3 ms·

If you were to test ClamAV on a few thousand malware samples you would probably find that the detection rate would be in the low single digits. At the same tim

If you were to test ClamAV on a few thousand malware samples you would probably find that the detection rate would be in the low single digits. At the same time, ClamAV has a terrifying CVE track record. There's no upside, and all downside.

8organicbits 6y ago
CVE track record for ClamAV is not perfect, but doesn't seem out of line with similar products. ClamAV: https://www.cvedetails.com/product/15657/Clamav-Clamav.html?vendor_id=8871 https://www.cvedetails.com/product/15657/Clamav-Clamav.html?... Norton AV: https://www.cvedetails.com/product/398/Symantec-Norton-Antivirus.html?vendor_id=76 https://www.cvedetails.com/product/398/Symantec-Norton-Antiv... Windows Defender: https://www.cvedetails.com/product/9767/Microsoft-Windows-Defender.html?vendor_id=26 https://www.cvedetails.com/product/9767/Microsoft-Windows-De... It may be safer to say that the CVE record for most AV software isn't great.
jka 6y ago
As I understand it, Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly. Given that, a possible upside with ClamAV could be that you could verify the behaviour of the processes on the installed systems, to make sure you're up-to-date and have the correct software and signatures installed. That's not unreasonable - Microsoft's software delivery pipeline should be trustworthy and their security reputation could be damaged if an issue were discovered here.
- acdha 6y ago
  > Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly. That’s true of everything installed on a system - if you don’t control the software you’re running, Defender is the least of your worries. Unless you’re doing a full analysis of every binary you’re trusting the source.

8organicbits 6y ago

CVE track record for ClamAV is not perfect, but doesn't seem out of line with similar products. ClamAV: https://www.cvedetails.com/product/15657/Clamav-Clamav.html?vendor_id=8871 https://www.cvedetails.com/product/15657/Clamav-Clamav.html?... Norton AV: https://www.cvedetails.com/product/398/Symantec-Norton-Antivirus.html?vendor_id=76 https://www.cvedetails.com/product/398/Symantec-Norton-Antiv... Windows Defender: https://www.cvedetails.com/product/9767/Microsoft-Windows-Defender.html?vendor_id=26 https://www.cvedetails.com/product/9767/Microsoft-Windows-De... It may be safer to say that the CVE record for most AV software isn't great.

jka 6y ago

As I understand it, Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly. Given that, a possible upside with ClamAV could be that you could verify the behaviour of the processes on the installed systems, to make sure you're up-to-date and have the correct software and signatures installed. That's not unreasonable - Microsoft's software delivery pipeline should be trustworthy and their security reputation could be damaged if an issue were discovered here.

acdha 6y ago
> Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly. That’s true of everything installed on a system - if you don’t control the software you’re running, Defender is the least of your worries. Unless you’re doing a full analysis of every binary you’re trusting the source.