3 ms·

I find this extremely strange. I cannot even come up with a good metaphor to explain to non-technical people how untrustworthy this makes most AV software look

by krylon 8y ago

I find this extremely strange. I cannot even come up with a good metaphor to explain to non-technical people how untrustworthy this makes most AV software look to me. I mean, we all make mistakes, but the kind of bugs that have been found in various AV products are so obviously stupid one can easily get a concussion from face-palming. If I were to roll my own crypto, there are all kinds of subtle mistakes that I could, nay: would, make that I might not even understand if someone explained them to me very patiently. Like, redirecting system calls from a "sandboxed" process, but then executing them as SYSTEM? How can I trust a company that allows such dumb mistakes in their code to build software that is supposed to make a system more secure? It is like finding out that the surgeon who is supposed to operate on you lacks basic knowledge of human anatomy.

blattimwind 8y ago
> I find this extremely strange. I don't. AV software is virtually impossible to vet for a customer; it is the literal stone to keep tigers away (do you see any? It must therefore work). So 100 % of selling AV software is marketing, not functionality. "Independent tests", e.g. how much slower the computer is made by AV software disfavour solid design: All else being equal an AV software where the signature engine runs directly in the kernel code intercepting FS calls will always be faster than the properly designed software were the signature engine runs at lower privileges (requiring task switching), and the FS filter driver has to delegate. Tests where well-known malware is fed into engines and the red flag comes up are also pretty meaningless; signature scanning works, that's not the problem of the product. The problem of the product is that the only things a customer can measure disfavour good execution of it and that signature detection is fundamentally inept in countering relevant attacks and therefore no real protection. Heuristics (or ML or whatever) doesn't really work well, either.

by krylon 8y ago

blattimwind 8y ago

> I find this extremely strange. I don't. AV software is virtually impossible to vet for a customer; it is the literal stone to keep tigers away (do you see any? It must therefore work). So 100 % of selling AV software is marketing, not functionality. "Independent tests", e.g. how much slower the computer is made by AV software disfavour solid design: All else being equal an AV software where the signature engine runs directly in the kernel code intercepting FS calls will always be faster than the properly designed software were the signature engine runs at lower privileges (requiring task switching), and the FS filter driver has to delegate. Tests where well-known malware is fed into engines and the red flag comes up are also pretty meaningless; signature scanning works, that's not the problem of the product. The problem of the product is that the only things a customer can measure disfavour good execution of it and that signature detection is fundamentally inept in countering relevant attacks and therefore no real protection. Heuristics (or ML or whatever) doesn't really work well, either.