23 ms·

Avoid Non-Microsoft Antivirus Software

859 points by bzbarsky 10y ago

KayL 10y ago
Most people forget the malware on hacked website. Browsers won't give you a warning. (OK. Chrome will show you a RED screen but not for all) They need not hack into your system. But they collected your login info, credit card. I even want to install one on my MacOS. MS AV still too slow at the moment. In Windows 10, you could turn on Defender to run both AV at the same time.
- deleted 10y ago
  [deleted]
- AntivirusExpert 10y ago
  Running Defender with another AV in parallel is not a good idea, it would lead to serious conflicts
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
chime 10y ago
> At best, there is negligible evidence that major non-MS AV products give a net improvement in security. I apologize for present anecdote when data is needed but I manage a Windows network with 100+ users and on a daily basis, Kaspersky catches 5-10 emails from Outlook that have nasty attachments. It prevents my users from opening these innocuous looking but nasty Invoice-Jan-2017.docx files. Without a good AV there is no way to know which Invoice-Jan-2017 has a virus/worm vs. which doesn't. Relying on the Office security feature is not sufficient because actual vendor/customers send macro-enabled files to us regularly.
- hueving 10y ago
  Does Microsoft security essentials not scan an attachment when you download/open it?
- beefhash 10y ago
  Are you the target audience for this blog post, though? As far as I can tell, the post talks about one-user setups. I'd argue that the starting point in a corporate environment, where you can assume that users can be quite negligent, is fundamentally different from a one-user setup, especially since I agree that you can't "fix" the user in corporate. You want the e-mails gone, not just a warning about it, but a warning is perfectly fine if you're one person and have an idea what you're doing.
  - Angostura 10y ago
    I don't see any caveats in the article about the kind of user that the advice is intended for.
    - frozenport 10y ago
      In your case, the av can run on the Linux mail server.
- shultays 10y ago
  > Invoice-Jan-2017.docx uh, docx files can hack my PC now? Is this a bug of MS Word or docx format really has ability to become a virus?
  - spinsser 10y ago
    It is a feature [0]. Microsoft office products allow for "macros" which are Visual Basic code embedded within a document or a worksheet that can be used by developers to add extra functionalities to their MS files (e.g. validate all data in a work sheet after a user clicks a specific button in the worksheet). Just like any programming language, it could be used maliciously, and there is no easy way to distinguish which macro-enabled file is safe and which isn't (without going through the code yourself prior to enabling the functionality) [0] https://support.office.com/en-us/article/Enable-or-disable-macros-in-Office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6 https://support.office.com/en-us/article/Enable-or-disable-m...
owenwil 10y ago
This is my advice to everyone I know that gets a new Windows PC. Windows 10's built-in protection is more than adequate, and catches the majority of bad software - anything more is unnecessary, and many of the AV vendors are predatory.
- WhiteSource1 10y ago
  Which AV vendors are predatory? (Though Kaspersky makes me nervous). What do you think about ESET?
  - AntivirusExpert 10y ago
    I recommend going by test results and by the features that interest you most. Kaspersky, BTW, has the best scores (See here: https://bestantivirus.reviews/tools/test-results-calculator https://bestantivirus.reviews/tools/test-results-calculator) but Bitdefender and Avira are also great according to these tests, and Bitdefender is my choice, personally.
    - WhiteSource1 10y ago
      Kaspersky just worries me because of the Russian connections https://www.bloomberg.com/news/articles/2015-03-19/cybersecurity-kaspersky-has-close-ties-to-russian-spies https://www.bloomberg.com/news/articles/2015-03-19/cybersecu... It's sort of like Cloudflare protecting against DDoS attacks while also protecting booters.
  - Neil44 10y ago
    I have 150 ish machines on eset across a few different clients, obviously my experience with it has been very good over the years in all aspects. Eset don't offer the biggest margins but I stick with them because it doesn't cause support issues and I can count the number of infected eset machines I've had to deal with on one hand.
  - lmm 10y ago
    McAfee in particular aggressively pushes "free trials" (often getting them bundled into the installers of unrelated software) that will then show scarily-worded warnings encouraging you to buy once the trial has expired.
aszantu 10y ago
Granny won't believe me :( she feels safer because of some popup that tells her she's safe.
- dschuetz 10y ago
  This is the most authentic argument I have read so far on this subject. People do not care about vendors. People care about how they feel. For everything else going beyond the "You are safe!" popup (try to explain "DLL injection?" to your Granny! Okay, "blocking updates" she might understand) a user needs a far deeper understanding of what goes on under the hood of the OS, or practically any software based on said OS. "Uninstall AV software" does not make people feel safer, now that the narrative of "AV is making the Internet safer" is practically standard.
- currysausage 10y ago
  Maybe you could create a scheduled task that opens Windows Defender every 2 hours or so? It also has beautiful green buttons that show her how safe she is, and an orange warning every once in a while when she should do a quick scan. There's also some new security center coming with the next Windows 10 version: https://blogs.windows.com/windowsexperience/2017/01/23/introducing-windows-defender-security-center/ https://blogs.windows.com/windowsexperience/2017/01/23/intro...
- mynameisvlad 10y ago
  A recent Windows 10 Update (I don't remember which) brought in periodic notifications from Windows Defender. They're not big bright green checkmarks, but it's a step in the right direction.
- doczoidberg 10y ago
  Not only your granny. I also want to remember the android icon which gained thousand of 5 star reviews for 'protecting' the smartphone. https://www.theguardian.com/technology/2014/apr/10/fake-android-antivirus-app-developer-virus-shield https://www.theguardian.com/technology/2014/apr/10/fake-andr... I don't have an AV on my windows machine since ~8years and no problems so far.
- 10y ago
Acalyptol 10y ago
Might be true for people who know what they're doing. However I've seen a decrease in the number of toolbars installed in my mom's computer since I've installed an antivirus.
- e40 10y ago
  Is she on XP or something without Defender?
rubbingalcohol 10y ago
It's irresponsible to make such a broad claim and back it up with really vague anecdotal evidence. Yes, there are a lot of lousy AV products that are at best a break-even for security, but there are some that don't suck and generally you have to pay for them - what a strange concept. I'm not going to advocate for any particular vendor as I used to work for an AV company (and currently use a product from a competitor). But I can attest that I've used products that have caught threats that Windows Defender didn't, and many products also include a much more robust and configurable firewall. It's annoying when someone else's lousy code breaks your own code. This happens to the sites I administer frequently, where we will randomly get blacklisted by some no-name AV product's web security feature. I understand the frustration when you have no control over this. But to conclude that all AV software is bad does not follow from the evidence given.
- krylon 10y ago
  > really vague anecdotal evidence [...] > I can attest that I've used products that have caught threats that Windows Defender didn't Since you brought it up, the latter statements sounds suspiciously like the very definition of "really vague anecdotal evidence. SCNR
  - nurettin 10y ago
    Perhaps it is counter-anecdotal evidence showing the futility of anecdotal evidence as a whole.
- jpcosta 10y ago
  I completely agree with you, I find this "disable antivirus" to be such a bad advice! Yes, it may work for tech savvy or security aware person. If you know what you're doing you're much less likely to get into problems. It won't work for general public though. And the argument being made that "for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors" could be made for any piece of software your install.
  - 10y ago
tempestn 10y ago
What's more, as third party antivirus software becomes increasingly irrelevant, many of these companies resort to harmful and even actively malicious tactics to stay in business. On the more benign end, you see an increase in 'safe web browsing' and such tools that parse javascript while browsing and somehow attempt to make it.. safer, I guess. My main experience with these things is when they randomly decide to block bits of code on our sites, breaking functionality for no discernible purpose. Far worse are the lengths that a company like AVG will go to to get and keep their software installed on your computer. Their browser toolbars essentially take all the dirty tricks they've apparently learned dealing with malware to.. build a piece of malware. Honestly whether it's active malice, incompetence, or lack of motivation I don't know, but I do know I've spent hours trying to extract their stuff from people's browsers. (I should say here that I fully expect someone reading this has managed to uninstall an AVG toolbar with no issues. They have multiple different auxiliary tools to their antivirus, and I'm not sure specifically which one(s) caused me trouble personally. It's also likely that they're only a _real_ pain in certain circumstances. But regardless, if you google something like 'how uninstall avg' or 'avg malware' I'm sure you'll find many more examples.)
- t0mek 10y ago
  A friend of mine worked as an on-site contractor for the AVG. He claimed that the "toolbar department" in the company, working on the browser toolbar displaying ads is as big as the "antivirus department", working on the engine (or bigger). It shouldn't be a surprise, since the toolbar is the main revenue source for the company.
- TeMPOraL 10y ago
  > I should say here that I fully expect someone reading this has managed to uninstall an AVG toolbar with no issues. They have multiple different auxiliary tools to their antivirus, and I'm not sure specifically which one(s) caused me trouble personally. I can say this: I never had a problem with uninstalling a browser toolbar, or restoring the default search engine in the browser. What I always have problems with, is getting rid of AV software itself. Oh God, how hard it is sometimes. Norton AV taking half an hour to uninstall is a known thing; I'm convinced they actually have some Sleep() calls in their code just to piss people off. But just last week I tried to get rid of Comodo AV (+ 2 bullshit pieces of software it installed) on my neighbour's computer. Took a while. The uninstaller didn't work (it reported "an error" and gave up), so ultimately I had to resort to manually deleting stuff until the uninstaller finally unlocked itself and cleaned up the rest. I've been having similar experiences with all AV software in past few years. They're a menace.
resfirestar 10y ago
"Microsoft AV products" aren't exempt from breaking things with poorly implemented features. MSE on Windows 7 makes games (specifically, fresh installs of StarCraft II, CS:GO and Overwatch) unplayable for me due to CPU usage spikes, apparently due to it thinking that various game executables and settings files are suspicious. Exempting the directories from scanning and disabling suspected malware sample submission had no effect, what finally worked was switching to school-provided Sophos Endpoint. Antivirus can get messy and intrusive no matter who does it.
- raesene6 10y ago
  The thing is most anti-malware products cause perf. issues, but it seems to be the 3rd party ones that actually make your security worse with poorly implemented and secured features. It seems bizarre to me that commercial paid for security products have such poor coding practices that a lone (albeit very talented) researcher can find so many dangerous security vulnerabilities in them. These vendors should be leading the way in secure coding and design due to the high-privilege level their code runs at.
aarongolliver 10y ago
Defender has the nasty habit of aggressively scanning new games I download off Steam. There are two occasions where it'll do it: - While it's downloading it seems to scan each chunk. I have a gigabit connection, with defender off I can download at nearly full speed. With it on I can download at about 1MB/s. - While the game loads a level. For example, the intro level to the new Deus Ex took over 10 minutes to load the first time. At that point I disabled defender entirely and just promised myself I would be careful. Naive, I know, but at least I can play my video games.
