10 ms·

Mozilla and Opera remove Avast extensions from their add-on stores

305 points by robin_reala 7y ago

jefft255 7y ago
Modern antivirus software, to me, feels like a virus. Norton and McAffee are especially guilty of this. They install browsers toolbar, do search engine hijacking, constant nagging. They became the software they were supposed to protect us against. I finally convinced my dad not to renew his Norton subscription.
- romanovcode 7y ago
  Windows 10 has pretty good anti-virus built in.
  - hackbinary 7y ago
    Yes, it is called Windows Defender, as above.
    - louhike 7y ago
      The above message was actually posted after. They were probably written at the same time. Please take into account that comments on Hacker News are ordered by votes, not published dates.
- dessant 7y ago
  Windows Defender is a performant alternative to all the junk antivirus companies put out. At this point it's fairly well documented that having a third-party antivirus product running on your Windows device often exposes you to security issues, even if the antivirus doesn't spy on you. https://www.zdnet.com/article/ex-top-mozilla-dev-to-windows-users-ditch-all-antivirus-except-microsofts-defender/ https://www.zdnet.com/article/ex-top-mozilla-dev-to-windows-...
  - alibert 7y ago
    "Windows Defender is a performant alternative ..." No it's not really [1]. You can check by yourself running `npm install` of any medium sized project or if you are a gamer, launch Steam with/out Defender. Even IntelliJ warns you about Defender performance impact in the IDE. [1] https://www.av-comparatives.org/tests/performance-test-october-2019/ https://www.av-comparatives.org/tests/performance-test-octob...
    - Steltek 7y ago
      How does Defender compare against other antivirus options? Perhaps it's the least bad? Obviously running more software will have a performance hit over not running software. Especially when it almost requires constantly inspecting the system.
      - basch 7y ago
        From a performance impact standpoint, based on just one test suite, it is the worst on the market. https://www.av-comparatives.org/tests/performance-test-october-2019/ https://www.av-comparatives.org/tests/performance-test-octob... (and I linked to the same article in your parents comment...) Avira and Bitdefender manage to rank in the top tier of performance impact and protection every time I check. Both offer free products, and Bitdefender Free is considerably less annoying, in my past experiences. Free antivirus is actually one of the places where market competition forced a bunch of them to clean up their acts and offer a good non invasive product. Avira still has ads, but if you wanted one product on your pc and one on a home server, it might make sense to use two vendors products. https://www.bitdefender.com/solutions/free.html https://www.bitdefender.com/solutions/free.html https://www.avira.com/en/free-antivirus-windows https://www.avira.com/en/free-antivirus-windows For one off system scans, besides the two mentioned above; ESET, F-Secure, Kaspersky, Panda (and Emsisoft which has Avira and Bitdefender built in) all offer great spot check products. ADWCleaner is indispensable. It's interesting that "anti-virus" has now become the free component in suites. You pay for things like VPN, password management, and home network security. Kaspersky goes a step further and offers VPN and password management in a free tier. https://usa.kaspersky.com/free-antivirus https://usa.kaspersky.com/free-antivirus
- travisporter 7y ago
  Norton is sad, because isn't their security team excellent at reporting vulnerabilities?
  - smacktoward 7y ago
    The modern products sold under the Norton brand are a slur on the name of Peter Norton, a real dude who made some excellent software products and wrote some important books back in the day. https://www.technologizer.com/2014/06/05/where-have-you-gone-peter-norton/ https://www.technologizer.com/2014/06/05/where-have-you-gone... I guess there's a lesson here: if you sell your name, eventually it will be used for something that will tarnish it.
- dirkf 7y ago
  Take a look at the other articles from the same author where he investigated some popular anti-virus products. In particular Kaspersky is/was a mess: - https://palant.de/2019/08/19/kaspersky-in-the-middle-what-could-possibly-go-wrong/ https://palant.de/2019/08/19/kaspersky-in-the-middle-what-co... - https://palant.de/2019/11/25/kaspersky-the-art-of-keeping-your-keys-under-the-door-mat/ https://palant.de/2019/11/25/kaspersky-the-art-of-keeping-yo... - https://palant.de/2019/11/26/internal-kaspersky-api-exposed-to-websites/ https://palant.de/2019/11/26/internal-kaspersky-api-exposed-... - https://palant.de/2019/11/27/assorted-kaspersky-vulnerabilities/ https://palant.de/2019/11/27/assorted-kaspersky-vulnerabilit... McAfee: - https://palant.de/2019/12/02/rendering-mcafee-web-protection-ineffective/ https://palant.de/2019/12/02/rendering-mcafee-web-protection... And I expect that he will publish more articles in the future. If you want to use anti-virus I would stick to their on-access scanning and stay away from their web protection...
  - Abishek_Muthian 7y ago
    I would like to have a low power ARM box just for scanning files, like PiHole but for AV but I think it would be limited only to Clam AV; does any other AV support linux on ARM(not android)?
    - my123 7y ago
      Could you try qemu-i386 (or ExaGear with patching licensing... as it's dead) with https://github.com/taviso/loadlibrary https://github.com/taviso/loadlibrary (see the Windows Defender section)? Yeah it's hacky, but might work well for your usecase.
      - Abishek_Muthian 7y ago
