10 ms·

For everyone else who was lost like me (mined from this comment section and some googling): - AV: Anti-virus software - Vess: Security, AV expert, loves AV -

For everyone else who was lost like me (mined from this comment section and some googling): - AV: Anti-virus software - Vess: Security, AV expert, loves AV - Justin Schuh: Chrome dev (security-related), hates AV - AV needs deep access to the OS, opening the door for attacks if managed poorly - Deep OS access is often hacky (due to lack of APIs?), thus potentially unsafe - Vess and Justin Schuh both have bad manners Is this about right? Also, how is AV a (direct) impediment to a shipping a safe browser? It seems to me that a browser should be mostly agnostic toward AV. Edit: It seems like the problem is that AV tries to penetrate browsers in a similar hacky way as for the OS, resulting in similar issues. TL;DR: AV tries to help by supervising browsers because they're allegedly not safe enough, but browsers think they're already safe and want AV to gtfo. Edit 2: Are there any AVs that don't tamper with browsers at all? I've always been using Avast and switching off all browser-related features, but maybe there are better options.

joatmon-snoo 10y ago
[editing as this hilarious yet sad Twitter debate unfolds] Justin Schuh is the Chrome browser security tech lead* https://news.ycombinator.com/item?id=6166731 https://news.ycombinator.com/item?id=6166731 April King (GH:marumari) from Mozilla has chimed in agreeing with Justin: "Not speaking for my employer (@mozilla) but AV causes piles of security issues for Firefox." https://twitter.com/aprilmpls/status/804361653420691456 https://twitter.com/aprilmpls/status/804361653420691456 ===== Also, Vess really doesn't know his shit if he's arguing with @taviso. Incidentally, in the span of 26 hours and 37 minutes, @taviso also found massive vulns and attack surface in FProt, which Vess has advocated. https://twitter.com/taviso/status/803714407763062784 https://twitter.com/taviso/status/803714407763062784 https://twitter.com/VessOnSecurity/status/804298404763463680 https://twitter.com/VessOnSecurity/status/804298404763463680 ===== OK, I think this is the original Twitter thread: https://twitter.com/taviso/status/799747942441586688 https://twitter.com/taviso/status/799747942441586688 Some intermediary followup: https://twitter.com/taviso/status/800057733969944577 https://twitter.com/taviso/status/800057733969944577
- mikecb 10y ago
  Schuh is also the co-author of "the art of software security assessment", the bible of that subject.
- riffraff 10y ago
  > @taviso also found massive vulns and attack surface in FProt, which Vess has advocated. I see the attack surface tweet, but where are the vulnerabilities he found?
  - thyrsus 10y ago
    I expect someone is already running a fuzzer against them. Let's wait a few more hours.
deleted 10y ago
[deleted]
devmop 10y ago
TL;DR AV infects Chrome processes to the point they can't ship security features because they no longer control the application code.
- Klathmon 10y ago
  And it's not just breaking the actual code, it's breaking the standard communications and formats that all major browsers use. I've personally seen HSTS, HPKP, HTTP2, TLS1.3 and more all get royally fucked by various AV programs. And that's just from doing tech support for my family. I understand that if an AV wants to protect certain aspects they need to get access to it, but using these hacks, workarounds, and more to do it is not only unprofessional but both a security and usability nightmare. It's also why the only AV i'll ever recommend will be Windows Defender. People like to complain that it doesn't "catch as much as the others", but at least it's not actively breaking shit.
- dblohm7 10y ago
  Firefox dev here. All browsers have a big bulls-eye on their foreheads with respect to AV, and it's not just security features that are held up. These AV products patch our binaries all over the place such that changing any browser internals that happen to be targeted by AV will cause crashes.
  - busterarm 10y ago
    On the other hand, users tend to be more hardline about their choice of browser than they are about their choice of antivirus. Perhaps clearly communicating this fact to users and updating your software as you see fit will swing the needle in your favor.
    - masklinn 10y ago
      It'll work no better than for windows. When the browser crashers after it's been updated, users will blame the browser not the shit AV.
      - 10y ago
wmil 10y ago
Justin Schuh seems to be arguing that the issue isn't just hacky deep OS access. He's saying that AV companies follow poor security and stability practices in their software and are creating vulnerabilities.
- throwanem 10y ago