- Already__Taken 10y ago
  You can give it paths to exempt you know. https://www.tenforums.com/tutorials/5924-windows-defender-exclusions-add-remove-windows-10-a.html https://www.tenforums.com/tutorials/5924-windows-defender-ex...
  - aarongolliver 10y ago
    Yeah, but if you piss me off enough times I'm exempting all of my hard drives. It hasn't caught a single virus since 2009. I've not found it that hard to stay safe online.
- Tepix 10y ago
  I wonder, have there been cases where viruses or trojans were spread via Steam?
leni536 10y ago
I have the impression that the AV business is some kind of mixture of scam and mafia.
- pjmlp 10y ago
  Users are to blame by pirating software. Of course, pirates don't do it for free.
  - divanvisagie 10y ago
    How does piracy come into this?
    - thecatspaw 10y ago
      lots of binaries are not only patched to circument DRM, but also to contain malware
      - divanvisagie 10y ago
        How does this relate to the issue that antivirus companies do horrible things and hold ignorant paying users who don't even know how to pirate software, and legitimate software producers hostage like some sort of technical mafia?
        pjmlp 10y ago
        Because they only became a business due to the people that were pirating software in the 80's. Thanks to the increase of virus across MS-DOS, Atari, Acorn, Amiga and Mac operating systems, specially on boot sector floppies, the general public learned that anti-virus were required software to always have installed.
        divanvisagie 10y ago
        So are you saying that if people didn't pirate stuff the viruses would not have spread? Presumably because they would not be using floppies as much?
mherrmann 10y ago
As someone who develops a (PyQt-based) desktop app [1], I can confirm this: My app has so far falsely been put into quarantine by Avira and McAffee. It's a pain... [1]: https://fman.io https://fman.io
- galfarragem 10y ago
  Your app looks promising! It seems heavily inspired on Sublime and that's a very good sign. Is it available already?
  - mherrmann 10y ago
    Yes - click the big "Request early access" button on the home page.
- pacifika 10y ago
  Could you blog / expand on the packaging story for your product please?
  - mherrmann 10y ago
    If we're only talking about packaging, I recommend you search for "PyInstaller" on the blog [1]. For auto updates, search "Sparkle"/"Omaha". 1: https://fman.io/blog https://fman.io/blog
zamalek 10y ago
As always, it depends on the product that you are referring to. Purely by coincidence, I installed [product] again a few weeks ago, after having used Defender since Windows 10 launched. > see bugs in AV products listed in Google's Project Zero All software has vulnerabilities, including Defender. Searching for [product] in Project Zero shows that only 3 vulnerabilities have been discovered (which is arguably a bad thing, but not according to this author) and it took, at most, 4 days for them to be resolved. > if they make your product incredibly slow and bloated This is precisely the reason that I have returned to [product]: performance. I'm running off an HDD and Defender saturates my HDD for a good 2 minutes after boot. I don't experience this with [product]. In addition, it has a "gaming mode" which allows you to further cut back on its activity (I have never needed it). Looking at objective tests, Defender fares quite poorly in both performance[1] and protection[2]. Additionally, a homogeneous market is an easy market to exploit. Let's assume that everyone took this advice and installed Defender. It is guaranteed that Defender has vulnerabilities. If you wanted to pwn as many machines as possible, you would only have to worry about exploiting a single AV. This is just bad advice, I'm sticking with the competition (which may not always be [product]). There are bad players (McAfee, Norton) but that does not mean everyone sans Microsoft is utterly incompetent. [1]: http://www.av-comparatives.org/wp-content/uploads/2016/05/avc_per_201604_en.pdf http://www.av-comparatives.org/wp-content/uploads/2016/05/av... [2]: https://www.av-test.org/en/antivirus/home-windows/windows-10/ https://www.av-test.org/en/antivirus/home-windows/windows-10...
- rubber_duck 10y ago
  >I'm running off an HDD and Defender saturates my HDD for a good 2 minutes after boot. Yea, that's why I disable all AV - every install or clean build or untar or w/e brings the PC to a crawl. Haven't had problems yet.
- masklinn 10y ago
  > All software has vulnerabilities Most software doesn't run in ring0. And most software doesn't actively break exploit mitigation techniques in other software either.
- roca 10y ago
  All software has vulnerabilities but not all software has the egregious blunders that Travis Ormandy finds --- so many, in such a short period of time. Furthermore, most software provides value that offsets security risks. Since the entire value of AV products is to improve security, when they fail to do that, they're worse than useless. The homogeneous market argument is weak. If a determined attacker wants to compromise as many machines as possible with a single attack, they'll come up with an exploit that passes all AV products.
EJTH 10y ago
I really haven't had any real use for AV software after i disabled flash on all my browsers...
elorant 10y ago
I was running a crawler the other day on one of my PCs from a console app. Then suddenly the antivirus discovers that a page is infected, terminates the connection and wrecks havoc to the app which stays hung there for hours and I'm unable to terminate or even kill it from Task Manager. I had to restart the PC for the task to be forcefully killed. Thanks but no thanks. I uninstalled the damn thing the next day. How the fuck did antivirus software became too intrusive?
- smarx007 10y ago
  What's the difference between your crawler and the botnet client as far as the AV concerned? You're the outlier among the AV customer segment.
0xFFC 10y ago
It's fucking disaster to read your blog in iphone, please fix it. At least disable fixed width or disable right left surfing. I am not web developer, so i may give wrong suggestions, but please fix you template it is like piece of shit( the experience)
- 0xFFC 10y ago
  I don't understand why i got downvoted ao badly. I didnt say anything about his blog or material in his blog, i just couldn't read/navigate his blog in my phone. The template was a total disaster
  - JustSomeNobody 10y ago
    Likely it was your tone. When you start your comment off with "It's a fucking disaster..." people get insulted.
  - sctb 10y ago
    We don't comment like that here on Hacker News, and we're also asked not to complain about downvotes. Please re-read the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
bad_user 10y ago
I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software developer, only noticed it because I saw green icons appearing in my search results and then noticed that Google's SSL certificate is now a fake. And I only noticed it because I know how this shit works and those green icons seemed suspicious. And yes, I'm using the word "fake", because I doubt that companies like Bitdefender have to pass the same certifications as a certificate authority or that they have any deals whatsoever with Google. And it's a serious vulnerability, because their certificate can get stolen and used by malicious software, not to mention you now have to trust a third-party with all of your secure connections, which includes your Google searches exposing your most secret desires, your Facebook and Slack chats, your bank account, everything. A third-party that does not have the scrutiny of your open-source web browser. That's just preposterous and these products only survive because users are gullible and technically illiterate.
- disiplus 10y ago
  i dont think you understand how this works. they install a root certicicate on your machine and do mitm "attack" so they can scan the urls, and block some attacks (i remember when some forum had embeded a pdf, that had some attack and antivirus blocked it ) also you have installed an application that has a root acces to the pc, if it was mallicius it could do allot more damage. it is ultimately a question of trust. i created and installed my own root certificate because i dont want clicking on the exception if i open a new incognito window, its especialy anoying for websocket connections.
  - bad_user 10y ago
    I don't think you understand how HTTPS works. > so they can scan the urls, and block some attacks The purpose of HTTPS is to provide a guarantee that your connection to Google is direct, with no intermediaries, such that (1) only Google knows your search query and (2) you get a guarantee that the received content is from Google. And you get this guarantee from certificate authorities that have a good reputation and that are in business because they've proven they can keep their shit secure. And when one of them violates that trust, the OS / browser vendors can start to invalidate their certificates. AV companies are bypassing it all. The blocking of attacks reasoning is kind of bullshit, because Google's Safe Browsing service and browser extensions maintained by a community like uBlock Origin are doing a better job of warning against potentially malicious websites. There are always vulnerabilities to exploit of course, though it's getting harder for those to pop up due to the modern sandboxing of browsers. However I have yet to see evidence that AV software is doing a better job of catching those, because it's a whack-a-mole game and it's more likely that browser vendors find and fix those vulnerabilities faster than AV companies, because bugs get reported to browser vendors first. And sure, if you have Adobe Reader or Oracle Java installed as plugins in your browser, that's a huge risk, but it's actually easier to uninstall those and browsers have started disallowing plugins. Safari for example is disabling everything by default. The problem with installing their own root certificate is precisely one of trust. Yes, you allow a piece of software to run with root permissions, for as long as you don't see it do stupid shit, like installing a root certificate, at which point all of that trust should be gone. And that is because a custom root certificate that doesn't belong to a competent certificate authority cannot be trusted and will increase the attack surface. This is security 101.
interfixus 10y ago
This - minus the Microsoft part - is what I have been preaching for many years, even back in the late nineties, before pulling myself together and decamping for Linuxland. But users insist. I have probably never convinced anyone to go without the AV, at least not on a permanent basis. The best I can do is usually to set up som ClamWin and a daily or weekly scan for everybody's peace of mind.
z3t4 10y ago
While many AV companies are really bad, AV per say is still an extra layer of security. Telling people to remove a layer of security is bad advice. There's a problem though and if I knew how to solve it I'd be rich!
- pabloski 10y ago
  Security? The open more holes than they close.
- guardian5x 10y ago
  That's not how Security works at all. Its not about adding layers of security. That would imply installing 10 AntiVirus would be even better. But instead you're just increasing the attack surface, and slow your system down.
- pvdebbe 10y ago
  It could be an extra level of security if they ran in userspace or in-between. But they usually have enormous permissions to operate and doesn't really count as a whole new layer.
- draugadrotten 10y ago
  if you really want to add an extra layer of security, add the layer outside your computer. You know, like adding a moat outside the castle. https://s-media-cache-ak0.pinimg.com/564x/96/12/a6/9612a6cd64fe89d6efe9734320d136ff.jpg https://s-media-cache-ak0.pinimg.com/564x/96/12/a6/9612a6cd6...
kriro 10y ago
Some good points. The antivirus software itself is probably an interesting attack vector. However I don't like the assertion that Microsoft scanners are sufficient without some evidence (and In wouldn't be shocked if the MS-AV software itself was exploitable, too). At least run some tests and compare a couple of state of the art products. The situation is generally bad, AV vendors are often shady. However I think "vet your AV vendor" is much better advice.
- Beltiras 10y ago
  Most computer users are not competent enough to use their machine properly (and need stronger AV to protect them). What makes you think they have the technical capability to "vet their AV vendor"?
  - kriro 10y ago
    Those users usually rely on some support structure which I assumed was the intended audience of the article. At least I wouldn't expect my parents to even search the internet for some article that tells them to turn off all antivirus except Defender.
franciscop 10y ago
I will consider this. I "maintain" my relatives computers which is basically to install an anti-virus and adblock. They still get those sketchy messages from friends from time to time though, which is the main reason that I keep them with an AV. Is this correct? Does AV improve security for people who cannot differentiate between a .pdf and an .exe? Personally I don't use an AV, I am a bit paranoid and technical competent so my case and my relatives is totally different.
