5 ms·

> Most of the software you use is complete and utter shit full of shoddy, high-risk code. Do we need to bring that up every time when we are talking about somet

> Most of the software you use is complete and utter shit full of shoddy, high-risk code. Do we need to bring that up every time when we are talking about something specific? Most software doesn't run with full system privileges, go out of its way to interact with malicious content, and inject itself all over the system. The difference between AV and any other shitty software is that AV is massively more useful and abundant as attack surface. The hooks into the browser are nothing. It isn't the hooking, though that's not great. Imagine Chrome provided an API. OK, so now the AV listens to the API. It sees you open some file in the browser that's XML - it parses the XML. It gets exploited, trivially, because many vendors explicitly disable security features like stack cookies. Now the attacker went from a sandboxed environment to a full system privileges process.

mhurron 10y ago
So because of a future possibility of exploit, don't do anything which is one cause of the existing argument. I suggest you uninstall Chrome if that is your view, it too will lead to a full system compromise in the future, I mean it will in the future yet again. > Most software doesn't run with full system privileges For most people, yes it does. > go out of its way to interact with malicious content Your browser also does. > difference between AV and any other shitty software is that AV is massively more useful and abundant as attack surface. The browser pretty much wins here too. But no, it's AV vendors fault your browser is such a risk.
- witty_username 10y ago
  > For most people, yes it does. Examples? > I suggest you uninstall Chrome if that is your view, it too will lead to a full system compromise in the future, I mean it will in the future yet again. > The browser pretty much wins here too. Chrome is tightly sandboxed; any exploit in Chrome is very unlikely to compromise your OS.
- Bartweiss 10y ago
  So many responses here, but mostly: "Most software doesn't run with full system privileges", "For most people, yes it does." That's not even a little true. Even inexperienced Windows users have to click that little "permission to make changes" button, and sometimes "run as administrator". Winamp, Solitaire, and all your other random not-totally-secure programs don't offer kernel access to whoever compromises them. AV is a singularly good source of privilege escalation attacks for exactly that reason.
- staticassertion 10y ago
  > I suggest you uninstall Chrome if that is your view, it too will lead to a full system compromise in the future, I mean it will in the future yet again. Chrome developers take active measures (sandboxing, research, patching, bug bounties) to secure their browser. They have done amazing work and really, in my mind, pushed some solid technology that we've all benefited from (seccomp, as an example). AV has gone out of its way to disable modern security technologies like ASLR/Stack Cookies. There is no comparison here in terms of effort to avoid exploitation. As Justin said - find me a single AV that sandboxes its parsers. > For most people, yes it does. Even if this were true, and it is not, Chrome doesn't - it runs in a sandbox. Therefor a compromise of an AV is not just a jump to Admin but a jump out of the sandbox. > The browser pretty much wins here too. Not really. The majority of attack surface in a browser like Chrome is isolated and hardened. Web browsers avoid malicious content where possible. AV goes out of its way to interact with malicious content. > But no, it's AV vendors fault your browser is such a risk. It's AV vendors fault that they avoid writing secure software. And, yeah actually, it is AV vendors fault that the browser is vulnerable when the browser takes every step to stay secure and AV vendors shit all over that.
  - technion 10y ago
    bug bounties How about just responding to reports? I've re-reported this to McAfee every year and originally blogged it on a much earlier version something like 2005. https://lolware.net/2012/12/12/uvscan.html https://lolware.net/2012/12/12/uvscan.html
zamalek 10y ago
Also, most software doesn't declare that it's making your system more secure.

mhurron 10y ago

So because of a future possibility of exploit, don't do anything which is one cause of the existing argument. I suggest you uninstall Chrome if that is your view, it too will lead to a full system compromise in the future, I mean it will in the future yet again. > Most software doesn't run with full system privileges For most people, yes it does. > go out of its way to interact with malicious content Your browser also does. > difference between AV and any other shitty software is that AV is massively more useful and abundant as attack surface. The browser pretty much wins here too. But no, it's AV vendors fault your browser is such a risk.

witty_username 10y ago
> For most people, yes it does. Examples? > I suggest you uninstall Chrome if that is your view, it too will lead to a full system compromise in the future, I mean it will in the future yet again. > The browser pretty much wins here too. Chrome is tightly sandboxed; any exploit in Chrome is very unlikely to compromise your OS.
Bartweiss 10y ago
So many responses here, but mostly: "Most software doesn't run with full system privileges", "For most people, yes it does." That's not even a little true. Even inexperienced Windows users have to click that little "permission to make changes" button, and sometimes "run as administrator". Winamp, Solitaire, and all your other random not-totally-secure programs don't offer kernel access to whoever compromises them. AV is a singularly good source of privilege escalation attacks for exactly that reason.
staticassertion 10y ago
> I suggest you uninstall Chrome if that is your view, it too will lead to a full system compromise in the future, I mean it will in the future yet again. Chrome developers take active measures (sandboxing, research, patching, bug bounties) to secure their browser. They have done amazing work and really, in my mind, pushed some solid technology that we've all benefited from (seccomp, as an example). AV has gone out of its way to disable modern security technologies like ASLR/Stack Cookies. There is no comparison here in terms of effort to avoid exploitation. As Justin said - find me a single AV that sandboxes its parsers. > For most people, yes it does. Even if this were true, and it is not, Chrome doesn't - it runs in a sandbox. Therefor a compromise of an AV is not just a jump to Admin but a jump out of the sandbox. > The browser pretty much wins here too. Not really. The majority of attack surface in a browser like Chrome is isolated and hardened. Web browsers avoid malicious content where possible. AV goes out of its way to interact with malicious content. > But no, it's AV vendors fault your browser is such a risk. It's AV vendors fault that they avoid writing secure software. And, yeah actually, it is AV vendors fault that the browser is vulnerable when the browser takes every step to stay secure and AV vendors shit all over that.
- technion 10y ago
  bug bounties How about just responding to reports? I've re-reported this to McAfee every year and originally blogged it on a much earlier version something like 2005. https://lolware.net/2012/12/12/uvscan.html https://lolware.net/2012/12/12/uvscan.html

zamalek 10y ago

Also, most software doesn't declare that it's making your system more secure.