13 ms·

Most antivirus software feels sketchy in general (snake oil). The only antivirus I run at the moment is Windows Defender. For me the main reason is that Micros

Most antivirus software feels sketchy in general (snake oil). The only antivirus I run at the moment is Windows Defender. For me the main reason is that Microsoft actually benefits from a virus free system because it improves Windows as a platform. Antivirus software vendors benefit from viruses spreading around because it improves sales of their products. Also Windows Defender is fairly non-intrusive, it doesn't advertise a sketchy VPN, a sketchy adblock, a sketchy torrent or any other tool that usually anti-virus vendors try to bundle together.

nesky 7y ago
Doubling down on this, I do the same and have had maybe 1 instance where Defender didn't catch something in what seems like the last 10 years I've used it almost exclusively for 'virus' protection.
- lawnchair_larry 7y ago
  How would you know if it didn’t catch something?
  - nesky 7y ago
    Don't recall what specifically I was doing at the time but was maybe 7 or 8 years ago my computer got a virus and took me close to a week to fully gain control of my machine again. Only time I got actual warnings from Defender about something it couldn't erase.
  - penagwin 7y ago
    More often then not you'll find some "helpful" changes to your browsing experience, and/or "team.bitcoinz" running at 100% cpu, or your files are encrypted. Most viruses aren't stealthy, although a few are, and you're right, those you'll have a hard time with if they're well hidden and undetected. IMO - Something like Glasswire + Windows Defender is pretty robust. Nearly any virus will need network connectivity after all.
    - clarry 7y ago
      > Most viruses aren't stealthy Do you have data?
      - penagwin 7y ago
        Yes? But most viruses don't lay dormant waiting for you to type in a bank account password and quietly send it off (some do for sure). A lot of viruses sell "installs" - where other less moral software devs will pay per installation of their software. Or they spam ads across your entire computer etc. Or they encrypt your files and demand a ransom. None of these things are quiet or stealthy - anybody with decent IT experience will notice them pretty fast. It's kinda like regular crime. Sure every once in a while there's a thief that quietly lockpicks his way into somebodies home after spying on them and knowing they've left on vacation, leaving little evidence they took anything at all. Most of the time somebody just does a smash-and-grab, quick and dirty.
        clarry 7y ago
        You don't want to share that data? I keep running into the same phenomenon everywhere; everyone thinks they know whether they've been infected or not. I suppose everyone is a malware expert, so there's no need to share the data with anyone. I'm quite out of the loop here.
        penagwin 7y ago
        > I keep running into the same phenomenon everywhere; everyone thinks they know whether they've been infected or not. I mean I get what you're saying. My point is that most viruses aren't trying to be hidden, so they're rather obvious. Of course there's a chance they try to be sneaky, and you're right you have no way of knowing if those are present and well hidden. But anti-virus only does so much, if you're past Windows Defender you're past a bunch of other tools too. A lot of anti-malware software is very generic, and relies on some rather dumb techniques.
bsharitt 7y ago
> Also Windows Defender is fairly non-intrusive Microsoft and antivirus vendors have very different goals. Microsoft wants to quietly protect your computer without making a big deal out of viruses, while antivirus vendors always want to let you know that they're hard at work protecting you and that the world is a dangerous place so keep giving them money(or in the case of free versions, keep it installed so they can keep vacuuming that data).
- Brave-Steak 7y ago
  I think one of the worst parts of this kind of stuff is that paying for the product doesn't mean they stop selling all your data. It just means they make even more money off of you.
  - simias 7y ago
    That's the standard these days unfortunately. Why turn these options off when most users won't even notice and you get more money in the end? I wish that my various "premium" subscriptions to services like Spotify or various other apps meant that my privacy will be respected but I have absolutely no illusions about it. That's why I'll never ever consent to turning off u-block, I want the freemium/ad-driven model to die, it's the original evil that makes all these practices worthwhile.
    - reaperducer 7y ago
      Why turn these options off when most users won't even notice and you get more money in the end? Because it's the right thing to do? Why is it so hard for people in technology to simply do what's right? I don't buy the hackneyed HN arguments about "A company is required to maximize profits for the shareholder!" or high school thought exercises like, "Who gets to decide what is right?" It's simply not that hard. I wonder if software engineers had to pass ethics classes like other types of engineers if the world would be a different place today.
      - simias 7y ago
zojirushibottle 7y ago
funny, i said the same thing before but it came off wrong and people didn't get it or something. i only run windows defender too, not because it's efficient -- i don't know, i have never seen it catch anything -- but because it's the less sketchy of the bunch!
cypressious 7y ago
Agree with the non-intrusive part. However Defender does slow down programs that do a lot of filesystem IO. I tend to disable it when I update bigger programs or run other IO heavy tasks.
- tiernano 7y ago
  As a dev house, I agree on the io, but our solution is to add our dev folders to the exclusion list. One of our build times went from 10min to start a debug to less than 1min...
duxup 7y ago
The non-intrusive factor was huge for me. I remember when it came out and it would scan away and do it's thing and it was pretty much noticeable. I was "yeah this is it" uninstalled whatever I was using at the time and never looked back. That was a big plus in a market where as you say everything feels sketchy.
Ansil849 7y ago
> For me the main reason is that Microsoft actually benefits from a virus free system because it improves Windows as a platform. From the article: > Some past, present, and potential clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Home Depot, Condé Nast, Intuit, and many others. Microsoft doesn't need its AV products to do shady data collection because it outsources this to third-party shady AV products, therefore keeping its own reputation clean as your post demonstrates.
