36 ms·

We've been made to use Macs at work now and they have McAfee on that we can't disable, causes no end of performance issues

KingOfCoders 6y ago
We also had anti-virus software on every Mac in large enterprise. Took a lot of effort to at least except source directories.
- wilsonrocks 6y ago
  Oooh I wonder if I could get that here - things like npm install(presume any package manager, certainly homebrew) or git commands take obscenely long times.
  - joosters 6y ago
    Commands that download random 3rd party code and dependencies from the internet are precisely the kind of thing that should be included in a virus scan, surely?
    - foepys 6y ago
      Especially since any npm package can execute any code at install time in npm's default configuration. On Linux this is extra juicy since you cannot globally install any package without root unless you explicitly changed the directory's permissions and/or location.
      - jessaustin 6y ago
        By default, npm installs into the local project directory, as it should. Only the OS package manager should touch system directories. Before using the "--global" flag, think about what you're actually trying to do, and what the better way to do that would be. One conventional workaround is to install commonly used tools to "~/bin". Root is not required for that. Of course, it's a good idea to keep the username used for development separate from the one used for browsing the web. It wouldn't be surprising for rogue npm packages to search for e.g. credit card details. I'm sure the browsers try to obfuscate that somehow, but how much can they really defend against code that is allowed to read the disk?
        foepys 6y ago
        On Windows npm is using %AppData%\npm by default (which is wrong btw, it should use %LocalAppData%\npm as %AppData% is meant for configuration files). This means I don't require any elevation to install packages for my user without additional configuration. Installing tools like yarn or @angular/cli globally is not uncommon.
        jessaustin 6y ago
        I have no idea about windoze. I disagreed with the above incorrect statement about Linux.
        foepys 6y ago
        It wasn't incorrect, you misunderstood. npm just uses silly defaults on Linux while using saner defaults on Windows and mac os. I am a Linux user and having to configure npm to use another path for global packages that I use in literally all my projects is just bad UX.
        jessaustin 6y ago
        Sure, npm has bad UX. (For an actual example, see the stubborn refusal to follow XDG spec.) This is not an example of that. Defaulting prefix to "/usr/local" is what every well-behaved Linux package does. It seems odd to install so many packages at the "global" (but not owned by root!) level, that using the "--prefix=~" flag would be a hardship. I just checked; I have three. You can't fault npm for this.
    - lucideer 6y ago
      Only if you believe apps like McAfee are benign. I'd say excepting source directories is less about engineers believing those are safe directories and more about engineers wanting to except their entire machine and source directories being the compromise management went for.
      - joosters 6y ago
        Only if you believe apps like McAfee are benign. If sysadmins have installed McAfee on your workstation, then presumably they want to use it. Installing it and then excluding code downloaded from the internet defeats the whole point. (The effectiveness/safety/whatever of antivirus is a completely separate issue.)
        lucideer 6y ago
        > The effectiveness/safety/whatever of antivirus is a completely separate issue. Struggling to understand how this is a separate issue?
        joosters 6y ago
        If you have antivirus software installed, you presumably want it to scan stuff that is downloaded from the internet. On the other hand, if you don't believe/trust in the efficacy of antivirus software, then there's no point taking half measures and excluding some things from its scans, instead why use it at all?
        orisho 6y ago
        The problem is usually that AVs hook file operations to scan files. Unfortunately, software development performs a LOT of file IO by package management and compilers, and in the case of compilers those files are internally formatted as files containing code (eg obj files, libs or executables), even if they are only temporary during the build. Because of this, an AV product could work fine for every department of the company, but have an extreme negative performance impact on software devs. To give you an idea, it could mean the difference between a 5 minute and a 1 hour build. These issues are inherent to a generic AV product so often the fix is simply to add those folders to an exclusion list. Does it provide security for those folders? Nope. But the alternative could make it impossible to get work done.
    - KingOfCoders 6y ago
      I'd agree. We had Java and used and enterprise package proxy to reduce the risks. Wouldn't do that for npm. Also these machines were on a seperate network with no share access for example - not on the corporate network with all the other machines.
leephillips 6y ago
That’s hilarious. John McAfee himself has a useful video that you can search for on YouTube with instructions on how to disable it.
- dgellow 6y ago
  Link: https://www.youtube.com/watch?v=bKgf5PaBzyg https://www.youtube.com/watch?v=bKgf5PaBzyg Warning: NSFW!
ehutch79 6y ago
That isn't unique to macs though, most of the anti-virus crap is.. crap...