  He is not wrong. Here's a good, and only slightly exceptional, example from early this year: https://www.exploit-db.com/exploits/39218/ https://www.exploit-db.com/exploits/39218/ (And the relevant Hacker News discussion: https://news.ycombinator.com/item?id=10882563 https://news.ycombinator.com/item?id=10882563)
hedgehog 10y ago
In security simpler is almost always better. Vess is asserting that AV vendors can write their own versions of the most complicated parts of the browser & OS (including parsing & rendering HTTP/HTML/CSS/JS/PNG, JS runtime, etc), then add more code on top of that to detect bad things, and do all of this while adding no significant bugs and with tolerable performance overhead. The reality is that browsers are insanely complicated, the people working on the major browsers are extraordinarily skilled, and there is a mountain of evidence that AV vendors routinely ship software that by design exposes users to huge security risks on top of all of their bugs. Meanwhile security by isolation is proven effective at protecting users. Two good examples are the process-per-tab isolation in Chrome and the app sandboxing on iOS. Some holes into the sandboxes are necessary (for example you need to get keyboard input in and rendered images out) but every additional hole you open adds significant risk. The downside to this approach is it reduces the market for AV and other third party utilities. (I used to work in security)
- blauditore 10y ago
  I'm not a security expert, but always had a feeling that browsers mostly just need to sandbox websites, so websites cannot do any critical operations that would require AV supervision. "Soft" vulnerabilies like files downloaded and executed are critical outside of the browser, and that's where AV makes sense to me. But I don't want an invasive plugin telling me "this link is safe" with a green, flashing icon. So I've always been trying to just switch off all browser-related features of my AV, but are there AVs that are less aggressive in this matter by nature?
  - Animats 10y ago
    browsers mostly just need to sandbox websites, so websites cannot do any critical operations that would require AV supervision. That's the way it ought to work. But it's so tempting to launch stuff from the browser, from Adobe Reader to Flash to Microsoft's "protocol types" which launch apps. The proper role of antivirus programs is as a "guard". When you download a file, a program looks at it and decides if it should be allowed in. This at least gets rid of all those attack .zip files that show up in email attachments. It also has a well-defined interface with the application.
drzaiusapelord 10y ago
>due to lack of APIs This is the elephant in the room. Software vendors dont want to make this APIs as they increase complexity and cost so AV vendors use hackey solutions for a lot of security related tasks. This is a classic conflict that is probably never going away. To MS's credit, they did remove ring0 access to apps like AV and have added OS-level APIs, but the application level guys still consider that bothersome and the AV guys simple need more/better and more flexibility as threats change. The recent stuff in 8 and 10 were engineered well before we had this rash of ransomware attacks. Also from a practical perspective, its very rare to see an AV compromised but we're constantly seeing browsers, plugins, etc compromised. Heck, Firefox just had a zero-day yesterday. I think the argument that AV makes everything worse is the more questionable claim in this discussion regardless of how much we hate the necessary evil AV is. Especially when we consider how the next-gen stuff that's almost purely heuristics will probably replace AV one day and how its much less hacky than current solutions.
- rcthompson 10y ago
  The thread gives specific instances where AV has made the situation much worse for browsers, mainly by preventing them from enabling many forms of sandboxing.
- joatmon-snoo 10y ago
  Schuh points out in the Twitter thread that Chrome supports OS-level API's. > its very rare to see an AV compromised https://twitter.com/taviso/status/732365178872856577 https://twitter.com/taviso/status/732365178872856577 https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=symantec https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
  - drzaiusapelord 10y ago
    If AV was so vulnerable, we'd see nothing but exploits in the wild going after AV. Yet we aren't seeing that anywhere. If you read the notes you'll see scary terms like "buffer overflow" but "probably wont work on windows because windows uses /GS." I think Tavis does good work but the interpretation of his work is often hysterical. Finding an issue with AV doesn't invalidate the concept of AV. AV is just software. Bugs get found and patched like any other software. I think accepting that isn't asking too much here. Defect-free software is so far humanly impossible for non-trivial applications, let alone for complex security applications. Heck, how many security defects has the linux kernel and openssl had in the past couple years alone? Dozens, or more, and all have been weaponized and trivially exploited. Yet we still use that stuff. Grandma's PC, the PC of a random staff person at work, etc without AV is taken down near instantly. With it, she can avoid many of these security issues. The idea that some defects means AV is without value is a fun and popular opinion with techies, but in the real wold, it does far, far more good than harm.
