7 ms·

I'm currently picking the OS stack for all machines at my company. All guidance, even people I respect, point towards antivirus protection. Yet I lean towards n

I'm currently picking the OS stack for all machines at my company. All guidance, even people I respect, point towards antivirus protection. Yet I lean towards nixing that. I know it's hugely ineffective. In fact, it opens up holes of its own[1]. And yet... it's like scaffolding in NYC[2]. Absolutely useless[3]. But if you are all for removing it, and a brick falls and hurts someone, heads will roll. Quite a quandary I - and other C-levels - face. [1] https://www.computerworld.com/article/3089872/security/security-vulnerabilities-in-symantec-and-norton-as-bad-as-it-gets-warns-researcher.html https://www.computerworld.com/article/3089872/security/secur... [2] Another contrarian passion of mine. [3] Bricks do fall and hurt people. But no more than scaffolding itself falls with the same effect.

coder543 8y ago
Microsoft Defender typically doesn't hurt performance or security much. The alternative is to run Mac or Linux stacks instead of a Windows stack, of course.
- godDLL 8y ago
  While running a Linux stack may still work, your Mac info is outdated by three years, at least. Macs have entered the zoo in 2015.
  - coder543 8y ago
    For practical purposes, that's not true. Macs do not allow running unsigned software by default, and no one runs antivirus on Mac, ever. So even if they were commonly being infected, which they aren't, the person above would have organizational indemnity if someone were infected because they're following industry best practices by not running antivirus on Mac. If you want, you can further restrict Macs to only App Store software, which is heavily sandboxed. Then you can go even further by not allowing the individual users to install software on their own, if you really want to be draconian about it. Unless someone is being individually targeted, running very outdated software, or is intentionally trying to get themselves infected, it will not happen. Even if all three conditions are true, it's still very unlikely. Anyone who says otherwise is just fear mongering. That same level of fear mongering could point to the dozens of pieces of malware that have been released for Linux. I say this as someone who uses a Linux laptop for work and a Windows desktop at home. I don't have a dog in this fight. I do, however, try to stay very informed about the state of software security.
    - __mifflin 8y ago
      > and no one runs antivirus on the Mac, ever. Working at a large company (also not one of the famous silicon valley tech companies) and if you get a macbook, they are managed remotely and have BitDefender installed.
      - coder543 8y ago
        I sometimes forget how much big companies enjoy spending money. I once worked for a large company where every developer was issued a full copy of Microsoft Office, even though most of them worked inside a fullscreen Linux VM all day. Outlook was the only piece of Office that my coworkers and I used, and I would have been happier using a tab open to a webmail provider inside the VM than having to use Outlook to connect to Exchange. That was far from the only unnecessary software they paid for. Why use Git when you can pay for Perforce!
        viraptor 8y ago
        > every developer was issued a full copy of Microsoft Office Enterprise volume licenses. It probably cost them less than the time/money they'd lose if you spenta few minutes trying to figure out how to open some file sent by non-devs.
        pjmlp 8y ago
        > Why use Git when you can pay for Perforce! Nice graphical tooling and sane developer experience.
        Murk 8y ago
        I consider perforce "views" to be burdonsome and not so sane. The rest of the experience may be less jarring than git for many.
        golergka 8y ago
        If you're working in the game industry, and your repository includes a lot of huge binary files that are mergable, perfoce is a godsend. Also, p4merge is the best merging utility for any VCS, and I always install it alongside git if I work in Windows.
  - coldtea 8y ago