- gtirloni 10y ago
  I don't use an AV either, but I'm very careful with the things I download (and I don't download new stuff very often). My relatives, on the other hand, will click just about anything that says "click me" (even more if it says they will win a prize or something). Windows Defender is great and it's enough for me but my relatives need something that cover more areas. Any way you can think of tricking them, they will fall for it. Even with AV, they routinely install malware (those that are too new to be in the AV database or using new techniques not covered by heuristics). As far as I know, my relatives don't do anything but sit in front of their computers trying to install malware ;)
  - roca 10y ago
    An iOS device, or better still a Chromebook, would be pretty good for users like these.
    - franciscop 10y ago
      I don't even live in the same country so it's more of a "when you are around can you check this please?"
  - nashashmi 10y ago
    My love for Windows Defender came when it was called Giant Anti-Spyware (founded by Oz). It managed to find 4 pieces of spyware on my computer, and I consider myself technically competent enough to clean spyware manually. When I ran the same software on another computer, it managed to find 3284 pieces of malware. And to think I was planning on doing it manually, eh eh. (It had an antispyware software that did nothing.) Eventually, Giant went mainstream and malware became smarter to work around it. At which point, MBAM came to the rescue. My next favorite anti-malware.
billpg 10y ago
My pet gripe: Warning me about cookies as if they are malware.
Hydraulix989 10y ago
I've seen false negatives multiple times in Microsoft's.
neko_koneko 10y ago
Ok, disclaimer first: I've previously worked at Kaspersky Lab (incident response division). Now, I want to say that many of the incidents that we have investigated, would have been prevented by anti-virus software (in many cases AV software was deliberately disabled by user). And I'm talking about incidents that resulted in million-dollar thefts - not just cases of some user getting cryptolocker on their home computer. I agree that AV software is bloated and has very large, messy and barely maintainable codebase, but I disagree with people who say that "I have never used any AV products and in 10 years have never been infected with malware" - this attitude is careless, to say the least, and in corporate environment could lead to huge financial losses. There are many criminal groups that put serious effort in the development and distribution of malware - not just script kiddies, but professional programmers and hackers. BTW, there are also region-specific malware - so for example I would rely more on Kaspersky for detection of malware targeted at Russian businesses, than Symantec or Microsoft AVs.
- hetfeld 10y ago
  Russian antivirus? For corporation? No, thank you, komrade.
- kbart 10y ago
  I'm pretty sure no AV would help against targeted attacks on high profile target. If you have multi-million business to secure, you play at totally different risk model.
  - lmns 10y ago
    That's exactly what I had in mind when I read the GP. If third party AVs have a large and complex codebase with unknown or even known security flaws, they won't help much against targeted attacks or make them even easier. On the other hand, AV usability is so bad you can't expect it to help "normal" people. All those popups do more harm than good when people start ignoring them.
    - neko_koneko 10y ago
      Well, I agree that AV most likely wouldn't protect you against targeted attacks - but most of the attacks that we investigated were targeted quite broadly - phishing email campaigns targeting financial organizations (with address lists based on some hacked legitimate resources for accountants, for example). And usually these attack succeeded because of insecure infrastructure, poorly trained admins, old, non-updating systems (some people still think using Windows XP on internet-connected computers is fine), and lack of AV software.
delegate 10y ago
Who writes all these viruses ? I mean, I've experimented with assembler when I was a teenager and I may have developed some kind of program which could replicate itself.. but I highly doubt today's viruses are written by teenagers... Who and why do people write viruses ? Is this a thing at all or are all the viruses written by the Antivirus makers themselves ? More 'threats' is good news for the A/V makers so why not have a separate department which develops them ? I wouldn't be surprised at all, given that much crazier things are happening in this world.. Can anyone confirm or disprove this ?
- neko_koneko 10y ago
  There are many criminal groups that develop malware - it's a multi-million dollar business.
- Maakuth 10y ago
  If you have some time to watch a video, here's a clip of F-Secure's Mikko Hyppönen expaining some of the origins of network attacks and malware: https://www.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net https://www.ted.com/talks/mikko_hypponen_fighting_viruses_de...
  - hsivonen 10y ago
    Speaking of F-Secure, has taviso just not looked at F-Secure yet or does F-Secure not have egregious blunders?
- gtirloni 10y ago
  Confirm that AV vendors are writing the viruses themselves in order to boost their sales? Good luck with that. There are plenty of reasons why people write malware/viruses, often for financial reasons. The old days of a teenager writing some virus in assembly to infect bootsectors for the lulz is way past us. Today you're looking at malware, often exploiting social engineering, to create botnets for DDoS, spam, boosting social profiles, etc. Occam's razor helps :)
- billbail 10y ago
yrio 10y ago
What about open source antivirus software like ClamAV?
- floatboth 10y ago
  Usually used on email servers.
- exadeci 10y ago
  It's perfect! I use http://www.clamwin.com/ http://www.clamwin.com/ which is just an easy way to install it. There was a pdf about antiviruses that was posted a few month ago IIRC and they all had huge flaws except surprisingly ClamAv which had minor ones.
tehabe 10y ago
Just yesterday I had the computer of a friend in front of me, it had three anti-virus applications installed. No idea which was running. I wonder though, do those uninstall mechanism actually work and remove everything? I kinda have my doubts.
doczoidberg 10y ago
half offtopic: do I need an AV software on my android smartphone? Friends always ask me which they should use (because I am the "computer guy") and I tell them that I don't have one.
- floatboth 10y ago
  If you don't install pirated apps from shady sources, you absolutely do not need AV on your Android device.
  - tootie 10y ago
    My android seems to have some sneeky adware on it and I've never installed anything not for the Google or Amazon stores or written myself.
    - floatboth 10y ago
      Of course, you have to look at what you're downloading from the stores, Google Play isn't aggressively pre-moderated like the Apple App Store. Still, apps are sandboxed and can't do really evil shit without special permissions. Make sure these random apps don't request the "draw over other apps" one.
Osiris 10y ago
This is what I tell my family and friends. Whenever I help someone upgrade to Windows 10, or work on their computer, I tell them to just use Microsoft Defender. I've also read various reports of security problems with AV software, so I'm not comfortable recommending anything third-party. Defender + uBlock is a pretty simple and effective combo.
roryisok 10y ago
I've been beating this drum for years, MS Security Essentials is the only passably decent antivirus app there is, and seems to be the only one that doesn't try to scare users into paying for upgrades.
ForFreedom 10y ago
I got for free Norton Security with my new Dell laptop. On installing I was unable to enable windows defender or firewall. Norton takes over the security by default. I contacted Symantec and had to uninstall Norton Security and install Norton Antivirus for the windows firewall to be activated.
- hsivonen 10y ago
  The first thing you should do with a PC is to delete all partitions and install a fresh OS. Even if you aren't installing Linux, you should download untampered Windows 10 (the same edition that the PC came licensed for) from Microsoft and do a fresh install without OEMware.
  - WorldMaker 10y ago
    Or make sure you buy a "Signature Edition" PC in the first place, which is Microsoft's program for "junk free" systems [1] you can find in Microsoft Stores or if you ask the right Best Buy or office store. [1] https://www.microsoftstore.com/store/msusa/en_US/cat/categoryID.69916600?icid=MSstore_footer_PR_Signature https://www.microsoftstore.com/store/msusa/en_US/cat/categor...
StreamBright 10y ago
Anti-virus software is an anti-pattern in general. Having more bugs and backdoors than the rest of the applications combined. I havent been using anti-virus for the last 5-10 years I have just a simple rule set for using internet and it proved to be sufficient for me. However, I have many friends with anti-virus softwares and they still got viruses on their systems. I guess this is anecdotal evidence but I would like to see a comprehensive study on how effective anti-virus systems are. https://googleprojectzero.blogspot.hu/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.hu/2016/06/how-to-comprom...
fuzzy2 10y ago
I'd like to agree. But I can't. Even if disregard detection scores, Defender/Security Essentials is slow. It uses humongous amounts of CPU time, which slows down slower PCs (like Celeron N3150) a lot. It also tends to saturate disk I/O. In short: It sucks so bad it's virtually unusable.
mtgx 10y ago
What's wrong with avoiding Microsoft anti-virus, too? Or os he giving this advice only because most people can't disable Microsoft's antivirus anymore, anyway?
- roca 10y ago
  Because my guess is that Defender is reasonably implemented and does the basics right, and therefore is significantly better than nothing for the average user. That guess is based on anecdotal observations of the quality of developers and practices at Microsoft vs what we've learned about A/V vendors via bug disclosures.
- robjan 10y ago
  It's explained in the article
adamconroy 10y ago
AV software is a great example of a cure being worse than the disease
SuperVivid 10y ago
Couldn't be said oft enough. Still seeing people buying a new "security suite" every year.
baal80spam 10y ago
In principle, I agree with the article. Personally, on Win7 I use a combination of 3 things: - MSSE - TinyWall as a lightweight firewall - heavily modified HOSTS file Never had malware/virus problems and sometimes I do visit shady webistes or download quirky software.
- huhtenberg 10y ago
  You want to add EMET to the mix. https://microsoft.com/emet https://microsoft.com/emet
mtgx 10y ago
Yeah, trust Microsoft, he said: http://www.theverge.com/2017/1/25/14381174/microsoft-thailand-government-surveillance-thai-censorship-encryption http://www.theverge.com/2017/1/25/14381174/microsoft-thailan... Isn't it funny how at the same time someone is recommending to not trust other anti-viruses because they MITM you with their own certificates, Microsoft is doing the same god damn thing, or worse (allowing a whole country to spy on you through it, and not just itself). > “This program is an extensive review process that includes regular audits from a third-party web trust auditor. Is that the same auditor that audited WoSign as well? https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new... Why hasn't Microsoft started requiring Certificate Transparency yet for all certificates? Maybe then I'll believe them when they say they're sure nothing wrong is going on here.
galfarragem 10y ago
Any relevant information about Avast? I'm using their free version for 10 years and don't have any major complains.
- smasty 10y ago
  Avast also does HTTPS MITM. It's on by default, but can be disabled in Web shield preferences. I've just tested it in a clean VM running Windows 7, and the MITM didn't work in current Firefox stable, but it did in IE. However, as far as I can tell, it only MITMs DV certificates, not EV. Also, when it MITMs a self-signed certificate, it generates an untrusted certificate, but it says it was generated by Avast, so the user could trust it more easily. Also, in my experience, the free version of Avast considerably affects performance on slower machines (no SSD, earlier-gen CPU, etc.), but YMMV. It also tries to install Chrome as a default browser, a Google toolbar for IE, various "Secure browsing" extensions to other browsers and lot's of other annoying crap.
karlb 10y ago
Does this apply to Macs? I know that many Mac users don't use anti-virus. Are they right not to?
- floatboth 10y ago
  If you don't download apps from random shady sources, you don't really need AV. Recent versions of macOS default to only allowing apps from the App Store.