- CPLX 7y ago
  The word potential is doing a ton of work in that sentence.
  - Ansil849 7y ago
    From further in the article: > Microsoft declined to comment on the specifics of why it purchased products from Jumpshot, but said that it doesn't have a current relationship with the company. Which seems to indicate that Microsoft is in the list of past, not potential clients.
- chapium 7y ago
  Microsoft can collect information through their OS, why bother with doing it in AV.
  - Ansil849 7y ago
    Well, for that matter why bother purchasing it from this third party? Ostensibly for the same reason as not doing it in AV.
scott_s 7y ago
I think that has been the conclusion for a while. I went poking around for old stories, and the best I could find was a thread from 2016: “AV is my single biggest impediment to shipping a secure browser,” https://news.ycombinator.com/item?id=13079569 https://news.ycombinator.com/item?id=13079569 And a follow-up, "Avoid Non-Microsoft Antivirus Software", https://news.ycombinator.com/item?id=13489100 https://news.ycombinator.com/item?id=13489100 I believe there have been academic studies on the non-effectiveness of antivirus software, but I can't find them. (If others can, I'd like to read them.) I find the argument that antivirus software increases attack surface compelling because it's third-party software that tries to get into everything. This is not the '90s anymore; all of the big players care about security. I think that the engineers at Microsoft, Google, Apple and Firefox are more qualified to secure their own software than outside vendors are.
- BlueTemplar 7y ago
  Well, in the 90' things weren't nearly as bad, since hardly anyone even had an Internet connection...
safog 7y ago
I think there's several different underlying causes to Windows feeling more secure (not needing antivirus) these days: 1. Security on desktops has been improved quite a bit. You can no longer simply email someone a .exe file that's the equivalent of `sudo rm -rf /` and have it work, multiple levels of safeguards (from the browser, to the email virus scan to windows defender catch it). OS's also simply won't run unsigned binaries anymore unless you force them to which is (maybe?) a good thing. 2. Piracy has been on a downtick, and people seem to be more open to paying for software since App stores made it somewhat more acceptable. Less likelihood that people download sketchy binaries off the internet and run them on their PCs. 3. More hours spent on mobile OSes which are inherently more secure. casual PC usage at home is declining.
- silicon2401 7y ago
  speaking of this, is there a recommended way to run a windows binary within Ubuntu 18.04? I don't want to dual-boot windows because I read that installing windows after ubuntu isn't recommended, but I don't have experience running a windows environment within Ubuntu either.
  - cyberbanjo 7y ago
    Wine is an emulation layer for Win32 on Linux. You can install Windows in a virtual machine if you have enough resources.
    - silicon2401 7y ago
      Thank you.
    - abtinf 7y ago
      > Wine is an emulation layer Wine literally stands for “Wine is Not an Emulator”.
  - dredmorbius 7y ago
    Other than Wine, you can run any virtualisation system (qemu, VirtualBox, VMWare, Xen, ...) which will effectively give you a Windows (or other) OS running within your Linux system. It won't have direct local OS access, but files and networking can be shared through most emulation systems, generally as SMB/CFS shares.
ticmasta 7y ago
This is the same logic motivating me to (infrequently) buy Windows computers from the Microsoft store. They don't benefit from a brand-new Windows PC that runs like molasses so they don't have any bloatware* or other performance slowing software like a Dell PC or worse, your typical Best buy computer. The prices are on-par despite not getting the kickbacks where most manufacturers generate the majority of their profit. * except for that which is or comes with Windows. Unfortunately this has grown substantially - Windows 7 seems like something of a high-water mark for performance/polish/lean...
- rapind 7y ago
  Except that M$ was bundling ads and apps in Windows 10 (a paid OS) themselves. It's a sad state where other actors are so terrible that MS starts to look like a savior.
the8472 7y ago
One issue with all antivirus on windows, including defender, is the performance impact. It seems to be dreadfully single-threaded, or at least make single-threaded workloads even worse. Monitoring CPU use during updates easily shows this, there are periods where a single core is busy with the defender service and nothing else is happening. Another issue that while microsoft's incentives may be better aligned it still fundamentally is an antivirus and thus an increase in attacksurface. There have been exploits against it[0] and it turned out that it did things with SYSTEM privileges and no sandboxing. [0] https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=msmpeng https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
- BlueTemplar 7y ago
  If only one core is busy, then it shouldn't have much of a performance impact?
  - the8472 7y ago
    It's only one core pegged at 100%, practically nothing else, which means it's a sequential workload entirely blocked on defender.
    - BlueTemplar 7y ago
      Oh, you mean that Defender locks your thread?
      - the8472 7y ago
        I don't recall seeing significant locking in the stack samples, just that the scanning happens synchronously during some IO (e.g. closing file handles) and >90% of the CPU cycles are spent on defender. Which effectively boils down to a task that should be IO-bound becoming bottlenecked by waiting on defender.
KumarAseem 7y ago
What is there to prevent Microsoft from not having Defender monitor and report the traffic back to MS once it has gained a big foothold? MS with Win10 forcefully collects a lot of data and adding a little bit of data through Defender will give them a really huge(complete) picture.
- BlueTemplar 7y ago
  What would using Defender add to what they can already get?
  - KumarAseem 7y ago
    Browsing data which may not be getting collected through telemetry hopefully.
    - BlueTemplar 7y ago
      Aren't they already likely to collect this data through indexing?