cesarb 10y ago
> Also, how is AV a (direct) impediment to a shipping a safe browser? It seems to me that a browser should be mostly agnostic toward AV. The main problem is that AV (and some other Windows software) like to inject DLLs into every single process in the system. The current trend in browser security is a heavy form of sandboxing, in which the sandboxed processes can only access a very limited set of system calls. For that to work, the set of system calls required by the sandboxed process must be known, which is only possible if all the code running within the sandbox comes from either the browser or the operating system itself. However, if an arbitrary DLL is injected into the sandboxed process, running arbitrary code and attempting to call arbitrary system calls, the sandboxed process will crash, either because the sandbox mechanism kills the process when it attempts to call an unexpected system call, or because the call attempt returns an error value which the injected DLL didn't expect. Therefore, browser vendors are unable to enable stronger forms of sandboxing, since they'll lead to crashes in the wild.
- petra 10y ago
  >> browser vendors are unable to enable stronger forms of sandboxing, Is it availble as a setting , for those of us without AV ?
  - teaearlgraycold 10y ago
    I doubt they'd have code for that if only a small minority of users will use it. Hardening something takes a lot of effort, and it's probably not worth the work to have two different sandbox techniques just so that users without AV can have a better one.
- digi_owl 10y ago
  The current trend in security seems to be heavy sandboxing, period. And anything that gets in the way of said sandboxing, however benign, is considered insecure, full stop...
  - GauntletWizard 10y ago
    It's the principle of least privilege. Give apps (and websites, and even parts of core services/infrastructure and kernel code) only what they absolutely need. Every syscall you can say shouldn't ever be called is one less avenue for attack. Benign isn't good enough. You need to actively justify every privilege, and leaving a few open for "benign" reasons is bad practice.
jfindley 10y ago
Vess has been in the AV industry a LONG time. A really long time. So long that I don't think he's really able to see the state of the industry for what it is anymore. In the days of windows 95/8, the desktop landscape was very different to how it is now - OSes and browsers were horribly insecure, and readily compromised with little effort. Attacks were plentiful, and infections common. AV really did add useful additional security. These days that's less the case - an up to date windows 10 or OSX desktop is reasonably secure by default - it can still be infected, but generally not without some action taken by the user (of course there are still 0-days, but they are generally treated seriously and patched at least moderately quickly. Unauthenticated RCEs are now a rarity, thankfully). The AV industry hasn't really caught up with the idea that the OS/apps they are messing with are now in general fairly well written and audited pieces of code, and haven't really got institutional awareness that they are making things worse, much of the time. This is frustrating for the OS/app devs, who rightly get annoyed at having AV vendors actively removing protections built into the browser, but also I feel that the AV industry is getting defensive at the bad press generated by things like project-zero, when at least in their own minds they are trying to do something useful. Hence the heated words. ALso, infosec tends towards being a profession of heated language, a lot of the time...
- digi_owl 10y ago
  Yeah AV had its heyday when we didn't have 24/7 net connections (a problem all its own, i am starting to think) and "infections" happened by way of boot sectors and modified binaries. These days however, infections happen more and more via "clever" interpreted code that can be embedded in just about anything. You best bet for killing a whole lot of crap online is basically to turn off JS. This because http delivered JS is the best way to get past the firewall, that in turn is a blunt, but effective, way at stopping various network born crap.
  - JdeBP 10y ago