  - hmage 10y ago
    > Recent versions of macOS default to only allowing apps from the App Store. That's incorrect, with the introduction of Gatekeeper the default setting for it was to allow only signed apps — all app store apps are signed, but developer can sign apps outside of app store. The default setting didn't change since then.
deleted 10y ago
[deleted]
jagger11 10y ago
security software doesn't mean secure software
jug 10y ago
For the past years it seems like even Windows (given the large attack surface) viruses/trojans have become much less common than in the past. I think the first line of defense in web browsers and various techs like SmartScreen etc. has helped especially with fishy porn ad ridden websites wanting to download FixWindows.exe, but also that we've moved to often use cloud oriented tools. Nowadays we visit websites to get things done way more often than in the 80's / 90's when we ran executables from some friend's diskette or hard drive. And as long as we visit websites it's way too much effort to exploit weaknesses in their sandboxes that this is then almost entirely about targetted attacks. Another example of how obnoxious it is becoming to merely _get_ to someone's computer to infect it now that users rely less on executables, is that the Fake Indian Microsoft Support Technician has become a thing. Actual humans calling other humans and hoping for the best by social engineering. This is so far fetched and works so rarely that the desperation is real. E-mail has been another traditional way of getting to someone but that's nowadays mostly Outlook.com or Gmail.com, which have their own very efficient AV systems in place. I guess my point with this is that even Microsoft's so-so antivirus tool (given that it's less intrusive) should indeed be enough. Hell I think a user with common sense will be fine with no AV whatsoever for longer than one may think.
gravypod 10y ago
How about we avoid all antivirus software, integrate virtualization as a key feature of the UI of our operating system, and completely sandbox all apps. We have the technology to do this (Qubes does it now) but it's not going mainstream. I don't know why but I think this would be the end goal of computing. Completely segregate your work from your machine and only give it access to things that make sense. (Chrome doesn't need to see /etc/nginx or be able to run systemctl). I also don't think we should trust Microsoft to not use similar exploits as other AV products in the future and I think the biggest problem here is primarily an issue for proprietary software. One example is "Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security" I have a hard time beliving that a libre-AV would have this problem. I've never seen bad architecture prevent security fixes and I've never seen bad architecture stay for long when it's only one rewrite away from being fixed. (I'm making no comments about compatability because no doubt even the command arguments will be renamed and their order will be changed)
- Klathmon 10y ago
  >We have the technology to do this (Qubes does it now) but it's not going mainstream. It is starting to go mainstream. Most mobile phones do a lesser form of this, most "web apps" do a very similar form of this, even new windows 10 UWP apps are pushing in this direction. Everyone knows it's needed, and many see how good of a solution it is, and how much MORE can be done once there is a good baseline, but that line needs to be walked very carefully. Once apps stop being able to do their job because of un-escapable restrictions, it becomes a problem. And once it becomes a problem, people (both developers and users) will start actively trying to get around it, which means it's not going to work at all.
- sjellis 10y ago
  > How about we avoid all antivirus software, integrate virtualization as a key feature of the UI of our operating system, and completely sandbox all apps. This is basically the end-game for Flatpak: https://blogs.gnome.org/alexl/2017/01/24/the-flatpak-security-model-part-3-the-long-game/ https://blogs.gnome.org/alexl/2017/01/24/the-flatpak-securit... Flatpak is vendor-neutral, but it will provide the sandbox isolation that may then enable Fedora to ramp up to Atomic Workstation, a fully containerized desktop OS: https://fedoraproject.org/wiki/Workstation/AtomicWorkstation https://fedoraproject.org/wiki/Workstation/AtomicWorkstation Hopefully we will see other Linux distributions integrate the technology as it matures. FWIW, Microsoft are developing VM-based isolation for the browser: https://threatpost.com/microsoft-edge-adds-app-guard-browser-security/120925/ https://threatpost.com/microsoft-edge-adds-app-guard-browser...
warcode 10y ago
Haven't had any issues with ESET NOD32 in the last 10 years. I've turned off the MITM on https though.
dirtyaura 10y ago
If you need AV, consider F-secure. They do quality products and take security seriously. Mikko Hyppönen, famous for his TED talk, is from F-Secure https://www.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net https://www.ted.com/talks/mikko_hypponen_fighting_viruses_de...
- DavideNL 10y ago
  A year ago F-Secure had very bad detection results in AV comparatives test. However, it seems they have fixed that now... http://chart.av-comparatives.org/chart1.php?chart=chart2&year=2016&month=Jul_Nov&sort=1&zoom=2 http://chart.av-comparatives.org/chart1.php?chart=chart2&yea...
youdontknowtho 10y ago
I've often wondered how much energy has been waster on AV. All of those hard drives thrashing and all of those scans.
- pbhjpbhj 10y ago
  It's probably sold a lot of PC upgrades too.
JustSomeNobody 10y ago
What always bothered me about MS Windows was that for a long time one HAD to use 3rd party AV SW. This should have been MS's responsibility from the very beginning. I don't go to third parties for seatbelts and anti-lock brakes when I buy a car. I shouldn't have had to use a 3rd party AV SW.
- rocqua 10y ago
  Linux doesn't supply a 1st party AV solution either. Windows maybe could've responded faster to the creation of so many viruses, but it takes a really popular OS for AV to become a neccesity.
- WorldMaker 10y ago
  Microsoft had an injunction from the anti-trust lawsuit that they couldn't bundle AV with Windows because that would be "anti-competitive", which is why Security Essentials had to be downloaded for XP/Vista instead of just coming installed. Lucky for all of us the statute of limitations on that decision finally expired. I agree, something like AV should be a function of the OS, not a "competitive" (race-to-the-security-theater-bottom) bolt-on from some third party.
Spooky23 10y ago
Pretty questionable advice. Microsoft AV is fast and non-disruptive, but is a laggard in terms of effectiveness, even by the standard of AV. It's best used when you need to check the AV box, and it is less disruptive than other solutions.
Roritharr 10y ago
My main problem with this state of affairs is compliance. We have customers that require us to get certain certifications from TÜV. The TÜV asks your whole company to have certified AV Software in place on all machines. They do not accept Windows Defender as a dedicated AV Solution, or atleast did not the last time. I'm still unsure what to tell them about our Macs and Linux Notebooks that we've acquired since the last audit. Does anyone have a solution for this?
tptacek 10y ago
In case you're wondering, this is basically the advice that most security people will give you as well, if you exclude "antivirus people" (who are really off in their own weird world), all of whom will say "use our company's product first, but no matter what you do, don't use Microsoft's".
cube00 10y ago
Tried this with my parents, they said "can you guarantee that this free Microsoft thing will catch everything McAfee would?". There is a lot to be said for the skepticism around "free" products.
herbst 10y ago
I always think its super funny when a fucking ad pops up on someone desktop. Usually done by anti virus tools. And how casually people click it away is just amazing.
justin66 10y ago
Any idea why the author is picking on Windows 7 here? Microsoft's free AV works as well on Windows 7 as it does on Windows 10. Perhaps it should go without saying --- but you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.
- jamesgeck0 10y ago
  Microsoft's free AV works on Windows 7, but was only installed by default starting in Windows 8.
hydrogen18 10y ago
As a former IT support guy, I can't explain how much revenue Norton would generate from me. They would regularly push updates that wiped all the critical software from customer's systems. The software was often obscure products from small vendors. Even in a small office, it was an easy day's work for me that I would not have had otherwise. After multiple episodes of this, it dawned on me that I shouldn't be able to reinstall the software if Norton truly was removing it. The issue was that Norton's products did indeed remove it as part of an antivirus "update", but they quickly released another "update" that got rid of the problem. I turned off something labeled "pulse" updates and set it to daily instead. Not only did I never see this problem again, the PC's generally had better performance.
khana 10y ago
"I did this 10 years ago..." True dat.
hexmiles 10y ago
Reading trought the comments, i see that a lot of people don't like antivirus, but what alternative we have, is mcrosoft antivirus really a better alternative. I personaly have avast installed and i don't like it very much, i find it too invasive (it keep prompting to delete an firefox addons from test pilot, for example) and i always disable https scanning, but from comparison that i found online, seem that microsoft AV do much worse in respect to others. what HN crow suggest to protect a Windows machine (win10), is microsoft AV really better or just like the others?
hexmiles 10y ago
Reading trought the comments, i see that a lot of people don't like antivirus, but what alternative we have, is mcrosoft antivirus really a better alternative. I personaly have avast installed and i don't like it very much, i find it too invasive (it keep prompting to delete an firefox addons from test pilot, for example) and i always disable https scanning, but from comparison that i found online, seem that microsoft AV do much worse in respect to others. what HN crow suggest to protect a Windows machine (win10) ?
ndesaulniers 10y ago
One of Mozilla's previous CEOs and a bunch of big wigs now work at AVG.
avenoir 10y ago
Curious to know why people are still running antiviruses. I haven't had one running since, i believe, Windows 7 release and switching over to Chrome/Firefox from IE but even IE is very resistant to threats these days.
cpeterso 10y ago
AV causes all sorts of problems for Firefox, such as startup crashes or, in some cases, AV MITM breaking Firefox updates, leaving users stranded on old Firefox versions. In Firefox 53, Mozilla is starting to purposely make it more difficult for extensions to rummage around in native code and external software to inject DLLs into the running Firefox process: https://blog.mozilla.org/addons/2017/01/24/preventing-add-ons-third-party-software-from-loading-dlls-into-firefox/ https://blog.mozilla.org/addons/2017/01/24/preventing-add-on...
jdc0589 10y ago
Here's the deal, there are two DISTINCT classes of traditional AV software. One generally sucks, the other does not. First: free AV, generally marketed to the individual or small business. If it's free, they are making money somehow; you are almost never getting it for free out of the goodness of the vendor's heart. Most of this stuff is crap, introduces ridiculous vulnerabilities in lots of instances, and can wreak havoc on totally clean machines. For this class of AV, I 100% agree with OP; kill it with fire (aside from maybe malwarebytes). Second: paid AV products targeted towards large businesses and the enterprise. Some of them still suck, but a lot of them are pretty good, and responsible + low impact in general. We have ESET deployed to ~700 machines and have yet to have a SINGLE problem caused by the AV while I've been here. Some of those are workstations, but a huge number are servers (granted, they get a special kind of av, not the full suite of web protection and everything). That said, traditional AV is becoming more and more useless every month and is starting to do very little aside from catch browser toolbars, random adware, and if you don't have a firewall it can sometimes help block known bad websites (at a cost). We have also had a fair number of instances where malicious crap made it past MULTIPLE layers of email security and was caught by AV on a workstation. Malware is not distributed such that every payload has consistent content/file-hash anymore, the alternative products out there that have a chance at pseudo-reliably catching real malicious stuff are neither free, cheap, or realistically going to be deployed outside of medium to large companies.
Endy 10y ago
Nah, I'll stick with Avast & HitManPro, thanks.
deleted 10y ago
[deleted]
fowse 10y ago
That's awesome man