        Thank you, but both of those projects look dead; I'll check them out.
  - bscphil 7y ago
    More very entertaining evidence of how terrible most antivirus products are can be found be reading many of the Project Zero bug reports by taviso. https://bugs.chromium.org/p/project-zero/issues/list?q=owner%3Ataviso%40google.com&can=1 https://bugs.chromium.org/p/project-zero/issues/list?q=owner... There are a lot of them!
- jcranmer 7y ago
  > Modern antivirus software, to me, feels like a virus. Malware can be loosely defined as any software which tries to modify the system to inject capabilities not previously present. With that definition, antivirus is malware that tries to prevent other malware from doing what it did.
  - dessant 7y ago
    Malware is not defined by what it does, but whether or not its actions conform to user intent and approval.
    - dblohm7 7y ago
      That's true, but AV tends to use the same sketchy and unreliable techniques to hook itself in that malware uses. Having benevolent intent doesn't make the software less buggy or less harmful. (I used to lead Mozilla's efforts to extricate buggy third-party AV code from Firefox's processes)
  - SketchySeaBeast 7y ago
    > any software which tries to modify the system to inject capabilities not previously present Isn't that just software?
    - tptacek 7y ago
      No; ordinary software doesn't modify the operating system. To see the distinction, narrow it down for a second to "modify the system to inject capabilities not previously present into system calls".
  - andybak 7y ago
    > Malware can be loosely defined as any software which tries to modify the system to inject capabilities not previously present. Very loosely.
- zzma 7y ago
  They also will often install their own trusted root certificate and then MITM all HTTP/HTTPS connections. Often, this MITM will significantly reduce the cryptographic security of the connection over the public internet [1]. [1] https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf
- chooseaname 7y ago
  I never understood why this was a problem MS never felt they needed to address in the OS itself (architecturally). At this point, AV software should be obsolete. But, here we are.
  - munchbunny 7y ago
    They do and have done it for many years. But it’s hard (impossible) to stop a user from (being tricked into) downloading some random crap and insisting on running it despite warnings about untrusted executables and warnings about the executable asking for administrator permissions.
    - grawprog 7y ago
      The problem is a lot of legit programs cause the same terrifying popups in windows to the point where they become more of an annoyance than something you actually pay attention to.
      - munchbunny 7y ago
        The problem is that the same legit programs are doing things like using administrator permissions when they don’t need them and not signing their code, so the structural “protect users from themselves” features can’t kick in. Fundamentally power users want freedom over guard rails and casual users need those guard rails present (though in my experience there are plenty of power users who think they’re security savvy), so there’s not a one size fits all solution. At the moment I think Windows 10 S mode is a promising approach to give both groups what they want, which is also the kind of architectural solution you asked about.
        bluGill 7y ago
        I have long said that Microsoft could make a big difference just be having office check on startup for administrator privileges, and refuse to start if found. Nobody with administrator rights needs to run Office. You should have a second non-administrator login for that type of thing.
- jayflux 7y ago
  “Modern” ? Antiviruses have been doing all those things you listed for the past 15 years, these tactics are as old as the hill. I can’t remember a point when antivirus software didn’t do all that and just did the one job you wanted it to do. Since my school years I’ve always had to switch all that crap off
- roywiggins 7y ago
  An apparent incompatibility between the mandated antivirus and Windows Subsystem for Linux means that I can't run WSL on my work machine. Something to do with the on-write virus scanning means running rsync in WSL will reliably BSOD the machine.
- AnIdiotOnTheNet 7y ago
  I would say that AV could be generously described as snake-oil pretty much since its inception. It has always caused more trouble than it ever prevented and was only capable of catching common low-effort malware, and even then only if said malware wasn't a "product" of some ad company that had a relationship with the AV vendor. Meanwhile it caused issues for legitimate software, slowed things down, and sometimes just acted as a new attack vector.
pragnesh 7y ago
why gdpr law does not apply to them ?
- dessant 7y ago
  It does, but people rarely take the time to report illegal behavior that they encounter online.
  - allendoerfer 7y ago
    Mozilla's mission is to build a better internet. In my opinion, they should totally use legal measures to do that. I would take part in crowdfunding it.
    - iicc 7y ago
      Check out https://noyb.eu/support/ https://noyb.eu/support/ >https://noyb.eu/privacy-kickstarter-first-100k-for-noyb/ https://noyb.eu/privacy-kickstarter-first-100k-for-noyb/ Mozilla supported them with €10,000 when they were starting out.
      - literallycancer 7y ago