nesky 7y ago

Doubling down on this, I do the same and have had maybe 1 instance where Defender didn't catch something in what seems like the last 10 years I've used it almost exclusively for 'virus' protection.

lawnchair_larry 7y ago
How would you know if it didn’t catch something?
- nesky 7y ago
  Don't recall what specifically I was doing at the time but was maybe 7 or 8 years ago my computer got a virus and took me close to a week to fully gain control of my machine again. Only time I got actual warnings from Defender about something it couldn't erase.
- penagwin 7y ago
  More often then not you'll find some "helpful" changes to your browsing experience, and/or "team.bitcoinz" running at 100% cpu, or your files are encrypted. Most viruses aren't stealthy, although a few are, and you're right, those you'll have a hard time with if they're well hidden and undetected. IMO - Something like Glasswire + Windows Defender is pretty robust. Nearly any virus will need network connectivity after all.
  - clarry 7y ago
    > Most viruses aren't stealthy Do you have data?
    - penagwin 7y ago
      Yes? But most viruses don't lay dormant waiting for you to type in a bank account password and quietly send it off (some do for sure). A lot of viruses sell "installs" - where other less moral software devs will pay per installation of their software. Or they spam ads across your entire computer etc. Or they encrypt your files and demand a ransom. None of these things are quiet or stealthy - anybody with decent IT experience will notice them pretty fast. It's kinda like regular crime. Sure every once in a while there's a thief that quietly lockpicks his way into somebodies home after spying on them and knowing they've left on vacation, leaving little evidence they took anything at all. Most of the time somebody just does a smash-and-grab, quick and dirty.
      - clarry 7y ago
        You don't want to share that data? I keep running into the same phenomenon everywhere; everyone thinks they know whether they've been infected or not. I suppose everyone is a malware expert, so there's no need to share the data with anyone. I'm quite out of the loop here.
        penagwin 7y ago
        > I keep running into the same phenomenon everywhere; everyone thinks they know whether they've been infected or not. I mean I get what you're saying. My point is that most viruses aren't trying to be hidden, so they're rather obvious. Of course there's a chance they try to be sneaky, and you're right you have no way of knowing if those are present and well hidden. But anti-virus only does so much, if you're past Windows Defender you're past a bunch of other tools too. A lot of anti-malware software is very generic, and relies on some rather dumb techniques.