    There are interpreters for programs that are delivered over the network to be run locally by the unsuspecting user, in some surprising places. For example: Here's a sound player that contains an entire 6502-based virtual machine, because the "sound file format" that it "plays" is actually an executable program. Unfortunately, the virtual machine hardware is not properly simulated, allowing the 6502 code to memory-map parts of the virtual machine manager itself using the virtual memory controller hardware and alter them. * http://scarybeastsecurity.blogspot.co.uk/2016/11/0day-exploit-compromising-linux-desktop.html http://scarybeastsecurity.blogspot.co.uk/2016/11/0day-exploi... (https://news.ycombinator.com/item?id=12951503 https://news.ycombinator.com/item?id=12951503)
AJ007 10y ago
Ironic since Avast sells user clickstream data to third parties..
- blauditore 10y ago
  Hm, do you know a good alternative?
smnscu 10y ago
Can we all take a minute to appreciate how shit Twitter is at consuming complex conversations like this? It's shameful when something like Imgur (as bad as it is technically) has a comment system that's light-years ahead in terms of conversation readability.
- angry-hacker 10y ago
  Unbelievable that so smart people prefer this medium. At some point in the conversation they are both confused who is answering who and why. Twitter should just add a damn comment box for each Tweet and be done with this archaic sms system.
  - tracker1 10y ago
    Agreed... If they'd just make it so the @replies carry the root and upstream Id's, and make some leeway into their constraints... Is anyone still using the SMS adapter to do anything but send new tweets?
- brokenmachine 10y ago
  Twitter and facebook both hurt my brain with their UI.
tptacek 10y ago
Capsule summary of this thread: Justin Schuh finally comes out and broadcasts what security people have been telling each other for years, which is that antivirus software is one of the biggest impediments to hardening software. Here, I'll put it more succinctly: "did you know that random antivirus vendors held a pocket veto on OS and platform security features, and that they routinely use it to make things easier for their products?" I think by 2016 most people understand that antivirus doesn't work, and that it's installed more as a compliance and IT management check box than anything else. I think people who have paid attention for the last couple years as Tavis Ormandy has published AV bug after AV bug have a good sense for the low software quality of AV systems, and understand how it creates new vulnerabilities on systems. What I don't think we've seen is someone explaining that not only is AV ineffectual and unreliable, but that by dint of being installed across hundreds of thousands of machines and because of the kernel and runtime grubbing that AV requires as part of its security theater, AV makes it much harder to deploy OS and runtime countermeasures to attacks. There was a Project Zero post on HN yesterday (someone can find it) about how Chrome wanted to do full Win32 syscall filtering for its sandbox processes, but couldn't, because Adobe and Widevine relied on some Win32 syscalls --- and so DRM not only doesn't work, and creates new vulnerabilities (cough Flash cough) but also makes it harder for Chrome to implement new security features that can eliminate whole classes of bugs. Same deal with AV. Justin Schuh, by the way, is one of the Chrome security leads, and is a coauthor (with Mark Dowd and John McDonald) of TAOSSA, the bible of software security. I'm not sure who Vess is other than that he's an AV person.
- blub 10y ago
  Browser security doesn't work either. JS offers a huge attack surface by itself and it's difficult to disable it as web developers are lazy and won't want to develop a website which works without it. Every time someone complains here about mandatory-JS websites they're more or less called a luddite. More and more APIs are piled on in the (foolish) quest for native-like web apps. Plugins such as Flash, Java or various document viewers are notorious for being exploit magnets. Let's say we manage to disable JS and plugins though. The browser is written in C++ - and please correct me if I'm wrong - not particularly modern and safety-conscious C++. I am familiar with e.g. Firefox updates and most of them contain security fixed in said code. Underneath we have C libraries for image processing, font management, etc - it's expected that they are vulnerable. So a browser is basically a set of sieves on top of eachother that during the best of times can go several weeks without leaking. It doesn't seem that their biggest problem is AV, it's that their code and the code they rely on is riddled with holes.
ClashTheBunny 10y ago
I think a rootkit and a mitmproxy with very low software quality would make it hard to ship any secure software. Now multiply that by however many antivirus suites exist. Would you type your credit card number into something running on that platform?