        This is great. There's some interesting info about progress of ongoing projects in the projects section: When relying on consent as a legal basis to process personal data, companies need to comply with the stringent requirements contained in the GDPR. In May 2018, noyb filed four complaints; in France against Google, in Austria against Facebook, in Belgium against Instagram and in Germany against Whatsapp. The reason was that these major companies adopted a “take it or leave it” approach, forcing their users to consent to both their privacy policies and terms in full in order to keep using their services. In January 2019, following our complaint the French supervisory authority (CNIL) imposed a 50 million euro fine on Google over the company’s invalid consent mechanisms. The sanction was appealed and a hearing date before the French Conseil d’Etat is yet to be set. All three other complaints (Facebook, Instagram and WhatsApp) triggered the European cooperation mechanism and are still being investigated today. We are carefully monitoring the cooperation between the Irish DPC and its counterparts and are hoping to hear back from our latest submissions in the near future.
hirako2000 7y ago
Avast even does some browser trickery to then be able to inspect tls/ssl packets. Not sure how I noticed that on a windows machine, but the owner was glad to uninstall it. As said on other comments, the built-in windows 10 defender AV is the least evil software to have enabled for somewhat a protected endpoint. The situation is desperate for AV publishers, they treat customers like sheeps, the parallel with mafia ain't too far possible to make. It sorts of reminds me 20 years back when it was common discussion to have on how AV publishers first deployed a number of viruses to create a market. The war for a decent form of cyber security and privacy is being lost. It's getting worse every year. More money (billions) is poured into it. To no avail. I think we got to seriously show the example and reject closed source solutions all together, stay away from centralized providers, question everything we consume. The crowed will eventually follow.
- joobus 7y ago
  I was forced to install this by my company on my mac. Avast breaks ssl/tls certification, and in a browser with avast, every website is reported as having an Avast cert. They basically mitm all browser traffic.
  - hirako2000 7y ago
    This shinannigan can be diabled btw. It's just On by default. Quite concerning a company forcing you to install this on an OS that has so little need for AV altogether.
  - 52-6F-62 7y ago
    I see your Avast and raise you McAfee protection on everything. Thankfully we were able to remove it. It was literally destroying the machine (do anything it considers a risky process and it would crank the CPU to 99% and start to melt the thing) and rendering it unusable.
  - mr_toad 7y ago
    I see this all the time on corporate desktops, but on your own hardware? I’d point blank refuse. I’d rather just not use it for work.
AznHisoka 7y ago
SimilarWeb have similar extensions doing essentially the same thing. this stuff has been going on for well over 5 years but Google has done nothing about it.
- a3n 7y ago
  Professional courtesy.
  - AznHisoka 7y ago
    Is something similarweb doesn’t have. I know.
bad_user 7y ago
I don't even understand why people use antivirus software. Sure, if you're on an ancient version of your OS, like Windows XP, then it might serve some purpose, but assuming modern versions of these operating systems, antivirus software does more harm than good. Worried about browser extensions? Another problem is that popular antivirus software are also installing their own root certificate so they can MITM secure HTTPS connections. For example Bitdefender is able to inspect and modify your Google search result without installing a browser extension. And this is a common practice. See for example: https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-vulnerable-to-the-FREAK-attack-and-other-ways-Antivirus-software-lowers-your-HTTPS-security.html https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-...
- degenerate 7y ago
  If you are computer savvy, you understand the danger of opening "free_netflix.exe" from an ad you clicked, but the majority of people do not. There are still good 3rd party antivirus that stay out of the way, as an example I have been running Panda Antivirus (free edition) for a few years and often forget it's installed until I pop in an infected USB or try to open a questionable exe (such as a game mod patcher). If you have lots of click-happy family members, 3rd party antivirus is a must. Just stay away from the big names (Norton, Kaspersky, Avast, AVG, McAfee, etc). I used to run NOD32 but it started becoming a memory hog in ~2015.
  - jermaustin1 7y ago
    > If you have lots of click-happy family members, 3rd party antivirus is a must. I HAD lots of click-happy family members, but as soon as I stopped fixing their computers and just formatting them, they stopped being so click happy.
    - carlhjerpe 7y ago
      I'd lie suggesting that a Linux Desktop is more secure than a Windows Desktop, but my solution with my father's just been installing a Linux distro and helping him there instead, considering there's no market to make consumer viruses for Linux. I've recently started looking at "Neverware CloudReady" (ChromeOS for regular machines), i think that'd be the perfect OS for my father, considering almost everything he does is done through the browser, but still has a few applications that needs local execution. (And they seem to support the Crostini Linux app beta thingy that Google is working so hard on for ChromeOS).
lousken 7y ago
How did we end up here? Antimalware companies turning into spyware ones? And how is this even legal? Just the fact that they add privacy policy makes it legal?
- Zelphyr 7y ago