    >Macs have entered the zoo in 2015. What "zoo"? To this day, Macs are practically virus-less, which they always where (99.999% of the scares in the media were for trojans, and even those at worse affected something like 1-5% of the total user base) -- nothing like the good ole Windows (XP and pre) days where after 1 day surfing the web you'd have a few viruses. And of course if you go with the default options (gatekeeper, signed packages, etc) you have even less to worry about. It's also not about "market share" -- Macs had 1/4 the market share they have now in 1990-1997, but there were tons of viruses for them under the old OS. It's not like the original (pre-many security features were introduced) OS X was specially hardened or anything, but it was much more secure than Mac OS and the old Windows versions just by having a basic UNIX-style design.
    - godDLL 8y ago
      > To this day, Macs are practically virus-less Exactly what I'm talking about. Not to this day, but to some time back in 2015. Right now any trojan toolchain on the black market comes with a Mac-targeted package.
      - coldtea 8y ago
        Trojans always existed. But trojans aren't viruses, and if you don't get your stuff from shady websites you don't have much to worry about (and if you just get signed and sandboxed App Store stuff, even less or nothing to worry about).
  - setquk 8y ago
    I believe you mean “finished” not “out of date”.
    - godDLL 8y ago
      Actually I chose my words carefully. Even though malware guys have started targeting Macs about three years back actual infestations are uncommon.
- jaxn 8y ago
  Microsoft Defender destroys WSL performance unless you create exclusions.
  - setquk 8y ago
    Then there’s NTFS behind that. Just use a VM. Ten times faster.
    - dagw 8y ago
      Ten times faster at what? Do you have any benchmarks?
      - setquk 8y ago
        Writing and reading lots of small files on disk. Which is basically what 90% of Unixes are.
    - jaxn 8y ago
      For what I am using it for, a VM is not faster than WSL. Maybe in the early days, but not now.
ggreer 8y ago
I would recommend against antivirus. If you force developers to use an annoying configuration of a specific OS, you make it much harder to hire top talent. Why would someone work at your company when they could go to Google and use their favorite Linux tools running on their favorite model ThinkPad? It totally makes sense to lock down machines that can access production, but for development? Just let people use what they like. You'll have less work for IT, happier developers, and an easier time recruiting talent.
ryanwaggoner 8y ago
Eh, I’d like to see some data on NYC scaffolds. They do collapse and hurt people, but the sheer volume of pedestrians and construction work makes me skeptical that it’s just as bad to have them as not have them. Not to mention the fact that it gives construction workers a way to not block the sidewalk with equipment and personnel.
opportune 8y ago
Keep in mind the reason guidance exists for products that aren’t really all that necessary is largely due to the massive sales teams behind those products, plus (as you mention) cover-your-ass concerns
otoburb 8y ago
>>And yet... it's like scaffolding in NYC[2]. Absolutely useless[3]. But if you are all for removing it, and a brick falls and hurts someone, heads will roll. This is a question of shifting liability and sharing responsibility. If a brick falls when you knew the facade needed maintenance, then the liability falls solely on the building. If the scaffolding falls, then the liability is borne by the scaffolding company, or at least shared. If people you respect are pointing towards antivirus protection, you might also want to inquire whether they are saying this purely out of technical reasons (i.e. surface attack area, which could be debated), or if there are financial risk management factors tipping in this direction. Since you're picking the OS for everybody in your company, which presumably includes multiple departments and staff who are non-technical, it seems like madness that you'd let them run amok without some level of antivirus. But -- leave the poor developers alone. One hopes that the company was capable of hiring technical staff practicing basic day-to-day security hygene.