KingOfCoders 6y ago

We also had anti-virus software on every Mac in large enterprise. Took a lot of effort to at least except source directories.

wilsonrocks 6y ago
Oooh I wonder if I could get that here - things like npm install(presume any package manager, certainly homebrew) or git commands take obscenely long times.
- joosters 6y ago
  Commands that download random 3rd party code and dependencies from the internet are precisely the kind of thing that should be included in a virus scan, surely?
  - foepys 6y ago
    Especially since any npm package can execute any code at install time in npm's default configuration. On Linux this is extra juicy since you cannot globally install any package without root unless you explicitly changed the directory's permissions and/or location.
    - jessaustin 6y ago
      By default, npm installs into the local project directory, as it should. Only the OS package manager should touch system directories. Before using the "--global" flag, think about what you're actually trying to do, and what the better way to do that would be. One conventional workaround is to install commonly used tools to "~/bin". Root is not required for that. Of course, it's a good idea to keep the username used for development separate from the one used for browsing the web. It wouldn't be surprising for rogue npm packages to search for e.g. credit card details. I'm sure the browsers try to obfuscate that somehow, but how much can they really defend against code that is allowed to read the disk?
      - foepys 6y ago
        On Windows npm is using %AppData%\npm by default (which is wrong btw, it should use %LocalAppData%\npm as %AppData% is meant for configuration files). This means I don't require any elevation to install packages for my user without additional configuration. Installing tools like yarn or @angular/cli globally is not uncommon.
        jessaustin 6y ago
        I have no idea about windoze. I disagreed with the above incorrect statement about Linux.
        foepys 6y ago
        It wasn't incorrect, you misunderstood. npm just uses silly defaults on Linux while using saner defaults on Windows and mac os. I am a Linux user and having to configure npm to use another path for global packages that I use in literally all my projects is just bad UX.
        jessaustin 6y ago
        Sure, npm has bad UX. (For an actual example, see the stubborn refusal to follow XDG spec.) This is not an example of that. Defaulting prefix to "/usr/local" is what every well-behaved Linux package does. It seems odd to install so many packages at the "global" (but not owned by root!) level, that using the "--prefix=~" flag would be a hardship. I just checked; I have three. You can't fault npm for this.
  - lucideer 6y ago
    Only if you believe apps like McAfee are benign. I'd say excepting source directories is less about engineers believing those are safe directories and more about engineers wanting to except their entire machine and source directories being the compromise management went for.
    - joosters 6y ago
      Only if you believe apps like McAfee are benign. If sysadmins have installed McAfee on your workstation, then presumably they want to use it. Installing it and then excluding code downloaded from the internet defeats the whole point. (The effectiveness/safety/whatever of antivirus is a completely separate issue.)
      - lucideer 6y ago
        > The effectiveness/safety/whatever of antivirus is a completely separate issue. Struggling to understand how this is a separate issue?
        joosters 6y ago
        If you have antivirus software installed, you presumably want it to scan stuff that is downloaded from the internet. On the other hand, if you don't believe/trust in the efficacy of antivirus software, then there's no point taking half measures and excluding some things from its scans, instead why use it at all?
        orisho 6y ago
        The problem is usually that AVs hook file operations to scan files. Unfortunately, software development performs a LOT of file IO by package management and compilers, and in the case of compilers those files are internally formatted as files containing code (eg obj files, libs or executables), even if they are only temporary during the build. Because of this, an AV product could work fine for every department of the company, but have an extreme negative performance impact on software devs. To give you an idea, it could mean the difference between a 5 minute and a 1 hour build. These issues are inherent to a generic AV product so often the fix is simply to add those folders to an exclusion list. Does it provide security for those folders? Nope. But the alternative could make it impossible to get work done.
  - KingOfCoders 6y ago
    I'd agree. We had Java and used and enterprise package proxy to reduce the risks. Wouldn't do that for npm. Also these machines were on a seperate network with no share access for example - not on the corporate network with all the other machines.

leephillips 6y ago

That’s hilarious. John McAfee himself has a useful video that you can search for on YouTube with instructions on how to disable it.

dgellow 6y ago
Link: https://www.youtube.com/watch?v=bKgf5PaBzyg https://www.youtube.com/watch?v=bKgf5PaBzyg Warning: NSFW!

ehutch79 6y ago

That isn't unique to macs though, most of the anti-virus crap is.. crap...