joatmon-snoo 10y ago

[editing as this hilarious yet sad Twitter debate unfolds] Justin Schuh is the Chrome browser security tech lead* https://news.ycombinator.com/item?id=6166731 https://news.ycombinator.com/item?id=6166731 April King (GH:marumari) from Mozilla has chimed in agreeing with Justin: "Not speaking for my employer (@mozilla) but AV causes piles of security issues for Firefox." https://twitter.com/aprilmpls/status/804361653420691456 https://twitter.com/aprilmpls/status/804361653420691456 ===== Also, Vess really doesn't know his shit if he's arguing with @taviso. Incidentally, in the span of 26 hours and 37 minutes, @taviso also found massive vulns and attack surface in FProt, which Vess has advocated. https://twitter.com/taviso/status/803714407763062784 https://twitter.com/taviso/status/803714407763062784 https://twitter.com/VessOnSecurity/status/804298404763463680 https://twitter.com/VessOnSecurity/status/804298404763463680 ===== OK, I think this is the original Twitter thread: https://twitter.com/taviso/status/799747942441586688 https://twitter.com/taviso/status/799747942441586688 Some intermediary followup: https://twitter.com/taviso/status/800057733969944577 https://twitter.com/taviso/status/800057733969944577

mikecb 10y ago
Schuh is also the co-author of "the art of software security assessment", the bible of that subject.
riffraff 10y ago
> @taviso also found massive vulns and attack surface in FProt, which Vess has advocated. I see the attack surface tweet, but where are the vulnerabilities he found?
- thyrsus 10y ago
  I expect someone is already running a fuzzer against them. Let's wait a few more hours.

deleted 10y ago

[deleted]

devmop 10y ago

TL;DR AV infects Chrome processes to the point they can't ship security features because they no longer control the application code.

Klathmon 10y ago
And it's not just breaking the actual code, it's breaking the standard communications and formats that all major browsers use. I've personally seen HSTS, HPKP, HTTP2, TLS1.3 and more all get royally fucked by various AV programs. And that's just from doing tech support for my family. I understand that if an AV wants to protect certain aspects they need to get access to it, but using these hacks, workarounds, and more to do it is not only unprofessional but both a security and usability nightmare. It's also why the only AV i'll ever recommend will be Windows Defender. People like to complain that it doesn't "catch as much as the others", but at least it's not actively breaking shit.
dblohm7 10y ago
Firefox dev here. All browsers have a big bulls-eye on their foreheads with respect to AV, and it's not just security features that are held up. These AV products patch our binaries all over the place such that changing any browser internals that happen to be targeted by AV will cause crashes.
- busterarm 10y ago
  On the other hand, users tend to be more hardline about their choice of browser than they are about their choice of antivirus. Perhaps clearly communicating this fact to users and updating your software as you see fit will swing the needle in your favor.
  - masklinn 10y ago
    It'll work no better than for windows. When the browser crashers after it's been updated, users will blame the browser not the shit AV.
    - 10y ago

wmil 10y ago

Justin Schuh seems to be arguing that the issue isn't just hacky deep OS access. He's saying that AV companies follow poor security and stability practices in their software and are creating vulnerabilities.