coder543 8y ago

Microsoft Defender typically doesn't hurt performance or security much. The alternative is to run Mac or Linux stacks instead of a Windows stack, of course.

godDLL 8y ago
While running a Linux stack may still work, your Mac info is outdated by three years, at least. Macs have entered the zoo in 2015.
- coder543 8y ago
  For practical purposes, that's not true. Macs do not allow running unsigned software by default, and no one runs antivirus on Mac, ever. So even if they were commonly being infected, which they aren't, the person above would have organizational indemnity if someone were infected because they're following industry best practices by not running antivirus on Mac. If you want, you can further restrict Macs to only App Store software, which is heavily sandboxed. Then you can go even further by not allowing the individual users to install software on their own, if you really want to be draconian about it. Unless someone is being individually targeted, running very outdated software, or is intentionally trying to get themselves infected, it will not happen. Even if all three conditions are true, it's still very unlikely. Anyone who says otherwise is just fear mongering. That same level of fear mongering could point to the dozens of pieces of malware that have been released for Linux. I say this as someone who uses a Linux laptop for work and a Windows desktop at home. I don't have a dog in this fight. I do, however, try to stay very informed about the state of software security.
  - __mifflin 8y ago
    > and no one runs antivirus on the Mac, ever. Working at a large company (also not one of the famous silicon valley tech companies) and if you get a macbook, they are managed remotely and have BitDefender installed.
    - coder543 8y ago
      I sometimes forget how much big companies enjoy spending money. I once worked for a large company where every developer was issued a full copy of Microsoft Office, even though most of them worked inside a fullscreen Linux VM all day. Outlook was the only piece of Office that my coworkers and I used, and I would have been happier using a tab open to a webmail provider inside the VM than having to use Outlook to connect to Exchange. That was far from the only unnecessary software they paid for. Why use Git when you can pay for Perforce!
      - viraptor 8y ago
        > every developer was issued a full copy of Microsoft Office Enterprise volume licenses. It probably cost them less than the time/money they'd lose if you spenta few minutes trying to figure out how to open some file sent by non-devs.
      - pjmlp 8y ago
        > Why use Git when you can pay for Perforce! Nice graphical tooling and sane developer experience.
        Murk 8y ago
        I consider perforce "views" to be burdonsome and not so sane. The rest of the experience may be less jarring than git for many.
      - golergka 8y ago
        If you're working in the game industry, and your repository includes a lot of huge binary files that are mergable, perfoce is a godsend. Also, p4merge is the best merging utility for any VCS, and I always install it alongside git if I work in Windows.
- coldtea 8y ago
  >Macs have entered the zoo in 2015. What "zoo"? To this day, Macs are practically virus-less, which they always where (99.999% of the scares in the media were for trojans, and even those at worse affected something like 1-5% of the total user base) -- nothing like the good ole Windows (XP and pre) days where after 1 day surfing the web you'd have a few viruses. And of course if you go with the default options (gatekeeper, signed packages, etc) you have even less to worry about. It's also not about "market share" -- Macs had 1/4 the market share they have now in 1990-1997, but there were tons of viruses for them under the old OS. It's not like the original (pre-many security features were introduced) OS X was specially hardened or anything, but it was much more secure than Mac OS and the old Windows versions just by having a basic UNIX-style design.
  - godDLL 8y ago
    > To this day, Macs are practically virus-less Exactly what I'm talking about. Not to this day, but to some time back in 2015. Right now any trojan toolchain on the black market comes with a Mac-targeted package.
    - coldtea 8y ago
      Trojans always existed. But trojans aren't viruses, and if you don't get your stuff from shady websites you don't have much to worry about (and if you just get signed and sandboxed App Store stuff, even less or nothing to worry about).
- setquk 8y ago
  I believe you mean “finished” not “out of date”.
  - godDLL 8y ago
    Actually I chose my words carefully. Even though malware guys have started targeting Macs about three years back actual infestations are uncommon.
jaxn 8y ago
Microsoft Defender destroys WSL performance unless you create exclusions.
- setquk 8y ago
  Then there’s NTFS behind that. Just use a VM. Ten times faster.
  - dagw 8y ago
    Ten times faster at what? Do you have any benchmarks?
    - setquk 8y ago
      Writing and reading lots of small files on disk. Which is basically what 90% of Unixes are.
  - jaxn 8y ago
    For what I am using it for, a VM is not faster than WSL. Maybe in the early days, but not now.

ggreer 8y ago

I would recommend against antivirus. If you force developers to use an annoying configuration of a specific OS, you make it much harder to hire top talent. Why would someone work at your company when they could go to Google and use their favorite Linux tools running on their favorite model ThinkPad? It totally makes sense to lock down machines that can access production, but for development? Just let people use what they like. You'll have less work for IT, happier developers, and an easier time recruiting talent.

ryanwaggoner 8y ago

Eh, I’d like to see some data on NYC scaffolds. They do collapse and hurt people, but the sheer volume of pedestrians and construction work makes me skeptical that it’s just as bad to have them as not have them. Not to mention the fact that it gives construction workers a way to not block the sidewalk with equipment and personnel.

opportune 8y ago

Keep in mind the reason guidance exists for products that aren’t really all that necessary is largely due to the massive sales teams behind those products, plus (as you mention) cover-your-ass concerns

otoburb 8y ago

>>And yet... it's like scaffolding in NYC[2]. Absolutely useless[3]. But if you are all for removing it, and a brick falls and hurts someone, heads will roll. This is a question of shifting liability and sharing responsibility. If a brick falls when you knew the facade needed maintenance, then the liability falls solely on the building. If the scaffolding falls, then the liability is borne by the scaffolding company, or at least shared. If people you respect are pointing towards antivirus protection, you might also want to inquire whether they are saying this purely out of technical reasons (i.e. surface attack area, which could be debated), or if there are financial risk management factors tipping in this direction. Since you're picking the OS for everybody in your company, which presumably includes multiple departments and staff who are non-technical, it seems like madness that you'd let them run amok without some level of antivirus. But -- leave the poor developers alone. One hopes that the company was capable of hiring technical staff practicing basic day-to-day security hygene.