859 points by bzbarsky 10y ago

KayL 10y ago

Most people forget the malware on hacked website. Browsers won't give you a warning. (OK. Chrome will show you a RED screen but not for all) They need not hack into your system. But they collected your login info, credit card. I even want to install one on my MacOS. MS AV still too slow at the moment. In Windows 10, you could turn on Defender to run both AV at the same time.

deleted 10y ago
[deleted]
AntivirusExpert 10y ago
Running Defender with another AV in parallel is not a good idea, it would lead to serious conflicts

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]

chime 10y ago

> At best, there is negligible evidence that major non-MS AV products give a net improvement in security. I apologize for present anecdote when data is needed but I manage a Windows network with 100+ users and on a daily basis, Kaspersky catches 5-10 emails from Outlook that have nasty attachments. It prevents my users from opening these innocuous looking but nasty Invoice-Jan-2017.docx files. Without a good AV there is no way to know which Invoice-Jan-2017 has a virus/worm vs. which doesn't. Relying on the Office security feature is not sufficient because actual vendor/customers send macro-enabled files to us regularly.

hueving 10y ago
Does Microsoft security essentials not scan an attachment when you download/open it?
beefhash 10y ago
Are you the target audience for this blog post, though? As far as I can tell, the post talks about one-user setups. I'd argue that the starting point in a corporate environment, where you can assume that users can be quite negligent, is fundamentally different from a one-user setup, especially since I agree that you can't "fix" the user in corporate. You want the e-mails gone, not just a warning about it, but a warning is perfectly fine if you're one person and have an idea what you're doing.
- Angostura 10y ago
  I don't see any caveats in the article about the kind of user that the advice is intended for.
  - frozenport 10y ago
    In your case, the av can run on the Linux mail server.
shultays 10y ago
> Invoice-Jan-2017.docx uh, docx files can hack my PC now? Is this a bug of MS Word or docx format really has ability to become a virus?
- spinsser 10y ago
  It is a feature [0]. Microsoft office products allow for "macros" which are Visual Basic code embedded within a document or a worksheet that can be used by developers to add extra functionalities to their MS files (e.g. validate all data in a work sheet after a user clicks a specific button in the worksheet). Just like any programming language, it could be used maliciously, and there is no easy way to distinguish which macro-enabled file is safe and which isn't (without going through the code yourself prior to enabling the functionality) [0] https://support.office.com/en-us/article/Enable-or-disable-macros-in-Office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6 https://support.office.com/en-us/article/Enable-or-disable-m...

owenwil 10y ago

This is my advice to everyone I know that gets a new Windows PC. Windows 10's built-in protection is more than adequate, and catches the majority of bad software - anything more is unnecessary, and many of the AV vendors are predatory.

WhiteSource1 10y ago
Which AV vendors are predatory? (Though Kaspersky makes me nervous). What do you think about ESET?
- AntivirusExpert 10y ago
  I recommend going by test results and by the features that interest you most. Kaspersky, BTW, has the best scores (See here: https://bestantivirus.reviews/tools/test-results-calculator https://bestantivirus.reviews/tools/test-results-calculator) but Bitdefender and Avira are also great according to these tests, and Bitdefender is my choice, personally.
  - WhiteSource1 10y ago
    Kaspersky just worries me because of the Russian connections https://www.bloomberg.com/news/articles/2015-03-19/cybersecurity-kaspersky-has-close-ties-to-russian-spies https://www.bloomberg.com/news/articles/2015-03-19/cybersecu... It's sort of like Cloudflare protecting against DDoS attacks while also protecting booters.
- Neil44 10y ago
  I have 150 ish machines on eset across a few different clients, obviously my experience with it has been very good over the years in all aspects. Eset don't offer the biggest margins but I stick with them because it doesn't cause support issues and I can count the number of infected eset machines I've had to deal with on one hand.
- lmm 10y ago
  McAfee in particular aggressively pushes "free trials" (often getting them bundled into the installers of unrelated software) that will then show scarily-worded warnings encouraging you to buy once the trial has expired.

aszantu 10y ago

Granny won't believe me :( she feels safer because of some popup that tells her she's safe.

dschuetz 10y ago
This is the most authentic argument I have read so far on this subject. People do not care about vendors. People care about how they feel. For everything else going beyond the "You are safe!" popup (try to explain "DLL injection?" to your Granny! Okay, "blocking updates" she might understand) a user needs a far deeper understanding of what goes on under the hood of the OS, or practically any software based on said OS. "Uninstall AV software" does not make people feel safer, now that the narrative of "AV is making the Internet safer" is practically standard.
currysausage 10y ago
Maybe you could create a scheduled task that opens Windows Defender every 2 hours or so? It also has beautiful green buttons that show her how safe she is, and an orange warning every once in a while when she should do a quick scan. There's also some new security center coming with the next Windows 10 version: https://blogs.windows.com/windowsexperience/2017/01/23/introducing-windows-defender-security-center/ https://blogs.windows.com/windowsexperience/2017/01/23/intro...
mynameisvlad 10y ago
A recent Windows 10 Update (I don't remember which) brought in periodic notifications from Windows Defender. They're not big bright green checkmarks, but it's a step in the right direction.
doczoidberg 10y ago
Not only your granny. I also want to remember the android icon which gained thousand of 5 star reviews for 'protecting' the smartphone. https://www.theguardian.com/technology/2014/apr/10/fake-android-antivirus-app-developer-virus-shield https://www.theguardian.com/technology/2014/apr/10/fake-andr... I don't have an AV on my windows machine since ~8years and no problems so far.
10y ago

Acalyptol 10y ago

Might be true for people who know what they're doing. However I've seen a decrease in the number of toolbars installed in my mom's computer since I've installed an antivirus.

e40 10y ago
Is she on XP or something without Defender?

rubbingalcohol 10y ago

It's irresponsible to make such a broad claim and back it up with really vague anecdotal evidence. Yes, there are a lot of lousy AV products that are at best a break-even for security, but there are some that don't suck and generally you have to pay for them - what a strange concept. I'm not going to advocate for any particular vendor as I used to work for an AV company (and currently use a product from a competitor). But I can attest that I've used products that have caught threats that Windows Defender didn't, and many products also include a much more robust and configurable firewall. It's annoying when someone else's lousy code breaks your own code. This happens to the sites I administer frequently, where we will randomly get blacklisted by some no-name AV product's web security feature. I understand the frustration when you have no control over this. But to conclude that all AV software is bad does not follow from the evidence given.

krylon 10y ago
> really vague anecdotal evidence [...] > I can attest that I've used products that have caught threats that Windows Defender didn't Since you brought it up, the latter statements sounds suspiciously like the very definition of "really vague anecdotal evidence. SCNR
- nurettin 10y ago
  Perhaps it is counter-anecdotal evidence showing the futility of anecdotal evidence as a whole.
jpcosta 10y ago
I completely agree with you, I find this "disable antivirus" to be such a bad advice! Yes, it may work for tech savvy or security aware person. If you know what you're doing you're much less likely to get into problems. It won't work for general public though. And the argument being made that "for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors" could be made for any piece of software your install.
- 10y ago

tempestn 10y ago

What's more, as third party antivirus software becomes increasingly irrelevant, many of these companies resort to harmful and even actively malicious tactics to stay in business. On the more benign end, you see an increase in 'safe web browsing' and such tools that parse javascript while browsing and somehow attempt to make it.. safer, I guess. My main experience with these things is when they randomly decide to block bits of code on our sites, breaking functionality for no discernible purpose. Far worse are the lengths that a company like AVG will go to to get and keep their software installed on your computer. Their browser toolbars essentially take all the dirty tricks they've apparently learned dealing with malware to.. build a piece of malware. Honestly whether it's active malice, incompetence, or lack of motivation I don't know, but I do know I've spent hours trying to extract their stuff from people's browsers. (I should say here that I fully expect someone reading this has managed to uninstall an AVG toolbar with no issues. They have multiple different auxiliary tools to their antivirus, and I'm not sure specifically which one(s) caused me trouble personally. It's also likely that they're only a _real_ pain in certain circumstances. But regardless, if you google something like 'how uninstall avg' or 'avg malware' I'm sure you'll find many more examples.)

t0mek 10y ago
A friend of mine worked as an on-site contractor for the AVG. He claimed that the "toolbar department" in the company, working on the browser toolbar displaying ads is as big as the "antivirus department", working on the engine (or bigger). It shouldn't be a surprise, since the toolbar is the main revenue source for the company.
TeMPOraL 10y ago
> I should say here that I fully expect someone reading this has managed to uninstall an AVG toolbar with no issues. They have multiple different auxiliary tools to their antivirus, and I'm not sure specifically which one(s) caused me trouble personally. I can say this: I never had a problem with uninstalling a browser toolbar, or restoring the default search engine in the browser. What I always have problems with, is getting rid of AV software itself. Oh God, how hard it is sometimes. Norton AV taking half an hour to uninstall is a known thing; I'm convinced they actually have some Sleep() calls in their code just to piss people off. But just last week I tried to get rid of Comodo AV (+ 2 bullshit pieces of software it installed) on my neighbour's computer. Took a while. The uninstaller didn't work (it reported "an error" and gave up), so ultimately I had to resort to manually deleting stuff until the uninstaller finally unlocked itself and cleaned up the rest. I've been having similar experiences with all AV software in past few years. They're a menace.

resfirestar 10y ago

"Microsoft AV products" aren't exempt from breaking things with poorly implemented features. MSE on Windows 7 makes games (specifically, fresh installs of StarCraft II, CS:GO and Overwatch) unplayable for me due to CPU usage spikes, apparently due to it thinking that various game executables and settings files are suspicious. Exempting the directories from scanning and disabling suspected malware sample submission had no effect, what finally worked was switching to school-provided Sophos Endpoint. Antivirus can get messy and intrusive no matter who does it.

raesene6 10y ago
The thing is most anti-malware products cause perf. issues, but it seems to be the 3rd party ones that actually make your security worse with poorly implemented and secured features. It seems bizarre to me that commercial paid for security products have such poor coding practices that a lone (albeit very talented) researcher can find so many dangerous security vulnerabilities in them. These vendors should be leading the way in secure coding and design due to the high-privilege level their code runs at.

aarongolliver 10y ago

Defender has the nasty habit of aggressively scanning new games I download off Steam. There are two occasions where it'll do it: - While it's downloading it seems to scan each chunk. I have a gigabit connection, with defender off I can download at nearly full speed. With it on I can download at about 1MB/s. - While the game loads a level. For example, the intro level to the new Deus Ex took over 10 minutes to load the first time. At that point I disabled defender entirely and just promised myself I would be careful. Naive, I know, but at least I can play my video games.