  Everybody (except, unfortunately for the moment, our government it seems) has realized just how valuable personal data is. That's turning not only antimalware companies into spyware companies but also search engines, TV manufactuers, etc... I don't think it's really going to change much until we as consumers really start to push back. Sadly, I don't see that happening anytime soon because anytime I mention it to non-techical family and friends the reply I get back is a near unanimous shrug and some mumbling about their not having anything to hide. Of course, inevitably this evolves into them complaining incredulously about their phone listening to them "because so and so talked about such and such product the other day and I NEVER talk about that but when I got home all I saw were ads for that product and how dare they?!" My forehead hurts from frustratedly banging it against the wall.
gregjw 7y ago
What's with all of these unethical antivirus companies infringing privacy for a profit? Surely they're becoming exactly what they're trying to combat..
- skocznymroczny 7y ago
  It's possible that they're trying to reach new markets. The environment nowadays is much safer than it was 10 years ago. Java applets are dead, Flash is dying, and adblocks are common. Outside of few specific security holes, Javascript sandbox is working well and protecting users from drive-by attacks. USB/CDs are not as common as in the past, so people don't spread viruses from one machine to another. P2P networks and torrents are also less popular because of the wide availability of legal content at low prices.
Ceezy 7y ago
Farewell!!! How this stuff is even possible?
aba_cz 7y ago
Jumpshot (https://www.jumpshot.com/ https://www.jumpshot.com/) is created, owned and operated by Avast (same people sitting in the same offices using same data/servers). 100% of data use for the analytics is provided by that browser plugin. Nothing is anonymized. They (Jumpshot) have unique user/hardware id, url, referrer, IP all browser information and others so they can create their reports. I'm surprised that it surprises anyone after the years of them doing that. They (Avast) are not a nice company.
- palant 7y ago
  Yes, according to the Avast privacy policy the data is "anonymized or pseudonymized." As I already speculated in https://palant.de/2019/10/28/avast-online-security-and-avast-secure-browser-are-spying-on-you/ https://palant.de/2019/10/28/avast-online-security-and-avast..., they likely went for pseudonymization in this particular case - meaning that they simply left the data as it is. The unique user ID being sent there is technically a pseudonym, meaning that it isn't directly tied to your identity. That this "clickstream data" is easily deanonymized - so far there is no indication that Avast cared.
  - aba_cz 7y ago
    It's not tied to your identity, but if you go frequently to some social sites with the same user id in the url (LinkedIn and others) it's possible to match that an HW id to a real name. Also when you buy coupon or goods which are tied to you just by unique ID the data science team could see that in the clickstream and it they were evil enough they could just use that (holiday coupon for example) for themselves. Or private photos shared by unique ID in url. Basically they (employees) could see everything from navigation bar and try to find out who it belongs to. Source: Jumpshot/Avast employees Funny example: They (developers) could see a man from Alaska (IP based) looking for an info about yeti and then going to buy a rifle in the same session.
    - palant 7y ago
      Yes, there is research about finding out the name behind pseudonymized browsing history data - they had success rates in the area of 90%, despite having far less detailed data than what Avast is collecting.
takeda 7y ago
Avast got from the best (free) AV solution to join the scum AV that is malware.
- wruza 7y ago
  Free cheese is always a part of a mouse trap.
aarongray 7y ago
What does a virus do? Makes your computer run slow, spies on you, and asks you for money What do most antiviruses do? Makes your computer run slow, spies on you, and asks you for money
- qxnqd 7y ago
  Thanks grandma.
ndesaulniers 7y ago
Didn't a bunch of Mozilla execs leave for Avast? Ironic, if so. (Looks the they went to AVG which got acquired by Avast)?
IvanK_net 7y ago
I wonder, that many people are scared of websites doing something they don't want them to do, but nobody is scared of extensions. Extensions have much bigger permissions than websites. I never used any extension in my browser. I think it is already enough, that each website knows what I do on it, what I click etc. I don't need some third party to know, what I do on all websites.
obenn 7y ago
At this point I think the only options are using the built in OS security for personal use, and endpoint protection like fieldeffect.com or crowdstrike.com for businesses.
badness 7y ago
Seeing so much talk on various AVs being bad, how does bitdefender stack up in vileness?
- Nextgrid 7y ago
  I had an incident at a client recently where their employees' (macOS) machines would have issues connecting to services on Localhost. The client's request would arrive to the server just fine, but the client would immediately get a connection reset ("empty reply from server" in curl) without getting the response from the server. Eventually we tracked it down to a BitDefender update.
s1k3b8 7y ago
Many years ago, I remember that avast was one of the antivirus software recommended over norton/mcafee/etc. Seems like all the idealistic and "good" tech/software eventually goes bad. Is it money that ultimately corrupts? From google to avast, they all seem to go from saints to sinners. Maybe I was just naive back then and they weren't saints to begin with.

