5 ms·

Every single company I worked for installed AV on our work computers, which was a huge resource hog and made the highest-specced MacBook Pros feel like cheap ne

Every single company I worked for installed AV on our work computers, which was a huge resource hog and made the highest-specced MacBook Pros feel like cheap netbook. I suspect it is mandated by some sort of compliance requirement, and the IT departments are just ticking a box. Maybe that's how this industry is still alive.

Freak_NL 7y ago
ISO 27001. It doesn't mandate it explicitly, but your auditor may get fussy if you can't answer questions about the relevant controls with a clear answer.
noselasd 7y ago
If you have an IT department, they will insist on AV software just to cover their ass. Noone there wants to be the one explaining to a clueless boss that they didn't use av software og something bad happened.
- mcny 7y ago
  I don't mind having an antivirus on Windows but I despise having real-time file scanning when I have a computer with spinning rust. Node Package Manager install or yarn install creates thousands of tiny files and my understanding is that these "antivirus" software try to scan each file at the same time as npm wants to create them or in earlier days even as subversion was trying to do something. I imagine things are different for people on PCIe NVMe SSD but Windows (or any modern OS I guess with any antivirus) is not so good if we are on spinning rust. I think if we insist on real-time file scanning, the least we can do is provide at least a decent SATA SSD like the Samsung 860 EVO and adequate RAM to avoid thrashing.
  - andai 7y ago
    I was using a spinny disk for a few weeks and I upgraded back to SSD the other day. The difference is incredible. Browser used to take 10 seconds to start, now it's instant. The only good thing is, I got so frustrated waiting constantly that I optimized my software to minimize IO (eg disabled browser history) so now it's even faster.
    - unnouinceput 7y ago
      I will blow your mind when I will tell you to use a RamDisks for fastest run times wink wink
      - pdimitar 7y ago
        If you use a Samsung SATA SSD, just enable RAPID mode in the Samsung Magician program. The different with and without is huge. (Enabling RAPID mode basically creates an invisible RAM disk and uses it under the hood.)
        leetcrew 7y ago
        is this different than just allocating swap space on the SSD?
        pdimitar 7y ago
        Very different. The RAPID mode is basically a RAM disk under the hood -- it does its best to cache often-accessed files and temporarily prioritise loading big files on demand (which is the use-case of games, they often have huge files with textures and sound). Gotta say, it works amazingly well. I am getting almost PCI/NVMe speeds on my SATA III SSD.
        mcny 7y ago
        > The RAPID mode is basically a RAM disk under the hood -- it does its best to cache often-accessed files and temporarily prioritise loading big files on demand (which is the use-case of games, they often have huge files with textures and sound). Sorry if this is obvious but does that mean we will have a better experience with a total of 32GB RAM than say 8GB? I have not worked with RAM disk before...
  - leetcrew 7y ago
    windows defender does the same thing by default. first step setting up my workstation for c++ dev is always specifically excluding my source code directories and msvc.exe and friends. sometimes takes me a few days to notice all the ancillary processes that will trigger the file scanning and whitelist them. otherwise it eats a whole logical core every time I kick off a compile.
hawski 7y ago
Reading sibling comments I have an idea for a startup. Make an AV, that does not really do anything, but can be used by thoughtful companies to "tick the box". Sell licenses and then do only the minimum required for compliance. It could be described that it uses Windows Defender service to provide the basis of AV solution.
- vinceguidry 7y ago
  As far as I'm aware, there are no governmental regulatory requirements to use AV software. All such requirements are generated by individual organizations, for example this one by NC State: https://policies.ncsu.edu/regulation/reg-08-00-10/ https://policies.ncsu.edu/regulation/reg-08-00-10/ Nobody told NC State to require anti-virus, and the same company that created the requirements isn't going to accept some "minimal" solution to check their own box. Instead they will maintain a list of approved software, and your solution won't be on it.
- brownbat 7y ago
  An AV that alarmed on unpatched vulnerabilities might be better. Attackers will resignature their code to evade everything on VT, then spam the world to hit whoever hasn't patched. For ransomware anyway. If they're targeting you specifically they'll find out what you're running and customize against it.
  - Skunkleton 7y ago
    A vulnerability scanner would be welcome. I would even run something like that on my linux machines.
endorphone 7y ago
PCI DSS Requirement 5 demands AV. Many financial industry standards, and auditors that verify the same, will demand an AV installation. The AV needs to be up to date, pervasive, and with central reporting. Here is where simply having Windows Defender installed falls flat -- when it finds some malware on Betty's computer, you can't be sure what the scope was until you investigate yet standalone Windows Defender won't give you that information. So you need the enterprise version with the reporting console, alerts, etc. AV is a nuisance for most of us, and I've gone sans it for many years, but it's critical in most workplaces because there are a lot of people who will happily run that program, etc, and you can't catch everything at the edge.