throwanem 10y ago
He is not wrong. Here's a good, and only slightly exceptional, example from early this year: https://www.exploit-db.com/exploits/39218/ https://www.exploit-db.com/exploits/39218/ (And the relevant Hacker News discussion: https://news.ycombinator.com/item?id=10882563 https://news.ycombinator.com/item?id=10882563)

hedgehog 10y ago

In security simpler is almost always better. Vess is asserting that AV vendors can write their own versions of the most complicated parts of the browser & OS (including parsing & rendering HTTP/HTML/CSS/JS/PNG, JS runtime, etc), then add more code on top of that to detect bad things, and do all of this while adding no significant bugs and with tolerable performance overhead. The reality is that browsers are insanely complicated, the people working on the major browsers are extraordinarily skilled, and there is a mountain of evidence that AV vendors routinely ship software that by design exposes users to huge security risks on top of all of their bugs. Meanwhile security by isolation is proven effective at protecting users. Two good examples are the process-per-tab isolation in Chrome and the app sandboxing on iOS. Some holes into the sandboxes are necessary (for example you need to get keyboard input in and rendered images out) but every additional hole you open adds significant risk. The downside to this approach is it reduces the market for AV and other third party utilities. (I used to work in security)

blauditore 10y ago
I'm not a security expert, but always had a feeling that browsers mostly just need to sandbox websites, so websites cannot do any critical operations that would require AV supervision. "Soft" vulnerabilies like files downloaded and executed are critical outside of the browser, and that's where AV makes sense to me. But I don't want an invasive plugin telling me "this link is safe" with a green, flashing icon. So I've always been trying to just switch off all browser-related features of my AV, but are there AVs that are less aggressive in this matter by nature?
- Animats 10y ago
  browsers mostly just need to sandbox websites, so websites cannot do any critical operations that would require AV supervision. That's the way it ought to work. But it's so tempting to launch stuff from the browser, from Adobe Reader to Flash to Microsoft's "protocol types" which launch apps. The proper role of antivirus programs is as a "guard". When you download a file, a program looks at it and decides if it should be allowed in. This at least gets rid of all those attack .zip files that show up in email attachments. It also has a well-defined interface with the application.

drzaiusapelord 10y ago

>due to lack of APIs This is the elephant in the room. Software vendors dont want to make this APIs as they increase complexity and cost so AV vendors use hackey solutions for a lot of security related tasks. This is a classic conflict that is probably never going away. To MS's credit, they did remove ring0 access to apps like AV and have added OS-level APIs, but the application level guys still consider that bothersome and the AV guys simple need more/better and more flexibility as threats change. The recent stuff in 8 and 10 were engineered well before we had this rash of ransomware attacks. Also from a practical perspective, its very rare to see an AV compromised but we're constantly seeing browsers, plugins, etc compromised. Heck, Firefox just had a zero-day yesterday. I think the argument that AV makes everything worse is the more questionable claim in this discussion regardless of how much we hate the necessary evil AV is. Especially when we consider how the next-gen stuff that's almost purely heuristics will probably replace AV one day and how its much less hacky than current solutions.

rcthompson 10y ago
The thread gives specific instances where AV has made the situation much worse for browsers, mainly by preventing them from enabling many forms of sandboxing.
joatmon-snoo 10y ago
Schuh points out in the Twitter thread that Chrome supports OS-level API's. > its very rare to see an AV compromised https://twitter.com/taviso/status/732365178872856577 https://twitter.com/taviso/status/732365178872856577 https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=symantec https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
- drzaiusapelord 10y ago
  If AV was so vulnerable, we'd see nothing but exploits in the wild going after AV. Yet we aren't seeing that anywhere. If you read the notes you'll see scary terms like "buffer overflow" but "probably wont work on windows because windows uses /GS." I think Tavis does good work but the interpretation of his work is often hysterical. Finding an issue with AV doesn't invalidate the concept of AV. AV is just software. Bugs get found and patched like any other software. I think accepting that isn't asking too much here. Defect-free software is so far humanly impossible for non-trivial applications, let alone for complex security applications. Heck, how many security defects has the linux kernel and openssl had in the past couple years alone? Dozens, or more, and all have been weaponized and trivially exploited. Yet we still use that stuff. Grandma's PC, the PC of a random staff person at work, etc without AV is taken down near instantly. With it, she can avoid many of these security issues. The idea that some defects means AV is without value is a fun and popular opinion with techies, but in the real wold, it does far, far more good than harm.