305 points by robin_reala 7y ago

Modern antivirus software, to me, feels like a virus. Norton and McAffee are especially guilty of this. They install browsers toolbar, do search engine hijacking, constant nagging. They became the software they were supposed to protect us against. I finally convinced my dad not to renew his Norton subscription.

romanovcode 7y ago
Windows 10 has pretty good anti-virus built in.
- hackbinary 7y ago
  Yes, it is called Windows Defender, as above.
  - louhike 7y ago
    The above message was actually posted after. They were probably written at the same time. Please take into account that comments on Hacker News are ordered by votes, not published dates.
dessant 7y ago
Windows Defender is a performant alternative to all the junk antivirus companies put out. At this point it's fairly well documented that having a third-party antivirus product running on your Windows device often exposes you to security issues, even if the antivirus doesn't spy on you. https://www.zdnet.com/article/ex-top-mozilla-dev-to-windows-users-ditch-all-antivirus-except-microsofts-defender/ https://www.zdnet.com/article/ex-top-mozilla-dev-to-windows-...
- alibert 7y ago
  "Windows Defender is a performant alternative ..." No it's not really [1]. You can check by yourself running `npm install` of any medium sized project or if you are a gamer, launch Steam with/out Defender. Even IntelliJ warns you about Defender performance impact in the IDE. [1] https://www.av-comparatives.org/tests/performance-test-october-2019/ https://www.av-comparatives.org/tests/performance-test-octob...
  - Steltek 7y ago
    How does Defender compare against other antivirus options? Perhaps it's the least bad? Obviously running more software will have a performance hit over not running software. Especially when it almost requires constantly inspecting the system.
    - basch 7y ago
      From a performance impact standpoint, based on just one test suite, it is the worst on the market. https://www.av-comparatives.org/tests/performance-test-october-2019/ https://www.av-comparatives.org/tests/performance-test-octob... (and I linked to the same article in your parents comment...) Avira and Bitdefender manage to rank in the top tier of performance impact and protection every time I check. Both offer free products, and Bitdefender Free is considerably less annoying, in my past experiences. Free antivirus is actually one of the places where market competition forced a bunch of them to clean up their acts and offer a good non invasive product. Avira still has ads, but if you wanted one product on your pc and one on a home server, it might make sense to use two vendors products. https://www.bitdefender.com/solutions/free.html https://www.bitdefender.com/solutions/free.html https://www.avira.com/en/free-antivirus-windows https://www.avira.com/en/free-antivirus-windows For one off system scans, besides the two mentioned above; ESET, F-Secure, Kaspersky, Panda (and Emsisoft which has Avira and Bitdefender built in) all offer great spot check products. ADWCleaner is indispensable. It's interesting that "anti-virus" has now become the free component in suites. You pay for things like VPN, password management, and home network security. Kaspersky goes a step further and offers VPN and password management in a free tier. https://usa.kaspersky.com/free-antivirus https://usa.kaspersky.com/free-antivirus
travisporter 7y ago
Norton is sad, because isn't their security team excellent at reporting vulnerabilities?
- smacktoward 7y ago
  The modern products sold under the Norton brand are a slur on the name of Peter Norton, a real dude who made some excellent software products and wrote some important books back in the day. https://www.technologizer.com/2014/06/05/where-have-you-gone-peter-norton/ https://www.technologizer.com/2014/06/05/where-have-you-gone... I guess there's a lesson here: if you sell your name, eventually it will be used for something that will tarnish it.
dirkf 7y ago
Take a look at the other articles from the same author where he investigated some popular anti-virus products. In particular Kaspersky is/was a mess: - https://palant.de/2019/08/19/kaspersky-in-the-middle-what-could-possibly-go-wrong/ https://palant.de/2019/08/19/kaspersky-in-the-middle-what-co... - https://palant.de/2019/11/25/kaspersky-the-art-of-keeping-your-keys-under-the-door-mat/ https://palant.de/2019/11/25/kaspersky-the-art-of-keeping-yo... - https://palant.de/2019/11/26/internal-kaspersky-api-exposed-to-websites/ https://palant.de/2019/11/26/internal-kaspersky-api-exposed-... - https://palant.de/2019/11/27/assorted-kaspersky-vulnerabilities/ https://palant.de/2019/11/27/assorted-kaspersky-vulnerabilit... McAfee: - https://palant.de/2019/12/02/rendering-mcafee-web-protection-ineffective/ https://palant.de/2019/12/02/rendering-mcafee-web-protection... And I expect that he will publish more articles in the future. If you want to use anti-virus I would stick to their on-access scanning and stay away from their web protection...
- Abishek_Muthian 7y ago