Already__Taken 10y ago
You can give it paths to exempt you know. https://www.tenforums.com/tutorials/5924-windows-defender-exclusions-add-remove-windows-10-a.html https://www.tenforums.com/tutorials/5924-windows-defender-ex...
- aarongolliver 10y ago
  Yeah, but if you piss me off enough times I'm exempting all of my hard drives. It hasn't caught a single virus since 2009. I've not found it that hard to stay safe online.
Tepix 10y ago
I wonder, have there been cases where viruses or trojans were spread via Steam?

leni536 10y ago

I have the impression that the AV business is some kind of mixture of scam and mafia.

pjmlp 10y ago
Users are to blame by pirating software. Of course, pirates don't do it for free.
- divanvisagie 10y ago
  How does piracy come into this?
  - thecatspaw 10y ago
    lots of binaries are not only patched to circument DRM, but also to contain malware
    - divanvisagie 10y ago
      How does this relate to the issue that antivirus companies do horrible things and hold ignorant paying users who don't even know how to pirate software, and legitimate software producers hostage like some sort of technical mafia?
      - pjmlp 10y ago
        Because they only became a business due to the people that were pirating software in the 80's. Thanks to the increase of virus across MS-DOS, Atari, Acorn, Amiga and Mac operating systems, specially on boot sector floppies, the general public learned that anti-virus were required software to always have installed.
        divanvisagie 10y ago
        So are you saying that if people didn't pirate stuff the viruses would not have spread? Presumably because they would not be using floppies as much?

mherrmann 10y ago

As someone who develops a (PyQt-based) desktop app [1], I can confirm this: My app has so far falsely been put into quarantine by Avira and McAffee. It's a pain... [1]: https://fman.io https://fman.io

galfarragem 10y ago
Your app looks promising! It seems heavily inspired on Sublime and that's a very good sign. Is it available already?
- mherrmann 10y ago
  Yes - click the big "Request early access" button on the home page.
pacifika 10y ago
Could you blog / expand on the packaging story for your product please?
- mherrmann 10y ago
  If we're only talking about packaging, I recommend you search for "PyInstaller" on the blog [1]. For auto updates, search "Sparkle"/"Omaha". 1: https://fman.io/blog https://fman.io/blog

zamalek 10y ago

As always, it depends on the product that you are referring to. Purely by coincidence, I installed [product] again a few weeks ago, after having used Defender since Windows 10 launched. > see bugs in AV products listed in Google's Project Zero All software has vulnerabilities, including Defender. Searching for [product] in Project Zero shows that only 3 vulnerabilities have been discovered (which is arguably a bad thing, but not according to this author) and it took, at most, 4 days for them to be resolved. > if they make your product incredibly slow and bloated This is precisely the reason that I have returned to [product]: performance. I'm running off an HDD and Defender saturates my HDD for a good 2 minutes after boot. I don't experience this with [product]. In addition, it has a "gaming mode" which allows you to further cut back on its activity (I have never needed it). Looking at objective tests, Defender fares quite poorly in both performance[1] and protection[2]. Additionally, a homogeneous market is an easy market to exploit. Let's assume that everyone took this advice and installed Defender. It is guaranteed that Defender has vulnerabilities. If you wanted to pwn as many machines as possible, you would only have to worry about exploiting a single AV. This is just bad advice, I'm sticking with the competition (which may not always be [product]). There are bad players (McAfee, Norton) but that does not mean everyone sans Microsoft is utterly incompetent. [1]: http://www.av-comparatives.org/wp-content/uploads/2016/05/avc_per_201604_en.pdf http://www.av-comparatives.org/wp-content/uploads/2016/05/av... [2]: https://www.av-test.org/en/antivirus/home-windows/windows-10/ https://www.av-test.org/en/antivirus/home-windows/windows-10...

rubber_duck 10y ago
>I'm running off an HDD and Defender saturates my HDD for a good 2 minutes after boot. Yea, that's why I disable all AV - every install or clean build or untar or w/e brings the PC to a crawl. Haven't had problems yet.
masklinn 10y ago
> All software has vulnerabilities Most software doesn't run in ring0. And most software doesn't actively break exploit mitigation techniques in other software either.
roca 10y ago
All software has vulnerabilities but not all software has the egregious blunders that Travis Ormandy finds --- so many, in such a short period of time. Furthermore, most software provides value that offsets security risks. Since the entire value of AV products is to improve security, when they fail to do that, they're worse than useless. The homogeneous market argument is weak. If a determined attacker wants to compromise as many machines as possible with a single attack, they'll come up with an exploit that passes all AV products.

EJTH 10y ago

I really haven't had any real use for AV software after i disabled flash on all my browsers...

elorant 10y ago

I was running a crawler the other day on one of my PCs from a console app. Then suddenly the antivirus discovers that a page is infected, terminates the connection and wrecks havoc to the app which stays hung there for hours and I'm unable to terminate or even kill it from Task Manager. I had to restart the PC for the task to be forcefully killed. Thanks but no thanks. I uninstalled the damn thing the next day. How the fuck did antivirus software became too intrusive?

smarx007 10y ago
What's the difference between your crawler and the botnet client as far as the AV concerned? You're the outlier among the AV customer segment.

0xFFC 10y ago

It's fucking disaster to read your blog in iphone, please fix it. At least disable fixed width or disable right left surfing. I am not web developer, so i may give wrong suggestions, but please fix you template it is like piece of shit( the experience)

0xFFC 10y ago
I don't understand why i got downvoted ao badly. I didnt say anything about his blog or material in his blog, i just couldn't read/navigate his blog in my phone. The template was a total disaster
- JustSomeNobody 10y ago
  Likely it was your tone. When you start your comment off with "It's a fucking disaster..." people get insulted.
- sctb 10y ago
  We don't comment like that here on Hacker News, and we're also asked not to complain about downvotes. Please re-read the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

bad_user 10y ago

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software developer, only noticed it because I saw green icons appearing in my search results and then noticed that Google's SSL certificate is now a fake. And I only noticed it because I know how this shit works and those green icons seemed suspicious. And yes, I'm using the word "fake", because I doubt that companies like Bitdefender have to pass the same certifications as a certificate authority or that they have any deals whatsoever with Google. And it's a serious vulnerability, because their certificate can get stolen and used by malicious software, not to mention you now have to trust a third-party with all of your secure connections, which includes your Google searches exposing your most secret desires, your Facebook and Slack chats, your bank account, everything. A third-party that does not have the scrutiny of your open-source web browser. That's just preposterous and these products only survive because users are gullible and technically illiterate.

disiplus 10y ago
i dont think you understand how this works. they install a root certicicate on your machine and do mitm "attack" so they can scan the urls, and block some attacks (i remember when some forum had embeded a pdf, that had some attack and antivirus blocked it ) also you have installed an application that has a root acces to the pc, if it was mallicius it could do allot more damage. it is ultimately a question of trust. i created and installed my own root certificate because i dont want clicking on the exception if i open a new incognito window, its especialy anoying for websocket connections.
- bad_user 10y ago
  I don't think you understand how HTTPS works. > so they can scan the urls, and block some attacks The purpose of HTTPS is to provide a guarantee that your connection to Google is direct, with no intermediaries, such that (1) only Google knows your search query and (2) you get a guarantee that the received content is from Google. And you get this guarantee from certificate authorities that have a good reputation and that are in business because they've proven they can keep their shit secure. And when one of them violates that trust, the OS / browser vendors can start to invalidate their certificates. AV companies are bypassing it all. The blocking of attacks reasoning is kind of bullshit, because Google's Safe Browsing service and browser extensions maintained by a community like uBlock Origin are doing a better job of warning against potentially malicious websites. There are always vulnerabilities to exploit of course, though it's getting harder for those to pop up due to the modern sandboxing of browsers. However I have yet to see evidence that AV software is doing a better job of catching those, because it's a whack-a-mole game and it's more likely that browser vendors find and fix those vulnerabilities faster than AV companies, because bugs get reported to browser vendors first. And sure, if you have Adobe Reader or Oracle Java installed as plugins in your browser, that's a huge risk, but it's actually easier to uninstall those and browsers have started disallowing plugins. Safari for example is disabling everything by default. The problem with installing their own root certificate is precisely one of trust. Yes, you allow a piece of software to run with root permissions, for as long as you don't see it do stupid shit, like installing a root certificate, at which point all of that trust should be gone. And that is because a custom root certificate that doesn't belong to a competent certificate authority cannot be trusted and will increase the attack surface. This is security 101.

interfixus 10y ago

This - minus the Microsoft part - is what I have been preaching for many years, even back in the late nineties, before pulling myself together and decamping for Linuxland. But users insist. I have probably never convinced anyone to go without the AV, at least not on a permanent basis. The best I can do is usually to set up som ClamWin and a daily or weekly scan for everybody's peace of mind.

z3t4 10y ago

While many AV companies are really bad, AV per say is still an extra layer of security. Telling people to remove a layer of security is bad advice. There's a problem though and if I knew how to solve it I'd be rich!

pabloski 10y ago
Security? The open more holes than they close.
guardian5x 10y ago
That's not how Security works at all. Its not about adding layers of security. That would imply installing 10 AntiVirus would be even better. But instead you're just increasing the attack surface, and slow your system down.
pvdebbe 10y ago
It could be an extra level of security if they ran in userspace or in-between. But they usually have enormous permissions to operate and doesn't really count as a whole new layer.
draugadrotten 10y ago
if you really want to add an extra layer of security, add the layer outside your computer. You know, like adding a moat outside the castle. https://s-media-cache-ak0.pinimg.com/564x/96/12/a6/9612a6cd64fe89d6efe9734320d136ff.jpg https://s-media-cache-ak0.pinimg.com/564x/96/12/a6/9612a6cd6...

kriro 10y ago

Some good points. The antivirus software itself is probably an interesting attack vector. However I don't like the assertion that Microsoft scanners are sufficient without some evidence (and In wouldn't be shocked if the MS-AV software itself was exploitable, too). At least run some tests and compare a couple of state of the art products. The situation is generally bad, AV vendors are often shady. However I think "vet your AV vendor" is much better advice.