cesarb 10y ago

> Also, how is AV a (direct) impediment to a shipping a safe browser? It seems to me that a browser should be mostly agnostic toward AV. The main problem is that AV (and some other Windows software) like to inject DLLs into every single process in the system. The current trend in browser security is a heavy form of sandboxing, in which the sandboxed processes can only access a very limited set of system calls. For that to work, the set of system calls required by the sandboxed process must be known, which is only possible if all the code running within the sandbox comes from either the browser or the operating system itself. However, if an arbitrary DLL is injected into the sandboxed process, running arbitrary code and attempting to call arbitrary system calls, the sandboxed process will crash, either because the sandbox mechanism kills the process when it attempts to call an unexpected system call, or because the call attempt returns an error value which the injected DLL didn't expect. Therefore, browser vendors are unable to enable stronger forms of sandboxing, since they'll lead to crashes in the wild.

petra 10y ago
>> browser vendors are unable to enable stronger forms of sandboxing, Is it availble as a setting , for those of us without AV ?
- teaearlgraycold 10y ago
  I doubt they'd have code for that if only a small minority of users will use it. Hardening something takes a lot of effort, and it's probably not worth the work to have two different sandbox techniques just so that users without AV can have a better one.
digi_owl 10y ago
The current trend in security seems to be heavy sandboxing, period. And anything that gets in the way of said sandboxing, however benign, is considered insecure, full stop...
- GauntletWizard 10y ago
  It's the principle of least privilege. Give apps (and websites, and even parts of core services/infrastructure and kernel code) only what they absolutely need. Every syscall you can say shouldn't ever be called is one less avenue for attack. Benign isn't good enough. You need to actively justify every privilege, and leaving a few open for "benign" reasons is bad practice.

jfindley 10y ago

Vess has been in the AV industry a LONG time. A really long time. So long that I don't think he's really able to see the state of the industry for what it is anymore. In the days of windows 95/8, the desktop landscape was very different to how it is now - OSes and browsers were horribly insecure, and readily compromised with little effort. Attacks were plentiful, and infections common. AV really did add useful additional security. These days that's less the case - an up to date windows 10 or OSX desktop is reasonably secure by default - it can still be infected, but generally not without some action taken by the user (of course there are still 0-days, but they are generally treated seriously and patched at least moderately quickly. Unauthenticated RCEs are now a rarity, thankfully). The AV industry hasn't really caught up with the idea that the OS/apps they are messing with are now in general fairly well written and audited pieces of code, and haven't really got institutional awareness that they are making things worse, much of the time. This is frustrating for the OS/app devs, who rightly get annoyed at having AV vendors actively removing protections built into the browser, but also I feel that the AV industry is getting defensive at the bad press generated by things like project-zero, when at least in their own minds they are trying to do something useful. Hence the heated words. ALso, infosec tends towards being a profession of heated language, a lot of the time...

digi_owl 10y ago
Yeah AV had its heyday when we didn't have 24/7 net connections (a problem all its own, i am starting to think) and "infections" happened by way of boot sectors and modified binaries. These days however, infections happen more and more via "clever" interpreted code that can be embedded in just about anything. You best bet for killing a whole lot of crap online is basically to turn off JS. This because http delivered JS is the best way to get past the firewall, that in turn is a blunt, but effective, way at stopping various network born crap.
- JdeBP 10y ago
  There are interpreters for programs that are delivered over the network to be run locally by the unsuspecting user, in some surprising places. For example: Here's a sound player that contains an entire 6502-based virtual machine, because the "sound file format" that it "plays" is actually an executable program. Unfortunately, the virtual machine hardware is not properly simulated, allowing the 6502 code to memory-map parts of the virtual machine manager itself using the virtual memory controller hardware and alter them. * http://scarybeastsecurity.blogspot.co.uk/2016/11/0day-exploit-compromising-linux-desktop.html http://scarybeastsecurity.blogspot.co.uk/2016/11/0day-exploi... (https://news.ycombinator.com/item?id=12951503 https://news.ycombinator.com/item?id=12951503)