  I would like to have a low power ARM box just for scanning files, like PiHole but for AV but I think it would be limited only to Clam AV; does any other AV support linux on ARM(not android)?
  - my123 7y ago
    Could you try qemu-i386 (or ExaGear with patching licensing... as it's dead) with https://github.com/taviso/loadlibrary https://github.com/taviso/loadlibrary (see the Windows Defender section)? Yeah it's hacky, but might work well for your usecase.
    - Abishek_Muthian 7y ago
      Thank you, but both of those projects look dead; I'll check them out.
- bscphil 7y ago
  More very entertaining evidence of how terrible most antivirus products are can be found be reading many of the Project Zero bug reports by taviso. https://bugs.chromium.org/p/project-zero/issues/list?q=owner%3Ataviso%40google.com&can=1 https://bugs.chromium.org/p/project-zero/issues/list?q=owner... There are a lot of them!
jcranmer 7y ago
> Modern antivirus software, to me, feels like a virus. Malware can be loosely defined as any software which tries to modify the system to inject capabilities not previously present. With that definition, antivirus is malware that tries to prevent other malware from doing what it did.
- dessant 7y ago
  Malware is not defined by what it does, but whether or not its actions conform to user intent and approval.
  - dblohm7 7y ago
    That's true, but AV tends to use the same sketchy and unreliable techniques to hook itself in that malware uses. Having benevolent intent doesn't make the software less buggy or less harmful. (I used to lead Mozilla's efforts to extricate buggy third-party AV code from Firefox's processes)
- SketchySeaBeast 7y ago
  > any software which tries to modify the system to inject capabilities not previously present Isn't that just software?
  - tptacek 7y ago
    No; ordinary software doesn't modify the operating system. To see the distinction, narrow it down for a second to "modify the system to inject capabilities not previously present into system calls".
- andybak 7y ago
  > Malware can be loosely defined as any software which tries to modify the system to inject capabilities not previously present. Very loosely.
zzma 7y ago
They also will often install their own trusted root certificate and then MITM all HTTP/HTTPS connections. Often, this MITM will significantly reduce the cryptographic security of the connection over the public internet [1]. [1] https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf
chooseaname 7y ago
I never understood why this was a problem MS never felt they needed to address in the OS itself (architecturally). At this point, AV software should be obsolete. But, here we are.
- munchbunny 7y ago
  They do and have done it for many years. But it’s hard (impossible) to stop a user from (being tricked into) downloading some random crap and insisting on running it despite warnings about untrusted executables and warnings about the executable asking for administrator permissions.
  - grawprog 7y ago
    The problem is a lot of legit programs cause the same terrifying popups in windows to the point where they become more of an annoyance than something you actually pay attention to.
    - munchbunny 7y ago
      The problem is that the same legit programs are doing things like using administrator permissions when they don’t need them and not signing their code, so the structural “protect users from themselves” features can’t kick in. Fundamentally power users want freedom over guard rails and casual users need those guard rails present (though in my experience there are plenty of power users who think they’re security savvy), so there’s not a one size fits all solution. At the moment I think Windows 10 S mode is a promising approach to give both groups what they want, which is also the kind of architectural solution you asked about.
      - bluGill 7y ago
        I have long said that Microsoft could make a big difference just be having office check on startup for administrator privileges, and refuse to start if found. Nobody with administrator rights needs to run Office. You should have a second non-administrator login for that type of thing.
jayflux 7y ago
“Modern” ? Antiviruses have been doing all those things you listed for the past 15 years, these tactics are as old as the hill. I can’t remember a point when antivirus software didn’t do all that and just did the one job you wanted it to do. Since my school years I’ve always had to switch all that crap off
roywiggins 7y ago
An apparent incompatibility between the mandated antivirus and Windows Subsystem for Linux means that I can't run WSL on my work machine. Something to do with the on-write virus scanning means running rsync in WSL will reliably BSOD the machine.
AnIdiotOnTheNet 7y ago
I would say that AV could be generously described as snake-oil pretty much since its inception. It has always caused more trouble than it ever prevented and was only capable of catching common low-effort malware, and even then only if said malware wasn't a "product" of some ad company that had a relationship with the AV vendor. Meanwhile it caused issues for legitimate software, slowed things down, and sometimes just acted as a new attack vector.