Freak_NL 7y ago

ISO 27001. It doesn't mandate it explicitly, but your auditor may get fussy if you can't answer questions about the relevant controls with a clear answer.

noselasd 7y ago

If you have an IT department, they will insist on AV software just to cover their ass. Noone there wants to be the one explaining to a clueless boss that they didn't use av software og something bad happened.

mcny 7y ago
I don't mind having an antivirus on Windows but I despise having real-time file scanning when I have a computer with spinning rust. Node Package Manager install or yarn install creates thousands of tiny files and my understanding is that these "antivirus" software try to scan each file at the same time as npm wants to create them or in earlier days even as subversion was trying to do something. I imagine things are different for people on PCIe NVMe SSD but Windows (or any modern OS I guess with any antivirus) is not so good if we are on spinning rust. I think if we insist on real-time file scanning, the least we can do is provide at least a decent SATA SSD like the Samsung 860 EVO and adequate RAM to avoid thrashing.
- andai 7y ago
  I was using a spinny disk for a few weeks and I upgraded back to SSD the other day. The difference is incredible. Browser used to take 10 seconds to start, now it's instant. The only good thing is, I got so frustrated waiting constantly that I optimized my software to minimize IO (eg disabled browser history) so now it's even faster.
  - unnouinceput 7y ago
    I will blow your mind when I will tell you to use a RamDisks for fastest run times wink wink
    - pdimitar 7y ago
      If you use a Samsung SATA SSD, just enable RAPID mode in the Samsung Magician program. The different with and without is huge. (Enabling RAPID mode basically creates an invisible RAM disk and uses it under the hood.)
      - leetcrew 7y ago
        is this different than just allocating swap space on the SSD?
        pdimitar 7y ago
        Very different. The RAPID mode is basically a RAM disk under the hood -- it does its best to cache often-accessed files and temporarily prioritise loading big files on demand (which is the use-case of games, they often have huge files with textures and sound). Gotta say, it works amazingly well. I am getting almost PCI/NVMe speeds on my SATA III SSD.
        mcny 7y ago
        > The RAPID mode is basically a RAM disk under the hood -- it does its best to cache often-accessed files and temporarily prioritise loading big files on demand (which is the use-case of games, they often have huge files with textures and sound). Sorry if this is obvious but does that mean we will have a better experience with a total of 32GB RAM than say 8GB? I have not worked with RAM disk before...
- leetcrew 7y ago
  windows defender does the same thing by default. first step setting up my workstation for c++ dev is always specifically excluding my source code directories and msvc.exe and friends. sometimes takes me a few days to notice all the ancillary processes that will trigger the file scanning and whitelist them. otherwise it eats a whole logical core every time I kick off a compile.

hawski 7y ago

Reading sibling comments I have an idea for a startup. Make an AV, that does not really do anything, but can be used by thoughtful companies to "tick the box". Sell licenses and then do only the minimum required for compliance. It could be described that it uses Windows Defender service to provide the basis of AV solution.

vinceguidry 7y ago
As far as I'm aware, there are no governmental regulatory requirements to use AV software. All such requirements are generated by individual organizations, for example this one by NC State: https://policies.ncsu.edu/regulation/reg-08-00-10/ https://policies.ncsu.edu/regulation/reg-08-00-10/ Nobody told NC State to require anti-virus, and the same company that created the requirements isn't going to accept some "minimal" solution to check their own box. Instead they will maintain a list of approved software, and your solution won't be on it.
brownbat 7y ago
An AV that alarmed on unpatched vulnerabilities might be better. Attackers will resignature their code to evade everything on VT, then spam the world to hit whoever hasn't patched. For ransomware anyway. If they're targeting you specifically they'll find out what you're running and customize against it.
- Skunkleton 7y ago
  A vulnerability scanner would be welcome. I would even run something like that on my linux machines.

endorphone 7y ago

PCI DSS Requirement 5 demands AV. Many financial industry standards, and auditors that verify the same, will demand an AV installation. The AV needs to be up to date, pervasive, and with central reporting. Here is where simply having Windows Defender installed falls flat -- when it finds some malware on Betty's computer, you can't be sure what the scope was until you investigate yet standalone Windows Defender won't give you that information. So you need the enterprise version with the reporting console, alerts, etc. AV is a nuisance for most of us, and I've gone sans it for many years, but it's critical in most workplaces because there are a lot of people who will happily run that program, etc, and you can't catch everything at the edge.