5 ms·

> I pointed out to the customer liaison that what the customer is trying to do is very suspicious and looks like a virus. The customer liaison explained that it

> I pointed out to the customer liaison that what the customer is trying to do is very suspicious and looks like a virus. The customer liaison explained that it’s quite the opposite: The customer is a major anti-virus software vendor! The customer has important functionality in their product that that they have built based on this technique of remote code injection, and they cannot afford to give it up at this point. As an aside, whenever I set up a Windows PC for me or a family member, the first thing I do is uninstall any third-party antivirus that may have come with the computer. I have found that anti-virus software likely makes my computer more insecure by having a big attack surface, not to mention slowing it down.

kmeisthax 5y ago
Actual Chromium developers have similar opinions w.r.t. antivirus vendors. It's almost like the extensibility necessary to make third-party security products work requires creating entirely new attack surface for those products to work.
AshamedCaptain 5y ago
It's not as if the first party antivirus inspires any confidence, either. It still loses in performance to some 3rd party ones, and has had its own list of security issues. For those who remember, its early versions (before the MS acquisition) required the Visual Basic runtime.
- ssklash 5y ago
  The current Windows Defender is not the crappy old MS AV it used to be. It's gotten drastically better, and for normal home users I always recommend it over installing any 3rd party AV. I'm a pentester and red teamer, and yes, bypassing Defender isn't all that hard, but neither are most 3rd party AVs, and Defender does not bring in all the instability and additional attack surface. Also I think it can take advantage of newer kernel APIs that non-MS AV can't.
  - floatboth 5y ago
    Defender still introduces performance issues, sometimes it's better to disable Defender too and have no scanning crap whatsoever.
Arnavion 5y ago
You shouldn't trust that uninstalling the AV reliably gets rid of whatever kernel drivers and other detritus it came with. I don't know of any AV examples but plenty of video game anti-cheat software has that problem. Just wipe and reinstall Windows.

kmeisthax 5y ago

Actual Chromium developers have similar opinions w.r.t. antivirus vendors. It's almost like the extensibility necessary to make third-party security products work requires creating entirely new attack surface for those products to work.

AshamedCaptain 5y ago

It's not as if the first party antivirus inspires any confidence, either. It still loses in performance to some 3rd party ones, and has had its own list of security issues. For those who remember, its early versions (before the MS acquisition) required the Visual Basic runtime.

ssklash 5y ago
The current Windows Defender is not the crappy old MS AV it used to be. It's gotten drastically better, and for normal home users I always recommend it over installing any 3rd party AV. I'm a pentester and red teamer, and yes, bypassing Defender isn't all that hard, but neither are most 3rd party AVs, and Defender does not bring in all the instability and additional attack surface. Also I think it can take advantage of newer kernel APIs that non-MS AV can't.
- floatboth 5y ago
  Defender still introduces performance issues, sometimes it's better to disable Defender too and have no scanning crap whatsoever.

Arnavion 5y ago

You shouldn't trust that uninstalling the AV reliably gets rid of whatever kernel drivers and other detritus it came with. I don't know of any AV examples but plenty of video game anti-cheat software has that problem. Just wipe and reinstall Windows.