pragnesh 7y ago

why gdpr law does not apply to them ?

dessant 7y ago
It does, but people rarely take the time to report illegal behavior that they encounter online.
- allendoerfer 7y ago
  Mozilla's mission is to build a better internet. In my opinion, they should totally use legal measures to do that. I would take part in crowdfunding it.
  - iicc 7y ago
    Check out https://noyb.eu/support/ https://noyb.eu/support/ >https://noyb.eu/privacy-kickstarter-first-100k-for-noyb/ https://noyb.eu/privacy-kickstarter-first-100k-for-noyb/ Mozilla supported them with €10,000 when they were starting out.
    - literallycancer 7y ago
      This is great. There's some interesting info about progress of ongoing projects in the projects section: When relying on consent as a legal basis to process personal data, companies need to comply with the stringent requirements contained in the GDPR. In May 2018, noyb filed four complaints; in France against Google, in Austria against Facebook, in Belgium against Instagram and in Germany against Whatsapp. The reason was that these major companies adopted a “take it or leave it” approach, forcing their users to consent to both their privacy policies and terms in full in order to keep using their services. In January 2019, following our complaint the French supervisory authority (CNIL) imposed a 50 million euro fine on Google over the company’s invalid consent mechanisms. The sanction was appealed and a hearing date before the French Conseil d’Etat is yet to be set. All three other complaints (Facebook, Instagram and WhatsApp) triggered the European cooperation mechanism and are still being investigated today. We are carefully monitoring the cooperation between the Irish DPC and its counterparts and are hoping to hear back from our latest submissions in the near future.

hirako2000 7y ago

Avast even does some browser trickery to then be able to inspect tls/ssl packets. Not sure how I noticed that on a windows machine, but the owner was glad to uninstall it. As said on other comments, the built-in windows 10 defender AV is the least evil software to have enabled for somewhat a protected endpoint. The situation is desperate for AV publishers, they treat customers like sheeps, the parallel with mafia ain't too far possible to make. It sorts of reminds me 20 years back when it was common discussion to have on how AV publishers first deployed a number of viruses to create a market. The war for a decent form of cyber security and privacy is being lost. It's getting worse every year. More money (billions) is poured into it. To no avail. I think we got to seriously show the example and reject closed source solutions all together, stay away from centralized providers, question everything we consume. The crowed will eventually follow.

joobus 7y ago
I was forced to install this by my company on my mac. Avast breaks ssl/tls certification, and in a browser with avast, every website is reported as having an Avast cert. They basically mitm all browser traffic.
- hirako2000 7y ago
  This shinannigan can be diabled btw. It's just On by default. Quite concerning a company forcing you to install this on an OS that has so little need for AV altogether.
- 52-6F-62 7y ago
  I see your Avast and raise you McAfee protection on everything. Thankfully we were able to remove it. It was literally destroying the machine (do anything it considers a risky process and it would crank the CPU to 99% and start to melt the thing) and rendering it unusable.
- mr_toad 7y ago
  I see this all the time on corporate desktops, but on your own hardware? I’d point blank refuse. I’d rather just not use it for work.

AznHisoka 7y ago

SimilarWeb have similar extensions doing essentially the same thing. this stuff has been going on for well over 5 years but Google has done nothing about it.

a3n 7y ago
Professional courtesy.
- AznHisoka 7y ago
  Is something similarweb doesn’t have. I know.

bad_user 7y ago

I don't even understand why people use antivirus software. Sure, if you're on an ancient version of your OS, like Windows XP, then it might serve some purpose, but assuming modern versions of these operating systems, antivirus software does more harm than good. Worried about browser extensions? Another problem is that popular antivirus software are also installing their own root certificate so they can MITM secure HTTPS connections. For example Bitdefender is able to inspect and modify your Google search result without installing a browser extension. And this is a common practice. See for example: https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-vulnerable-to-the-FREAK-attack-and-other-ways-Antivirus-software-lowers-your-HTTPS-security.html https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-...

degenerate 7y ago
If you are computer savvy, you understand the danger of opening "free_netflix.exe" from an ad you clicked, but the majority of people do not. There are still good 3rd party antivirus that stay out of the way, as an example I have been running Panda Antivirus (free edition) for a few years and often forget it's installed until I pop in an infected USB or try to open a questionable exe (such as a game mod patcher). If you have lots of click-happy family members, 3rd party antivirus is a must. Just stay away from the big names (Norton, Kaspersky, Avast, AVG, McAfee, etc). I used to run NOD32 but it started becoming a memory hog in ~2015.
- jermaustin1 7y ago
  > If you have lots of click-happy family members, 3rd party antivirus is a must. I HAD lots of click-happy family members, but as soon as I stopped fixing their computers and just formatting them, they stopped being so click happy.
  - carlhjerpe 7y ago
    I'd lie suggesting that a Linux Desktop is more secure than a Windows Desktop, but my solution with my father's just been installing a Linux distro and helping him there instead, considering there's no market to make consumer viruses for Linux. I've recently started looking at "Neverware CloudReady" (ChromeOS for regular machines), i think that'd be the perfect OS for my father, considering almost everything he does is done through the browser, but still has a few applications that needs local execution. (And they seem to support the Crostini Linux app beta thingy that Google is working so hard on for ChromeOS).

lousken 7y ago

How did we end up here? Antimalware companies turning into spyware ones? And how is this even legal? Just the fact that they add privacy policy makes it legal?