AJ007 10y ago

Ironic since Avast sells user clickstream data to third parties..

blauditore 10y ago
Hm, do you know a good alternative?

smnscu 10y ago

Can we all take a minute to appreciate how shit Twitter is at consuming complex conversations like this? It's shameful when something like Imgur (as bad as it is technically) has a comment system that's light-years ahead in terms of conversation readability.

angry-hacker 10y ago
Unbelievable that so smart people prefer this medium. At some point in the conversation they are both confused who is answering who and why. Twitter should just add a damn comment box for each Tweet and be done with this archaic sms system.
- tracker1 10y ago
  Agreed... If they'd just make it so the @replies carry the root and upstream Id's, and make some leeway into their constraints... Is anyone still using the SMS adapter to do anything but send new tweets?
brokenmachine 10y ago
Twitter and facebook both hurt my brain with their UI.

tptacek 10y ago

Capsule summary of this thread: Justin Schuh finally comes out and broadcasts what security people have been telling each other for years, which is that antivirus software is one of the biggest impediments to hardening software. Here, I'll put it more succinctly: "did you know that random antivirus vendors held a pocket veto on OS and platform security features, and that they routinely use it to make things easier for their products?" I think by 2016 most people understand that antivirus doesn't work, and that it's installed more as a compliance and IT management check box than anything else. I think people who have paid attention for the last couple years as Tavis Ormandy has published AV bug after AV bug have a good sense for the low software quality of AV systems, and understand how it creates new vulnerabilities on systems. What I don't think we've seen is someone explaining that not only is AV ineffectual and unreliable, but that by dint of being installed across hundreds of thousands of machines and because of the kernel and runtime grubbing that AV requires as part of its security theater, AV makes it much harder to deploy OS and runtime countermeasures to attacks. There was a Project Zero post on HN yesterday (someone can find it) about how Chrome wanted to do full Win32 syscall filtering for its sandbox processes, but couldn't, because Adobe and Widevine relied on some Win32 syscalls --- and so DRM not only doesn't work, and creates new vulnerabilities (cough Flash cough) but also makes it harder for Chrome to implement new security features that can eliminate whole classes of bugs. Same deal with AV. Justin Schuh, by the way, is one of the Chrome security leads, and is a coauthor (with Mark Dowd and John McDonald) of TAOSSA, the bible of software security. I'm not sure who Vess is other than that he's an AV person.

blub 10y ago
Browser security doesn't work either. JS offers a huge attack surface by itself and it's difficult to disable it as web developers are lazy and won't want to develop a website which works without it. Every time someone complains here about mandatory-JS websites they're more or less called a luddite. More and more APIs are piled on in the (foolish) quest for native-like web apps. Plugins such as Flash, Java or various document viewers are notorious for being exploit magnets. Let's say we manage to disable JS and plugins though. The browser is written in C++ - and please correct me if I'm wrong - not particularly modern and safety-conscious C++. I am familiar with e.g. Firefox updates and most of them contain security fixed in said code. Underneath we have C libraries for image processing, font management, etc - it's expected that they are vulnerable. So a browser is basically a set of sieves on top of eachother that during the best of times can go several weeks without leaking. It doesn't seem that their biggest problem is AV, it's that their code and the code they rely on is riddled with holes.

ClashTheBunny 10y ago

I think a rootkit and a mitmproxy with very low software quality would make it hard to ship any secure software. Now multiply that by however many antivirus suites exist. Would you type your credit card number into something running on that platform?