has a certain AV installed. All AV seems hacky--except for Microsoft's own, which is what I use and suggest all my friends use rather than shelling out for those subpar products.
- jackmott 10y agoeven ignoring the attack surface, the tools seem to always cause the same kinds of system performance degradation that actual malware does. I'd rather be occasionally hacked!
- sqeaky 10y agoYou act as though its a choice. You will get hacked with or without the the AV, The AV might just let you know.
- jsheard 10y agoCase in point: After years of fruitlessly asking AV companies to stop injecting shoddy patches into their kernel, Microsoft eventually gave up and added active countermeasures which deliberately trigger a kernel panic if certain structures are tampered with. That gave AV vendors the "encouragement" required to move to the sanctioned APIs. https://en.wikipedia.org/wiki/Kernel_Patch_Protection https://en.wikipedia.org/wiki/Kernel_Patch_Protection
- SippinLean 10y ago>except for Microsoft's own It used to be great but I think the last stats I saw showed it at about 50% success rate. ESET is excellent.
- zokier 10y agoI think the point is not detection rate, but the amount of new holes the AV introduces to the system
- ionised 10y agoWindows Defender was shown to be pretty piss poor in general detections. The only thing it has going for it is its low resource footprint.
- anonymfus 10y agoLooks like survivorship bias: malware detectable by Windows Defender does not spread so it is not included in comparisons.
- djcapelis 10y agoYou're making the mistake a lot of people make where you assume if one side is a thing a competing thing must be equally valid. These aren't two people that are equally well respected or with equal track records. One of them has years of experience developing secure software, the other has years of experience hacking on bullshit snake oil for the purpose of selling it to users. This is not a "the truth must be somewhere in the middle both sides are super great" narrative.
- wolfgke 10y ago> You're making the mistake a lot of people make where you assume if one side is a thing a competing thing must be equally valid. I am rather a "if there are two different opinions at least one side must be wrong" kind of guy and cannot even imagine how one might come up with a "the truth must be somewhere in the middle". If this were true, it would simply mean that both sides were wrong from beginning on.
- ThrustVectoring 10y agoThere are degrees of wrongness - it's not a black-and-white thing. Suppose two people are arguing over what causes robberies in downtown Chicago: person A blames drug use, while person B thinks it's poverty. The actual truth is some sort of mix of both, along with other factors not mentioned.
- blowski 10y agoNope, I was just saying that I don't have anywhere near the level of knowledge to say which of either them is more right than the other. I just find it fascinating when two people who are good at what they do have a debate.
- tptacek 10y agoAre they equally well-respected people? I'm not so sure that's true.
- blowski 10y agoBy me, yes, because I have no idea what I'm talking about.