bsharitt 7y ago

> Also Windows Defender is fairly non-intrusive Microsoft and antivirus vendors have very different goals. Microsoft wants to quietly protect your computer without making a big deal out of viruses, while antivirus vendors always want to let you know that they're hard at work protecting you and that the world is a dangerous place so keep giving them money(or in the case of free versions, keep it installed so they can keep vacuuming that data).

Brave-Steak 7y ago
I think one of the worst parts of this kind of stuff is that paying for the product doesn't mean they stop selling all your data. It just means they make even more money off of you.
- simias 7y ago
  That's the standard these days unfortunately. Why turn these options off when most users won't even notice and you get more money in the end? I wish that my various "premium" subscriptions to services like Spotify or various other apps meant that my privacy will be respected but I have absolutely no illusions about it. That's why I'll never ever consent to turning off u-block, I want the freemium/ad-driven model to die, it's the original evil that makes all these practices worthwhile.
  - reaperducer 7y ago
    Why turn these options off when most users won't even notice and you get more money in the end? Because it's the right thing to do? Why is it so hard for people in technology to simply do what's right? I don't buy the hackneyed HN arguments about "A company is required to maximize profits for the shareholder!" or high school thought exercises like, "Who gets to decide what is right?" It's simply not that hard. I wonder if software engineers had to pass ethics classes like other types of engineers if the world would be a different place today.
    - simias 7y ago

zojirushibottle 7y ago

funny, i said the same thing before but it came off wrong and people didn't get it or something. i only run windows defender too, not because it's efficient -- i don't know, i have never seen it catch anything -- but because it's the less sketchy of the bunch!

cypressious 7y ago

Agree with the non-intrusive part. However Defender does slow down programs that do a lot of filesystem IO. I tend to disable it when I update bigger programs or run other IO heavy tasks.

tiernano 7y ago
As a dev house, I agree on the io, but our solution is to add our dev folders to the exclusion list. One of our build times went from 10min to start a debug to less than 1min...

duxup 7y ago

The non-intrusive factor was huge for me. I remember when it came out and it would scan away and do it's thing and it was pretty much noticeable. I was "yeah this is it" uninstalled whatever I was using at the time and never looked back. That was a big plus in a market where as you say everything feels sketchy.

Ansil849 7y ago

> For me the main reason is that Microsoft actually benefits from a virus free system because it improves Windows as a platform. From the article: > Some past, present, and potential clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Home Depot, Condé Nast, Intuit, and many others. Microsoft doesn't need its AV products to do shady data collection because it outsources this to third-party shady AV products, therefore keeping its own reputation clean as your post demonstrates.

CPLX 7y ago
The word potential is doing a ton of work in that sentence.
- Ansil849 7y ago
  From further in the article: > Microsoft declined to comment on the specifics of why it purchased products from Jumpshot, but said that it doesn't have a current relationship with the company. Which seems to indicate that Microsoft is in the list of past, not potential clients.
chapium 7y ago
Microsoft can collect information through their OS, why bother with doing it in AV.
- Ansil849 7y ago
  Well, for that matter why bother purchasing it from this third party? Ostensibly for the same reason as not doing it in AV.

scott_s 7y ago

I think that has been the conclusion for a while. I went poking around for old stories, and the best I could find was a thread from 2016: “AV is my single biggest impediment to shipping a secure browser,” https://news.ycombinator.com/item?id=13079569 https://news.ycombinator.com/item?id=13079569 And a follow-up, "Avoid Non-Microsoft Antivirus Software", https://news.ycombinator.com/item?id=13489100 https://news.ycombinator.com/item?id=13489100 I believe there have been academic studies on the non-effectiveness of antivirus software, but I can't find them. (If others can, I'd like to read them.) I find the argument that antivirus software increases attack surface compelling because it's third-party software that tries to get into everything. This is not the '90s anymore; all of the big players care about security. I think that the engineers at Microsoft, Google, Apple and Firefox are more qualified to secure their own software than outside vendors are.

