5 ms·

The author is really kind of all over the place in this piece which for me really serves to reduce its impact. Clearly they had a strong need to vent, somewhat

The author is really kind of all over the place in this piece which for me really serves to reduce its impact. Clearly they had a strong need to vent, somewhat warranted, but they are casting a very wide net of aspersions. There are a lot of issues with the industry around antivirus/security vendors. It is a very gross industry for a lot of different reasons, but the trying to tie that into how Google is evil and also tech journalism is corrupt and unfit makes the author come across so much weaker. I’m also a little confused as to why the author, already unhappy with the free version of the product, decided to pony up for the paid version in the first place. Semi-related: AV software plays a huge role in the security ecosystem and it’s value is unmistakable in that context but it is worth considering how we get there. The way AV software is sold and marketed is generally some of the slimiest, especially the non-big name stuff. We all benefit from the very wide net they cast in a collective sense but from the end-user perspective, especially as a technically savvy user, the cost seems outweighed by the benefit. Personally I’m of the mind that if anything is questionable I’ll run it through virustotal on-demand and make a judgement from their but also if I’m wondering that deeply enough I’m just as inclined not to touch something potentially volatile. This doesn’t work for a layperson but the stuff built in to windows is honestly more than enough for a casual user. If things have progressed beyond that, they need professional help anyways.

atoav 5y ago
There is this class of tech outlets for "advanced" computer users (the kind which comes with CDs and USB drives full of "useful" software) which is pure snake oil marketing material. The truth is, that with the right behaviour you probably don't need any AV product. Don't click on weird links, use adblockers, don't open weird documents especially when they come via mail, keep your OS and software up to date, etc. For all the other stuff (zero days) AV software won't help you and in fact AV software will often even increase the attack surface of your system (remote code execution via AV-buffer overflow is not a rare thing to happen). On my Windows machines I am not using AV software since roughly a decade and I have not had a single issue. Telling people that they can click around carefree if only they have an AV software installed is irresponsible IMO. AV software is not a substitute for education.
- BrandoElFollito 5y ago
  I am genuinely curious: how do you know that you do not have an issue? You may have been infected by a botnet and your machine may be doing things without you knowing. It is possible of course to have some countermeasures (integrity checks, baseline checks) but this is hard work.
  - tgragnato 5y ago
    A good starting point is to set up a network tap and analyze the logs, manually. Obviously, it's one of those things that is rarely done by the people who use fancy security products. .. because it’s hard E.g.: Botnet traffic is often “strange” and easy to recognize
    - BrandoElFollito 5y ago
      I am a security professional and use all kinds of fancy security products in a 100+k IP deployment. They do not do any magical stuff but the alternative is to write your own product. In a home setting, I do not see how manually analyzing the network logs can help (not to mention that most of the traffic is encrypted). You then have integrity checks on files, IOCs you need to check your files against etc. Basically this means you have to rewrite an EDR from scratch. Fancy security products are not always a way to check a box in an audit it also means using a product that you otherwise would need to either write, or put together from many pieces. Just look at wazuh (open source EDR+) and when you go past the intro you ht some hard walls (especially with updating IOCs from external sources). Security is really hard, but doing it yourself is really, really hardest.
      - tgragnato 5y ago
        I’m pretty sure EDRs play a role in the professional protection of 100k+ IP. At home, OS and software updates combined with network monitoring should be sufficient for the more common threat models. One needs to draw a line somewhere. EDRs are complex and often fail to protect business systems when professionally managed. I do not believe it's worth wasting time on that at home.
mschuster91 5y ago
> Personally I’m of the mind that if anything is questionable I’ll run it through virustotal on-demand and make a judgement from their but also if I’m wondering that deeply enough I’m just as inclined not to touch something potentially volatile. The problem is that you're not accounting for ads, which have been used often enough as distribution networks for zero-day exploits, and other forms of drive-by infection. A virus scanner can't help against the zero-days itself, but the payloads are usually the same generic bullshit that will be picked up.
bosswipe 5y ago
I've learned to stay away from any and all security software and recommend against it to friends and family. Even open source projects have a tendency to sell out to shady characters and spammers without warning. The industry is fully corrupt as far as I can tell.

atoav 5y ago

There is this class of tech outlets for "advanced" computer users (the kind which comes with CDs and USB drives full of "useful" software) which is pure snake oil marketing material. The truth is, that with the right behaviour you probably don't need any AV product. Don't click on weird links, use adblockers, don't open weird documents especially when they come via mail, keep your OS and software up to date, etc. For all the other stuff (zero days) AV software won't help you and in fact AV software will often even increase the attack surface of your system (remote code execution via AV-buffer overflow is not a rare thing to happen). On my Windows machines I am not using AV software since roughly a decade and I have not had a single issue. Telling people that they can click around carefree if only they have an AV software installed is irresponsible IMO. AV software is not a substitute for education.

BrandoElFollito 5y ago
I am genuinely curious: how do you know that you do not have an issue? You may have been infected by a botnet and your machine may be doing things without you knowing. It is possible of course to have some countermeasures (integrity checks, baseline checks) but this is hard work.
- tgragnato 5y ago
  A good starting point is to set up a network tap and analyze the logs, manually. Obviously, it's one of those things that is rarely done by the people who use fancy security products. .. because it’s hard E.g.: Botnet traffic is often “strange” and easy to recognize
  - BrandoElFollito 5y ago
    I am a security professional and use all kinds of fancy security products in a 100+k IP deployment. They do not do any magical stuff but the alternative is to write your own product. In a home setting, I do not see how manually analyzing the network logs can help (not to mention that most of the traffic is encrypted). You then have integrity checks on files, IOCs you need to check your files against etc. Basically this means you have to rewrite an EDR from scratch. Fancy security products are not always a way to check a box in an audit it also means using a product that you otherwise would need to either write, or put together from many pieces. Just look at wazuh (open source EDR+) and when you go past the intro you ht some hard walls (especially with updating IOCs from external sources). Security is really hard, but doing it yourself is really, really hardest.
    - tgragnato 5y ago
      I’m pretty sure EDRs play a role in the professional protection of 100k+ IP. At home, OS and software updates combined with network monitoring should be sufficient for the more common threat models. One needs to draw a line somewhere. EDRs are complex and often fail to protect business systems when professionally managed. I do not believe it's worth wasting time on that at home.

mschuster91 5y ago

> Personally I’m of the mind that if anything is questionable I’ll run it through virustotal on-demand and make a judgement from their but also if I’m wondering that deeply enough I’m just as inclined not to touch something potentially volatile. The problem is that you're not accounting for ads, which have been used often enough as distribution networks for zero-day exploits, and other forms of drive-by infection. A virus scanner can't help against the zero-days itself, but the payloads are usually the same generic bullshit that will be picked up.

bosswipe 5y ago

I've learned to stay away from any and all security software and recommend against it to friends and family. Even open source projects have a tendency to sell out to shady characters and spammers without warning. The industry is fully corrupt as far as I can tell.