7 ms·

"Buy and download antivirus software from a reputable source such as McAfee, Norton, or Symantec." Installing more proprietary software with unrestricted acces

by kgwxd 8y ago

"Buy and download antivirus software from a reputable source such as McAfee, Norton, or Symantec." Installing more proprietary software with unrestricted access seems like a huge step backwards. https://en.wikipedia.org/wiki/Magic_Lantern_%28software%29#Antivirus_vendor_cooperation https://en.wikipedia.org/wiki/Magic_Lantern_%28software%29#A...

badrabbit 8y ago
Windows itseld is a proprietary software. MS Defender does an ok job but for most malware that target consumers,those av softwares are not a negative. As a techie you might have nation state actors employing sophisticated attacks or corpirations spying on users. But the most immediate threat to consumers are things like phishing attacks,ransomware and banking trojans.
- deleted 8y ago
  [deleted]
amluto 8y ago
That’s a somewhat minor issue compared to the fact that the major anti-virus products appear to be effectively adware with a dubiously secure scanning engine built in. Whenever I help clean up someone’s Windows computer, I treat any antivirus product other than Windows Defender as malware and get rid of it.
- deleted 8y ago
  [deleted]
- qwerty456127 8y ago
  As for resident antiviruses I would generally agree (even for purely logical reasons - that means adding another 3-rd party to the 100% trusted list, you grant their app godlike access to your computer and everything on it and let it talk freely and secretly to their vendor), nevertheless a live-cd version of something like Dr.Web can be of great use in such cases, Windows Defender a well as other antiviruses ran under an infected system can often be futile against viruses infesting it. Perhaps open-source ClamAV can do the job too but I'm not sure.
kerng 8y ago
Agreed. I'm not only uninstalling third party AV software - I always actually reimage the machine if its preinstalled. Even Windows Defender does sketchy things but at least it's the same vendor as the OS - so hopefully not adding on tons of risk. I have the feeling that security software is often the most insecure one, because of bad design choices and lack of quality engineering.
ken 8y ago
Previously, from a former Mozilla developer [1]: > At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.) In the linked Project Zero issue tracker, all 3 of these "reputable sources" have exploits in their anti-virus software. [1]: https://robert.ocallahan.org/2017/01/disable-your-antivirus-software-except.html https://robert.ocallahan.org/2017/01/disable-your-antivirus-...
- badrabbit 8y ago
  Vulnerability is not lack of security. You need a threat actor exploiting the weakness for it to become actual insecurity.
  - yayana 8y ago
    Insecurity is having a vulnerability. Whether a threat actor exploited it and what results you can detect are part of a useless variant of Schrödingers cat that everyone prefers you focus on to sell useless software.
    - badrabbit 8y ago
      Are you redefinig the field of information security? Please read some basic material on information risk and security. I mean,even just reading vulnerability bulletins and CVE descriptions should familiarize you with explotability and complexity of attack,they exist to help remediators prioritize more insecure vulns. Quick example: 'ls' has an easily exploitable code execution vuln. On a shared terminal server,this vuln translates to severe loss of security. On a firewall,this is nothing more than a house keeping item with no real loss of security as there are no threats that can run 'ls'.
      - yayana 8y ago
forapurpose 8y ago
That's been my understanding too, and I've seen security professionals say the same. But possibly, their advice was intended for likely targets, such as journalists, and not the general public. On the other hand, I'm not sure I'd trust a typical end user to protect themself otherwise. Are they going to secure their OS profile? Avoid malware?
- ozim 8y ago
  Yes, seems like people here take threat model of journalists and want to apply it to their 10 year old nephew who is downloading Minecraft mods.
2-4-Flinching 8y ago
It's pretty simple that they are looking to protect the user from the everyday threats (hint hint: Bare Minimum in the title). Also while I'm sure your superman with a "security degree" that looks down on all the mere mortals. You would stand no chance against an government agency with all the time in the world and a blank check.

by kgwxd 8y ago

badrabbit 8y ago

Windows itseld is a proprietary software. MS Defender does an ok job but for most malware that target consumers,those av softwares are not a negative. As a techie you might have nation state actors employing sophisticated attacks or corpirations spying on users. But the most immediate threat to consumers are things like phishing attacks,ransomware and banking trojans.

deleted 8y ago
[deleted]

amluto 8y ago

That’s a somewhat minor issue compared to the fact that the major anti-virus products appear to be effectively adware with a dubiously secure scanning engine built in. Whenever I help clean up someone’s Windows computer, I treat any antivirus product other than Windows Defender as malware and get rid of it.

deleted 8y ago
[deleted]
qwerty456127 8y ago
As for resident antiviruses I would generally agree (even for purely logical reasons - that means adding another 3-rd party to the 100% trusted list, you grant their app godlike access to your computer and everything on it and let it talk freely and secretly to their vendor), nevertheless a live-cd version of something like Dr.Web can be of great use in such cases, Windows Defender a well as other antiviruses ran under an infected system can often be futile against viruses infesting it. Perhaps open-source ClamAV can do the job too but I'm not sure.

kerng 8y ago

Agreed. I'm not only uninstalling third party AV software - I always actually reimage the machine if its preinstalled. Even Windows Defender does sketchy things but at least it's the same vendor as the OS - so hopefully not adding on tons of risk. I have the feeling that security software is often the most insecure one, because of bad design choices and lack of quality engineering.

ken 8y ago

Previously, from a former Mozilla developer [1]: > At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.) In the linked Project Zero issue tracker, all 3 of these "reputable sources" have exploits in their anti-virus software. [1]: https://robert.ocallahan.org/2017/01/disable-your-antivirus-software-except.html https://robert.ocallahan.org/2017/01/disable-your-antivirus-...

badrabbit 8y ago
Vulnerability is not lack of security. You need a threat actor exploiting the weakness for it to become actual insecurity.
- yayana 8y ago
  Insecurity is having a vulnerability. Whether a threat actor exploited it and what results you can detect are part of a useless variant of Schrödingers cat that everyone prefers you focus on to sell useless software.
  - badrabbit 8y ago
    Are you redefinig the field of information security? Please read some basic material on information risk and security. I mean,even just reading vulnerability bulletins and CVE descriptions should familiarize you with explotability and complexity of attack,they exist to help remediators prioritize more insecure vulns. Quick example: 'ls' has an easily exploitable code execution vuln. On a shared terminal server,this vuln translates to severe loss of security. On a firewall,this is nothing more than a house keeping item with no real loss of security as there are no threats that can run 'ls'.
    - yayana 8y ago

forapurpose 8y ago

That's been my understanding too, and I've seen security professionals say the same. But possibly, their advice was intended for likely targets, such as journalists, and not the general public. On the other hand, I'm not sure I'd trust a typical end user to protect themself otherwise. Are they going to secure their OS profile? Avoid malware?

ozim 8y ago
Yes, seems like people here take threat model of journalists and want to apply it to their 10 year old nephew who is downloading Minecraft mods.

2-4-Flinching 8y ago

It's pretty simple that they are looking to protect the user from the everyday threats (hint hint: Bare Minimum in the title). Also while I'm sure your superman with a "security degree" that looks down on all the mere mortals. You would stand no chance against an government agency with all the time in the world and a blank check.