Beltiras 10y ago
Most computer users are not competent enough to use their machine properly (and need stronger AV to protect them). What makes you think they have the technical capability to "vet their AV vendor"?
- kriro 10y ago
  Those users usually rely on some support structure which I assumed was the intended audience of the article. At least I wouldn't expect my parents to even search the internet for some article that tells them to turn off all antivirus except Defender.

franciscop 10y ago

I will consider this. I "maintain" my relatives computers which is basically to install an anti-virus and adblock. They still get those sketchy messages from friends from time to time though, which is the main reason that I keep them with an AV. Is this correct? Does AV improve security for people who cannot differentiate between a .pdf and an .exe? Personally I don't use an AV, I am a bit paranoid and technical competent so my case and my relatives is totally different.

gtirloni 10y ago
I don't use an AV either, but I'm very careful with the things I download (and I don't download new stuff very often). My relatives, on the other hand, will click just about anything that says "click me" (even more if it says they will win a prize or something). Windows Defender is great and it's enough for me but my relatives need something that cover more areas. Any way you can think of tricking them, they will fall for it. Even with AV, they routinely install malware (those that are too new to be in the AV database or using new techniques not covered by heuristics). As far as I know, my relatives don't do anything but sit in front of their computers trying to install malware ;)
- roca 10y ago
  An iOS device, or better still a Chromebook, would be pretty good for users like these.
  - franciscop 10y ago
    I don't even live in the same country so it's more of a "when you are around can you check this please?"
- nashashmi 10y ago
  My love for Windows Defender came when it was called Giant Anti-Spyware (founded by Oz). It managed to find 4 pieces of spyware on my computer, and I consider myself technically competent enough to clean spyware manually. When I ran the same software on another computer, it managed to find 3284 pieces of malware. And to think I was planning on doing it manually, eh eh. (It had an antispyware software that did nothing.) Eventually, Giant went mainstream and malware became smarter to work around it. At which point, MBAM came to the rescue. My next favorite anti-malware.

billpg 10y ago

My pet gripe: Warning me about cookies as if they are malware.

Hydraulix989 10y ago

I've seen false negatives multiple times in Microsoft's.

neko_koneko 10y ago

Ok, disclaimer first: I've previously worked at Kaspersky Lab (incident response division). Now, I want to say that many of the incidents that we have investigated, would have been prevented by anti-virus software (in many cases AV software was deliberately disabled by user). And I'm talking about incidents that resulted in million-dollar thefts - not just cases of some user getting cryptolocker on their home computer. I agree that AV software is bloated and has very large, messy and barely maintainable codebase, but I disagree with people who say that "I have never used any AV products and in 10 years have never been infected with malware" - this attitude is careless, to say the least, and in corporate environment could lead to huge financial losses. There are many criminal groups that put serious effort in the development and distribution of malware - not just script kiddies, but professional programmers and hackers. BTW, there are also region-specific malware - so for example I would rely more on Kaspersky for detection of malware targeted at Russian businesses, than Symantec or Microsoft AVs.

hetfeld 10y ago
Russian antivirus? For corporation? No, thank you, komrade.
kbart 10y ago
I'm pretty sure no AV would help against targeted attacks on high profile target. If you have multi-million business to secure, you play at totally different risk model.
- lmns 10y ago
  That's exactly what I had in mind when I read the GP. If third party AVs have a large and complex codebase with unknown or even known security flaws, they won't help much against targeted attacks or make them even easier. On the other hand, AV usability is so bad you can't expect it to help "normal" people. All those popups do more harm than good when people start ignoring them.
  - neko_koneko 10y ago
    Well, I agree that AV most likely wouldn't protect you against targeted attacks - but most of the attacks that we investigated were targeted quite broadly - phishing email campaigns targeting financial organizations (with address lists based on some hacked legitimate resources for accountants, for example). And usually these attack succeeded because of insecure infrastructure, poorly trained admins, old, non-updating systems (some people still think using Windows XP on internet-connected computers is fine), and lack of AV software.

delegate 10y ago

Who writes all these viruses ? I mean, I've experimented with assembler when I was a teenager and I may have developed some kind of program which could replicate itself.. but I highly doubt today's viruses are written by teenagers... Who and why do people write viruses ? Is this a thing at all or are all the viruses written by the Antivirus makers themselves ? More 'threats' is good news for the A/V makers so why not have a separate department which develops them ? I wouldn't be surprised at all, given that much crazier things are happening in this world.. Can anyone confirm or disprove this ?

neko_koneko 10y ago
There are many criminal groups that develop malware - it's a multi-million dollar business.
Maakuth 10y ago
If you have some time to watch a video, here's a clip of F-Secure's Mikko Hyppönen expaining some of the origins of network attacks and malware: https://www.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net https://www.ted.com/talks/mikko_hypponen_fighting_viruses_de...
- hsivonen 10y ago
  Speaking of F-Secure, has taviso just not looked at F-Secure yet or does F-Secure not have egregious blunders?
gtirloni 10y ago
Confirm that AV vendors are writing the viruses themselves in order to boost their sales? Good luck with that. There are plenty of reasons why people write malware/viruses, often for financial reasons. The old days of a teenager writing some virus in assembly to infect bootsectors for the lulz is way past us. Today you're looking at malware, often exploiting social engineering, to create botnets for DDoS, spam, boosting social profiles, etc. Occam's razor helps :)
billbail 10y ago

yrio 10y ago

What about open source antivirus software like ClamAV?

floatboth 10y ago
Usually used on email servers.
exadeci 10y ago
It's perfect! I use http://www.clamwin.com/ http://www.clamwin.com/ which is just an easy way to install it. There was a pdf about antiviruses that was posted a few month ago IIRC and they all had huge flaws except surprisingly ClamAv which had minor ones.

tehabe 10y ago

Just yesterday I had the computer of a friend in front of me, it had three anti-virus applications installed. No idea which was running. I wonder though, do those uninstall mechanism actually work and remove everything? I kinda have my doubts.

doczoidberg 10y ago

half offtopic: do I need an AV software on my android smartphone? Friends always ask me which they should use (because I am the "computer guy") and I tell them that I don't have one.

floatboth 10y ago
If you don't install pirated apps from shady sources, you absolutely do not need AV on your Android device.
- tootie 10y ago
  My android seems to have some sneeky adware on it and I've never installed anything not for the Google or Amazon stores or written myself.
  - floatboth 10y ago
    Of course, you have to look at what you're downloading from the stores, Google Play isn't aggressively pre-moderated like the Apple App Store. Still, apps are sandboxed and can't do really evil shit without special permissions. Make sure these random apps don't request the "draw over other apps" one.

Osiris 10y ago

This is what I tell my family and friends. Whenever I help someone upgrade to Windows 10, or work on their computer, I tell them to just use Microsoft Defender. I've also read various reports of security problems with AV software, so I'm not comfortable recommending anything third-party. Defender + uBlock is a pretty simple and effective combo.

roryisok 10y ago

I've been beating this drum for years, MS Security Essentials is the only passably decent antivirus app there is, and seems to be the only one that doesn't try to scare users into paying for upgrades.

ForFreedom 10y ago

I got for free Norton Security with my new Dell laptop. On installing I was unable to enable windows defender or firewall. Norton takes over the security by default. I contacted Symantec and had to uninstall Norton Security and install Norton Antivirus for the windows firewall to be activated.

hsivonen 10y ago
The first thing you should do with a PC is to delete all partitions and install a fresh OS. Even if you aren't installing Linux, you should download untampered Windows 10 (the same edition that the PC came licensed for) from Microsoft and do a fresh install without OEMware.
- WorldMaker 10y ago
  Or make sure you buy a "Signature Edition" PC in the first place, which is Microsoft's program for "junk free" systems [1] you can find in Microsoft Stores or if you ask the right Best Buy or office store. [1] https://www.microsoftstore.com/store/msusa/en_US/cat/categoryID.69916600?icid=MSstore_footer_PR_Signature https://www.microsoftstore.com/store/msusa/en_US/cat/categor...

StreamBright 10y ago

Anti-virus software is an anti-pattern in general. Having more bugs and backdoors than the rest of the applications combined. I havent been using anti-virus for the last 5-10 years I have just a simple rule set for using internet and it proved to be sufficient for me. However, I have many friends with anti-virus softwares and they still got viruses on their systems. I guess this is anecdotal evidence but I would like to see a comprehensive study on how effective anti-virus systems are. https://googleprojectzero.blogspot.hu/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.hu/2016/06/how-to-comprom...

fuzzy2 10y ago

I'd like to agree. But I can't. Even if disregard detection scores, Defender/Security Essentials is slow. It uses humongous amounts of CPU time, which slows down slower PCs (like Celeron N3150) a lot. It also tends to saturate disk I/O. In short: It sucks so bad it's virtually unusable.

mtgx 10y ago

What's wrong with avoiding Microsoft anti-virus, too? Or os he giving this advice only because most people can't disable Microsoft's antivirus anymore, anyway?

roca 10y ago
Because my guess is that Defender is reasonably implemented and does the basics right, and therefore is significantly better than nothing for the average user. That guess is based on anecdotal observations of the quality of developers and practices at Microsoft vs what we've learned about A/V vendors via bug disclosures.
robjan 10y ago
It's explained in the article

adamconroy 10y ago

AV software is a great example of a cure being worse than the disease

SuperVivid 10y ago

Couldn't be said oft enough. Still seeing people buying a new "security suite" every year.

baal80spam 10y ago

In principle, I agree with the article. Personally, on Win7 I use a combination of 3 things: - MSSE - TinyWall as a lightweight firewall - heavily modified HOSTS file Never had malware/virus problems and sometimes I do visit shady webistes or download quirky software.

huhtenberg 10y ago
You want to add EMET to the mix. https://microsoft.com/emet https://microsoft.com/emet

mtgx 10y ago

Yeah, trust Microsoft, he said: http://www.theverge.com/2017/1/25/14381174/microsoft-thailand-government-surveillance-thai-censorship-encryption http://www.theverge.com/2017/1/25/14381174/microsoft-thailan... Isn't it funny how at the same time someone is recommending to not trust other anti-viruses because they MITM you with their own certificates, Microsoft is doing the same god damn thing, or worse (allowing a whole country to spy on you through it, and not just itself). > “This program is an extensive review process that includes regular audits from a third-party web trust auditor. Is that the same auditor that audited WoSign as well? https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new... Why hasn't Microsoft started requiring Certificate Transparency yet for all certificates? Maybe then I'll believe them when they say they're sure nothing wrong is going on here.

galfarragem 10y ago

Any relevant information about Avast? I'm using their free version for 10 years and don't have any major complains.

smasty 10y ago
Avast also does HTTPS MITM. It's on by default, but can be disabled in Web shield preferences. I've just tested it in a clean VM running Windows 7, and the MITM didn't work in current Firefox stable, but it did in IE. However, as far as I can tell, it only MITMs DV certificates, not EV. Also, when it MITMs a self-signed certificate, it generates an untrusted certificate, but it says it was generated by Avast, so the user could trust it more easily. Also, in my experience, the free version of Avast considerably affects performance on slower machines (no SSD, earlier-gen CPU, etc.), but YMMV. It also tries to install Chrome as a default browser, a Google toolbar for IE, various "Secure browsing" extensions to other browsers and lot's of other annoying crap.

