4 ms·

Most anti-virus software is unnecessary, almost useless and can significantly decrease the performance of your machine. I worked at one company that provided i

Most anti-virus software is unnecessary, almost useless and can significantly decrease the performance of your machine. I worked at one company that provided its employees with really powerful desktop machines (Xeon CPU with 24 cores, 64GB of RAM, two SSDs in hardware RAID). Per my estimate the cost of such desktops had to be around $6K-$8K. But they installed a CA anti-virus software on them. And just like that the desktop turned from a performance beast to a snail. On most operations it was even slower than my middle of the road personal laptop. The anti-virus interfered with everything: disk, network, processes. The machine can be loaded at most at 3-4%, because the anti-virus service was consuming a single core up to 100% and didn't let anything else to run. Needless to say, it never found any viruses on my machine.

0xfeba 7y ago
Not only that -- but they increase the attack surface. Since all non-OEM antivirus are essentially using undocumented APIs and hooks into the kernel they have been exploited due to flaws in them. My company has Windows Defender (which does a fine job by itself), McAfee, and CyberArk EP (which AFAIK, just does exe vetting on-demand). I start my laptop up and it uses 50% of it's 32GB of RAM (not cache!) from a cold boot. Granted there are some IIS services and whatnot dev tools running but still. Plus the kernel just hangs every other day for a couple minutes. Yay! At my last job they also used McAfee in addition to Defender but I found a way to uninstall it. And the local IT guy gave me a pass when his management console said mine was unprotected.
sebazzz 7y ago
My employer, large accountancy firm does this. They use Symantec Endpoint Protection and our high-end (which aren't really that high-end) laptops are dog slow. My personal 7 year old i7 Sandy Bridge almost outruns these Skylake/Haswell notebooks. They configured Symantec also to scan files by every modification _and_ access. If something happens a lot during compilation it is disk I/O with a lot of small files. Not to mention they staple additional anti-malware solutions like CA Carbonblack, Microsoft EMET and Avecto Defendpoint on top of it. Probably every Windows API call is hooked multiple times. Horrible is it.
teilo 7y ago
And nevertheless we are forced to put an endpoint on all machines for compliancy reasons. The security/privacy beancounters at our larger customers demand it.
- lonelappde 7y ago
  Why hasn't some startup offered a low-resource AV? Call it "Anti-Tiger Rock AV" Why isn't Windows Defender good enough?
  - teilo 7y ago
    Well, for one, we are 80% Mac here.
cookiecaper 7y ago
While I agree in principle, most such platforms can avoid serious performance degradation with correct configuration. There's a lot of incentive for these things to come very aggressive out of the box -- after all, who wants to spend millions of dollars on software and then never even notice it? It's in the AV vendor's interest to make itself known and initially to overalarm. This also gives them some plausible deniability in the case that something does get through: they can just blame the guy who turned off $PerfObliteratingScan83 in the enterprise's profile. :) Every enterprise deploying such software is expected to pare back the behavior to accommodate their specific risk profile, and in particular, to ensure that any high-performance tooling or internal software is exempted from most types of real-time protection. This is obviously much easier said than done in the real world, but it doesn't have to be an all-or-nothing proposition.
lonelappde 7y ago
How can a 24 core machine dedicating 1 core to AV block 95% of CPU? How can a process on one core block a process on another core? Was it locking all the files other processes accessed?

0xfeba 7y ago

Not only that -- but they increase the attack surface. Since all non-OEM antivirus are essentially using undocumented APIs and hooks into the kernel they have been exploited due to flaws in them. My company has Windows Defender (which does a fine job by itself), McAfee, and CyberArk EP (which AFAIK, just does exe vetting on-demand). I start my laptop up and it uses 50% of it's 32GB of RAM (not cache!) from a cold boot. Granted there are some IIS services and whatnot dev tools running but still. Plus the kernel just hangs every other day for a couple minutes. Yay! At my last job they also used McAfee in addition to Defender but I found a way to uninstall it. And the local IT guy gave me a pass when his management console said mine was unprotected.

sebazzz 7y ago

My employer, large accountancy firm does this. They use Symantec Endpoint Protection and our high-end (which aren't really that high-end) laptops are dog slow. My personal 7 year old i7 Sandy Bridge almost outruns these Skylake/Haswell notebooks. They configured Symantec also to scan files by every modification _and_ access. If something happens a lot during compilation it is disk I/O with a lot of small files. Not to mention they staple additional anti-malware solutions like CA Carbonblack, Microsoft EMET and Avecto Defendpoint on top of it. Probably every Windows API call is hooked multiple times. Horrible is it.

teilo 7y ago

And nevertheless we are forced to put an endpoint on all machines for compliancy reasons. The security/privacy beancounters at our larger customers demand it.

lonelappde 7y ago
Why hasn't some startup offered a low-resource AV? Call it "Anti-Tiger Rock AV" Why isn't Windows Defender good enough?
- teilo 7y ago
  Well, for one, we are 80% Mac here.

cookiecaper 7y ago

While I agree in principle, most such platforms can avoid serious performance degradation with correct configuration. There's a lot of incentive for these things to come very aggressive out of the box -- after all, who wants to spend millions of dollars on software and then never even notice it? It's in the AV vendor's interest to make itself known and initially to overalarm. This also gives them some plausible deniability in the case that something does get through: they can just blame the guy who turned off $PerfObliteratingScan83 in the enterprise's profile. :) Every enterprise deploying such software is expected to pare back the behavior to accommodate their specific risk profile, and in particular, to ensure that any high-performance tooling or internal software is exempted from most types of real-time protection. This is obviously much easier said than done in the real world, but it doesn't have to be an all-or-nothing proposition.

lonelappde 7y ago

How can a 24 core machine dedicating 1 core to AV block 95% of CPU? How can a process on one core block a process on another core? Was it locking all the files other processes accessed?