4 ms·

This is nothing specific to WSL though, Windows has always had this problem. I expect there are many Windows developers who have no idea how much time they spen

This is nothing specific to WSL though, Windows has always had this problem. I expect there are many Windows developers who have no idea how much time they spend waiting for their code to be virus scanned every day.

0x138d5 6y ago
Some IDEs have started warning about this performance hit. IntelliJ + Gradle for example, but I'm guessing other Jetbrains products do the same.
- Roritharr 6y ago
  That's what made me aware of the problem. Now I need a comfortable gui for managing just those folders.
glandium 6y ago
To give an idea how bad it is, building Firefox on a Threadripper 3970X on Windows takes slightly over 12 minutes if you don't disable Defender and somewhere around 7 minutes if you do.
- samb1729 6y ago
  What a horrible amount of overhead. Why does Defender need to scan the contents of a bunch of non-executable files? I suspect the answer runs deep and is at least somewhat horrifying.
  - jan6 6y ago
    because windows has no concept of an executable bit, so a rename could make it runnable? or a benign looking program has a built-in interpreter run code from external file?
    - mehrdadn 6y ago
      > windows has no concept of an executable bit Sure it does. Execution is a permission you can set in the security tab. > a rename could make it runnable This is more likely why.
    - samb1729 6y ago
      > because windows has no concept of an executable bit, so a rename could make it runnable This much I understand - but why can something so tightly integrated into the OS not instead intercept a file rename event and scan at that point? I seem to be lacking sufficient information as to what specifically about Windows necessitates scanning everything on the filesystem when macOS and the various common Linux distros seem to do fine without it. It's not as if Windows is the only OS with interpreters, either.
  - mmis1000 6y ago
    Virus do abuse non executables like js, vbs, or whatever script file. Antivirus can't really know if it is the case without open it.
    - samb1729 6y ago
      What is it about Windows that makes this a problem where macOS and Linux seem to be fine? The same mechanisms exist in all three major operating systems, which is to say that technically any executable I choose to run on my computer can load a file and interpret it. Is it really just that Windows users download and run random junk? It's been so long that I've seen a virus of any kind anywhere at all that I genuinely have no clue how people become infected with them or indeed whether it still really happens at all. It certainly feels to me that the era of random toolbars and clearly visible desktop malware is over, but at the same time I live in a different bubble than in the past.
      - Shared404 6y ago
        > I genuinely have no clue how people become infected with them or indeed whether it still really happens at all. I'm a bit late to the conversation, but can confirm that yes, people do still get infected. We almost always turn something up while doing virus scans at the repair shop I work at, and we mostly use off the shelf products, along with a couple other tricks.
      - mkr-hn 6y ago
        It's possible you don't see random toolbars and malware now because Defender works. Microsoft could be smarter and offer default exclusions for some things.
        mmis1000 6y ago
        But even file type that you think it is pretty safe (jpg, wav and some other media foramt) can abuse parser bug in viewers / explore.exe to result in code execution. And how do you prevent the malware just name its .js as .jpg and execute it with some interpreter? Some interpreters definitively don't care about file extensions.
  - magicalhippo 6y ago
    > Why does Defender need to scan the contents of a bunch of non-executable files? While I agree the overhead is atrocious, buffer overflows and similar bugs can turn an "innocent" non-executable file into an executable, like this[1] JPEG file parser issue affecting a large number of applications using GDI+. That said, I'd be surprised if it couldn't be smarter about this. [1]: https://us-cert.cisa.gov/ncas/archives/alerts/TA04-260A https://us-cert.cisa.gov/ncas/archives/alerts/TA04-260A
CamperBob2 6y ago
Try "every compile." If you wonder why your .exe takes a couple of extra seconds to start up the first time you run it after a build, well, this is why.

0x138d5 6y ago

Some IDEs have started warning about this performance hit. IntelliJ + Gradle for example, but I'm guessing other Jetbrains products do the same.

Roritharr 6y ago
That's what made me aware of the problem. Now I need a comfortable gui for managing just those folders.

glandium 6y ago

To give an idea how bad it is, building Firefox on a Threadripper 3970X on Windows takes slightly over 12 minutes if you don't disable Defender and somewhere around 7 minutes if you do.

samb1729 6y ago
What a horrible amount of overhead. Why does Defender need to scan the contents of a bunch of non-executable files? I suspect the answer runs deep and is at least somewhat horrifying.
- jan6 6y ago
  because windows has no concept of an executable bit, so a rename could make it runnable? or a benign looking program has a built-in interpreter run code from external file?
  - mehrdadn 6y ago
    > windows has no concept of an executable bit Sure it does. Execution is a permission you can set in the security tab. > a rename could make it runnable This is more likely why.
  - samb1729 6y ago
    > because windows has no concept of an executable bit, so a rename could make it runnable This much I understand - but why can something so tightly integrated into the OS not instead intercept a file rename event and scan at that point? I seem to be lacking sufficient information as to what specifically about Windows necessitates scanning everything on the filesystem when macOS and the various common Linux distros seem to do fine without it. It's not as if Windows is the only OS with interpreters, either.
- mmis1000 6y ago
  Virus do abuse non executables like js, vbs, or whatever script file. Antivirus can't really know if it is the case without open it.
  - samb1729 6y ago
    What is it about Windows that makes this a problem where macOS and Linux seem to be fine? The same mechanisms exist in all three major operating systems, which is to say that technically any executable I choose to run on my computer can load a file and interpret it. Is it really just that Windows users download and run random junk? It's been so long that I've seen a virus of any kind anywhere at all that I genuinely have no clue how people become infected with them or indeed whether it still really happens at all. It certainly feels to me that the era of random toolbars and clearly visible desktop malware is over, but at the same time I live in a different bubble than in the past.
    - Shared404 6y ago
      > I genuinely have no clue how people become infected with them or indeed whether it still really happens at all. I'm a bit late to the conversation, but can confirm that yes, people do still get infected. We almost always turn something up while doing virus scans at the repair shop I work at, and we mostly use off the shelf products, along with a couple other tricks.
    - mkr-hn 6y ago
      It's possible you don't see random toolbars and malware now because Defender works. Microsoft could be smarter and offer default exclusions for some things.
      - mmis1000 6y ago
        But even file type that you think it is pretty safe (jpg, wav and some other media foramt) can abuse parser bug in viewers / explore.exe to result in code execution. And how do you prevent the malware just name its .js as .jpg and execute it with some interpreter? Some interpreters definitively don't care about file extensions.
- magicalhippo 6y ago
  > Why does Defender need to scan the contents of a bunch of non-executable files? While I agree the overhead is atrocious, buffer overflows and similar bugs can turn an "innocent" non-executable file into an executable, like this[1] JPEG file parser issue affecting a large number of applications using GDI+. That said, I'd be surprised if it couldn't be smarter about this. [1]: https://us-cert.cisa.gov/ncas/archives/alerts/TA04-260A https://us-cert.cisa.gov/ncas/archives/alerts/TA04-260A

CamperBob2 6y ago

Try "every compile." If you wonder why your .exe takes a couple of extra seconds to start up the first time you run it after a build, well, this is why.