Zelphyr 7y ago
Everybody (except, unfortunately for the moment, our government it seems) has realized just how valuable personal data is. That's turning not only antimalware companies into spyware companies but also search engines, TV manufactuers, etc... I don't think it's really going to change much until we as consumers really start to push back. Sadly, I don't see that happening anytime soon because anytime I mention it to non-techical family and friends the reply I get back is a near unanimous shrug and some mumbling about their not having anything to hide. Of course, inevitably this evolves into them complaining incredulously about their phone listening to them "because so and so talked about such and such product the other day and I NEVER talk about that but when I got home all I saw were ads for that product and how dare they?!" My forehead hurts from frustratedly banging it against the wall.

gregjw 7y ago

What's with all of these unethical antivirus companies infringing privacy for a profit? Surely they're becoming exactly what they're trying to combat..

skocznymroczny 7y ago
It's possible that they're trying to reach new markets. The environment nowadays is much safer than it was 10 years ago. Java applets are dead, Flash is dying, and adblocks are common. Outside of few specific security holes, Javascript sandbox is working well and protecting users from drive-by attacks. USB/CDs are not as common as in the past, so people don't spread viruses from one machine to another. P2P networks and torrents are also less popular because of the wide availability of legal content at low prices.

Ceezy 7y ago

Farewell!!! How this stuff is even possible?

aba_cz 7y ago

Jumpshot (https://www.jumpshot.com/ https://www.jumpshot.com/) is created, owned and operated by Avast (same people sitting in the same offices using same data/servers). 100% of data use for the analytics is provided by that browser plugin. Nothing is anonymized. They (Jumpshot) have unique user/hardware id, url, referrer, IP all browser information and others so they can create their reports. I'm surprised that it surprises anyone after the years of them doing that. They (Avast) are not a nice company.

palant 7y ago
Yes, according to the Avast privacy policy the data is "anonymized or pseudonymized." As I already speculated in https://palant.de/2019/10/28/avast-online-security-and-avast-secure-browser-are-spying-on-you/ https://palant.de/2019/10/28/avast-online-security-and-avast..., they likely went for pseudonymization in this particular case - meaning that they simply left the data as it is. The unique user ID being sent there is technically a pseudonym, meaning that it isn't directly tied to your identity. That this "clickstream data" is easily deanonymized - so far there is no indication that Avast cared.
- aba_cz 7y ago
  It's not tied to your identity, but if you go frequently to some social sites with the same user id in the url (LinkedIn and others) it's possible to match that an HW id to a real name. Also when you buy coupon or goods which are tied to you just by unique ID the data science team could see that in the clickstream and it they were evil enough they could just use that (holiday coupon for example) for themselves. Or private photos shared by unique ID in url. Basically they (employees) could see everything from navigation bar and try to find out who it belongs to. Source: Jumpshot/Avast employees Funny example: They (developers) could see a man from Alaska (IP based) looking for an info about yeti and then going to buy a rifle in the same session.
  - palant 7y ago
    Yes, there is research about finding out the name behind pseudonymized browsing history data - they had success rates in the area of 90%, despite having far less detailed data than what Avast is collecting.

takeda 7y ago

Avast got from the best (free) AV solution to join the scum AV that is malware.

wruza 7y ago
Free cheese is always a part of a mouse trap.

aarongray 7y ago

What does a virus do? Makes your computer run slow, spies on you, and asks you for money What do most antiviruses do? Makes your computer run slow, spies on you, and asks you for money

qxnqd 7y ago
Thanks grandma.

ndesaulniers 7y ago

Didn't a bunch of Mozilla execs leave for Avast? Ironic, if so. (Looks the they went to AVG which got acquired by Avast)?

IvanK_net 7y ago

I wonder, that many people are scared of websites doing something they don't want them to do, but nobody is scared of extensions. Extensions have much bigger permissions than websites. I never used any extension in my browser. I think it is already enough, that each website knows what I do on it, what I click etc. I don't need some third party to know, what I do on all websites.

obenn 7y ago

At this point I think the only options are using the built in OS security for personal use, and endpoint protection like fieldeffect.com or crowdstrike.com for businesses.

badness 7y ago

Seeing so much talk on various AVs being bad, how does bitdefender stack up in vileness?

Nextgrid 7y ago
I had an incident at a client recently where their employees' (macOS) machines would have issues connecting to services on Localhost. The client's request would arrive to the server just fine, but the client would immediately get a connection reset ("empty reply from server" in curl) without getting the response from the server. Eventually we tracked it down to a BitDefender update.

s1k3b8 7y ago

Many years ago, I remember that avast was one of the antivirus software recommended over norton/mcafee/etc. Seems like all the idealistic and "good" tech/software eventually goes bad. Is it money that ultimately corrupts? From google to avast, they all seem to go from saints to sinners. Maybe I was just naive back then and they weren't saints to begin with.