BlueTemplar 7y ago
Well, in the 90' things weren't nearly as bad, since hardly anyone even had an Internet connection...

safog 7y ago

I think there's several different underlying causes to Windows feeling more secure (not needing antivirus) these days: 1. Security on desktops has been improved quite a bit. You can no longer simply email someone a .exe file that's the equivalent of `sudo rm -rf /` and have it work, multiple levels of safeguards (from the browser, to the email virus scan to windows defender catch it). OS's also simply won't run unsigned binaries anymore unless you force them to which is (maybe?) a good thing. 2. Piracy has been on a downtick, and people seem to be more open to paying for software since App stores made it somewhat more acceptable. Less likelihood that people download sketchy binaries off the internet and run them on their PCs. 3. More hours spent on mobile OSes which are inherently more secure. casual PC usage at home is declining.

silicon2401 7y ago
speaking of this, is there a recommended way to run a windows binary within Ubuntu 18.04? I don't want to dual-boot windows because I read that installing windows after ubuntu isn't recommended, but I don't have experience running a windows environment within Ubuntu either.
- cyberbanjo 7y ago
  Wine is an emulation layer for Win32 on Linux. You can install Windows in a virtual machine if you have enough resources.
  - silicon2401 7y ago
    Thank you.
  - abtinf 7y ago
    > Wine is an emulation layer Wine literally stands for “Wine is Not an Emulator”.
- dredmorbius 7y ago
  Other than Wine, you can run any virtualisation system (qemu, VirtualBox, VMWare, Xen, ...) which will effectively give you a Windows (or other) OS running within your Linux system. It won't have direct local OS access, but files and networking can be shared through most emulation systems, generally as SMB/CFS shares.

ticmasta 7y ago

This is the same logic motivating me to (infrequently) buy Windows computers from the Microsoft store. They don't benefit from a brand-new Windows PC that runs like molasses so they don't have any bloatware* or other performance slowing software like a Dell PC or worse, your typical Best buy computer. The prices are on-par despite not getting the kickbacks where most manufacturers generate the majority of their profit. * except for that which is or comes with Windows. Unfortunately this has grown substantially - Windows 7 seems like something of a high-water mark for performance/polish/lean...

rapind 7y ago
Except that M$ was bundling ads and apps in Windows 10 (a paid OS) themselves. It's a sad state where other actors are so terrible that MS starts to look like a savior.

the8472 7y ago

One issue with all antivirus on windows, including defender, is the performance impact. It seems to be dreadfully single-threaded, or at least make single-threaded workloads even worse. Monitoring CPU use during updates easily shows this, there are periods where a single core is busy with the defender service and nothing else is happening. Another issue that while microsoft's incentives may be better aligned it still fundamentally is an antivirus and thus an increase in attacksurface. There have been exploits against it[0] and it turned out that it did things with SYSTEM privileges and no sandboxing. [0] https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=msmpeng https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

BlueTemplar 7y ago
If only one core is busy, then it shouldn't have much of a performance impact?
- the8472 7y ago
  It's only one core pegged at 100%, practically nothing else, which means it's a sequential workload entirely blocked on defender.
  - BlueTemplar 7y ago
    Oh, you mean that Defender locks your thread?
    - the8472 7y ago
      I don't recall seeing significant locking in the stack samples, just that the scanning happens synchronously during some IO (e.g. closing file handles) and >90% of the CPU cycles are spent on defender. Which effectively boils down to a task that should be IO-bound becoming bottlenecked by waiting on defender.

KumarAseem 7y ago

What is there to prevent Microsoft from not having Defender monitor and report the traffic back to MS once it has gained a big foothold? MS with Win10 forcefully collects a lot of data and adding a little bit of data through Defender will give them a really huge(complete) picture.

BlueTemplar 7y ago
What would using Defender add to what they can already get?
- KumarAseem 7y ago
  Browsing data which may not be getting collected through telemetry hopefully.
  - BlueTemplar 7y ago
    Aren't they already likely to collect this data through indexing?