karlb 10y ago

Does this apply to Macs? I know that many Mac users don't use anti-virus. Are they right not to?

floatboth 10y ago
If you don't download apps from random shady sources, you don't really need AV. Recent versions of macOS default to only allowing apps from the App Store.
- hmage 10y ago
  > Recent versions of macOS default to only allowing apps from the App Store. That's incorrect, with the introduction of Gatekeeper the default setting for it was to allow only signed apps — all app store apps are signed, but developer can sign apps outside of app store. The default setting didn't change since then.

deleted 10y ago

[deleted]

jagger11 10y ago

security software doesn't mean secure software

jug 10y ago

For the past years it seems like even Windows (given the large attack surface) viruses/trojans have become much less common than in the past. I think the first line of defense in web browsers and various techs like SmartScreen etc. has helped especially with fishy porn ad ridden websites wanting to download FixWindows.exe, but also that we've moved to often use cloud oriented tools. Nowadays we visit websites to get things done way more often than in the 80's / 90's when we ran executables from some friend's diskette or hard drive. And as long as we visit websites it's way too much effort to exploit weaknesses in their sandboxes that this is then almost entirely about targetted attacks. Another example of how obnoxious it is becoming to merely _get_ to someone's computer to infect it now that users rely less on executables, is that the Fake Indian Microsoft Support Technician has become a thing. Actual humans calling other humans and hoping for the best by social engineering. This is so far fetched and works so rarely that the desperation is real. E-mail has been another traditional way of getting to someone but that's nowadays mostly Outlook.com or Gmail.com, which have their own very efficient AV systems in place. I guess my point with this is that even Microsoft's so-so antivirus tool (given that it's less intrusive) should indeed be enough. Hell I think a user with common sense will be fine with no AV whatsoever for longer than one may think.

gravypod 10y ago

How about we avoid all antivirus software, integrate virtualization as a key feature of the UI of our operating system, and completely sandbox all apps. We have the technology to do this (Qubes does it now) but it's not going mainstream. I don't know why but I think this would be the end goal of computing. Completely segregate your work from your machine and only give it access to things that make sense. (Chrome doesn't need to see /etc/nginx or be able to run systemctl). I also don't think we should trust Microsoft to not use similar exploits as other AV products in the future and I think the biggest problem here is primarily an issue for proprietary software. One example is "Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security" I have a hard time beliving that a libre-AV would have this problem. I've never seen bad architecture prevent security fixes and I've never seen bad architecture stay for long when it's only one rewrite away from being fixed. (I'm making no comments about compatability because no doubt even the command arguments will be renamed and their order will be changed)

Klathmon 10y ago
>We have the technology to do this (Qubes does it now) but it's not going mainstream. It is starting to go mainstream. Most mobile phones do a lesser form of this, most "web apps" do a very similar form of this, even new windows 10 UWP apps are pushing in this direction. Everyone knows it's needed, and many see how good of a solution it is, and how much MORE can be done once there is a good baseline, but that line needs to be walked very carefully. Once apps stop being able to do their job because of un-escapable restrictions, it becomes a problem. And once it becomes a problem, people (both developers and users) will start actively trying to get around it, which means it's not going to work at all.
sjellis 10y ago
> How about we avoid all antivirus software, integrate virtualization as a key feature of the UI of our operating system, and completely sandbox all apps. This is basically the end-game for Flatpak: https://blogs.gnome.org/alexl/2017/01/24/the-flatpak-security-model-part-3-the-long-game/ https://blogs.gnome.org/alexl/2017/01/24/the-flatpak-securit... Flatpak is vendor-neutral, but it will provide the sandbox isolation that may then enable Fedora to ramp up to Atomic Workstation, a fully containerized desktop OS: https://fedoraproject.org/wiki/Workstation/AtomicWorkstation https://fedoraproject.org/wiki/Workstation/AtomicWorkstation Hopefully we will see other Linux distributions integrate the technology as it matures. FWIW, Microsoft are developing VM-based isolation for the browser: https://threatpost.com/microsoft-edge-adds-app-guard-browser-security/120925/ https://threatpost.com/microsoft-edge-adds-app-guard-browser...

warcode 10y ago

Haven't had any issues with ESET NOD32 in the last 10 years. I've turned off the MITM on https though.

dirtyaura 10y ago

If you need AV, consider F-secure. They do quality products and take security seriously. Mikko Hyppönen, famous for his TED talk, is from F-Secure https://www.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net https://www.ted.com/talks/mikko_hypponen_fighting_viruses_de...

DavideNL 10y ago
A year ago F-Secure had very bad detection results in AV comparatives test. However, it seems they have fixed that now... http://chart.av-comparatives.org/chart1.php?chart=chart2&year=2016&month=Jul_Nov&sort=1&zoom=2 http://chart.av-comparatives.org/chart1.php?chart=chart2&yea...

youdontknowtho 10y ago

I've often wondered how much energy has been waster on AV. All of those hard drives thrashing and all of those scans.

pbhjpbhj 10y ago
It's probably sold a lot of PC upgrades too.

JustSomeNobody 10y ago

What always bothered me about MS Windows was that for a long time one HAD to use 3rd party AV SW. This should have been MS's responsibility from the very beginning. I don't go to third parties for seatbelts and anti-lock brakes when I buy a car. I shouldn't have had to use a 3rd party AV SW.

rocqua 10y ago
Linux doesn't supply a 1st party AV solution either. Windows maybe could've responded faster to the creation of so many viruses, but it takes a really popular OS for AV to become a neccesity.
WorldMaker 10y ago
Microsoft had an injunction from the anti-trust lawsuit that they couldn't bundle AV with Windows because that would be "anti-competitive", which is why Security Essentials had to be downloaded for XP/Vista instead of just coming installed. Lucky for all of us the statute of limitations on that decision finally expired. I agree, something like AV should be a function of the OS, not a "competitive" (race-to-the-security-theater-bottom) bolt-on from some third party.

Spooky23 10y ago

Pretty questionable advice. Microsoft AV is fast and non-disruptive, but is a laggard in terms of effectiveness, even by the standard of AV. It's best used when you need to check the AV box, and it is less disruptive than other solutions.

Roritharr 10y ago

My main problem with this state of affairs is compliance. We have customers that require us to get certain certifications from TÜV. The TÜV asks your whole company to have certified AV Software in place on all machines. They do not accept Windows Defender as a dedicated AV Solution, or atleast did not the last time. I'm still unsure what to tell them about our Macs and Linux Notebooks that we've acquired since the last audit. Does anyone have a solution for this?

tptacek 10y ago

In case you're wondering, this is basically the advice that most security people will give you as well, if you exclude "antivirus people" (who are really off in their own weird world), all of whom will say "use our company's product first, but no matter what you do, don't use Microsoft's".

cube00 10y ago

Tried this with my parents, they said "can you guarantee that this free Microsoft thing will catch everything McAfee would?". There is a lot to be said for the skepticism around "free" products.

herbst 10y ago

I always think its super funny when a fucking ad pops up on someone desktop. Usually done by anti virus tools. And how casually people click it away is just amazing.

justin66 10y ago

Any idea why the author is picking on Windows 7 here? Microsoft's free AV works as well on Windows 7 as it does on Windows 10. Perhaps it should go without saying --- but you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.

jamesgeck0 10y ago
Microsoft's free AV works on Windows 7, but was only installed by default starting in Windows 8.

hydrogen18 10y ago

As a former IT support guy, I can't explain how much revenue Norton would generate from me. They would regularly push updates that wiped all the critical software from customer's systems. The software was often obscure products from small vendors. Even in a small office, it was an easy day's work for me that I would not have had otherwise. After multiple episodes of this, it dawned on me that I shouldn't be able to reinstall the software if Norton truly was removing it. The issue was that Norton's products did indeed remove it as part of an antivirus "update", but they quickly released another "update" that got rid of the problem. I turned off something labeled "pulse" updates and set it to daily instead. Not only did I never see this problem again, the PC's generally had better performance.

khana 10y ago

"I did this 10 years ago..." True dat.

hexmiles 10y ago

Reading trought the comments, i see that a lot of people don't like antivirus, but what alternative we have, is mcrosoft antivirus really a better alternative. I personaly have avast installed and i don't like it very much, i find it too invasive (it keep prompting to delete an firefox addons from test pilot, for example) and i always disable https scanning, but from comparison that i found online, seem that microsoft AV do much worse in respect to others. what HN crow suggest to protect a Windows machine (win10), is microsoft AV really better or just like the others?

hexmiles 10y ago

ndesaulniers 10y ago

One of Mozilla's previous CEOs and a bunch of big wigs now work at AVG.

avenoir 10y ago

Curious to know why people are still running antiviruses. I haven't had one running since, i believe, Windows 7 release and switching over to Chrome/Firefox from IE but even IE is very resistant to threats these days.

cpeterso 10y ago

AV causes all sorts of problems for Firefox, such as startup crashes or, in some cases, AV MITM breaking Firefox updates, leaving users stranded on old Firefox versions. In Firefox 53, Mozilla is starting to purposely make it more difficult for extensions to rummage around in native code and external software to inject DLLs into the running Firefox process: https://blog.mozilla.org/addons/2017/01/24/preventing-add-ons-third-party-software-from-loading-dlls-into-firefox/ https://blog.mozilla.org/addons/2017/01/24/preventing-add-on...

jdc0589 10y ago

Here's the deal, there are two DISTINCT classes of traditional AV software. One generally sucks, the other does not. First: free AV, generally marketed to the individual or small business. If it's free, they are making money somehow; you are almost never getting it for free out of the goodness of the vendor's heart. Most of this stuff is crap, introduces ridiculous vulnerabilities in lots of instances, and can wreak havoc on totally clean machines. For this class of AV, I 100% agree with OP; kill it with fire (aside from maybe malwarebytes). Second: paid AV products targeted towards large businesses and the enterprise. Some of them still suck, but a lot of them are pretty good, and responsible + low impact in general. We have ESET deployed to ~700 machines and have yet to have a SINGLE problem caused by the AV while I've been here. Some of those are workstations, but a huge number are servers (granted, they get a special kind of av, not the full suite of web protection and everything). That said, traditional AV is becoming more and more useless every month and is starting to do very little aside from catch browser toolbars, random adware, and if you don't have a firewall it can sometimes help block known bad websites (at a cost). We have also had a fair number of instances where malicious crap made it past MULTIPLE layers of email security and was caught by AV on a workstation. Malware is not distributed such that every payload has consistent content/file-hash anymore, the alternative products out there that have a chance at pseudo-reliably catching real malicious stuff are neither free, cheap, or realistically going to be deployed outside of medium to large companies.

Endy 10y ago

Nah, I'll stick with Avast & HitManPro, thanks.

deleted 10y ago

[deleted]

fowse 10y ago

That's awesome man