8 ms·

> Currently the service uses both McAfee and Tanium software packages to scan and protect service-issued endpoints like laptops. The problem isn't hardware, it

> Currently the service uses both McAfee and Tanium software packages to scan and protect service-issued endpoints like laptops. The problem isn't hardware, it's that they're using the worst antivirus known to mankind. It's not throwing money at the problem, it's about what can be removed.

iforgotpassword 5y ago
They should switch to Norton to make some crypto money on the side.
- 3np 5y ago
  Wat?
  - nucleardog 5y ago
    Few articles floating around from about a month ago, this is one: https://news.ycombinator.com/item?id=29795910 https://news.ycombinator.com/item?id=29795910
    - 3np 5y ago
      Oh wow. And here I thought they were one of the relatively clean ones among the crowd of McAfee and Avast!. Agreed with the top comment there that the whole industry is reeking. Seems like the only reasonable one is Windows Defender, with the only Linux alternative being ClamAV (non-shady but questionable if it's effective at all for a workstation)
      - unionpivo 5y ago
        It's there mostly for the checkboxes on copliance, but it's not that bad, compared to others.
- tanjtanjtanj 5y ago
  The Norton product that provides the services here is made and sold by a different company than the one shipping crypto-mining software.
eloisius 5y ago
At my last job IT had tanium installed on our machines. It would make your computer nearly unusable for hours. Sometimes I felt like we had computers that were completely consumed by the overhead it took just for us to have them.
- tablespoon 5y ago
  > At my last job IT had tanium installed on our machines. It would make your computer nearly unusable for hours. Sometimes I felt like we had computers that were completely consumed by the overhead it took just for us to have them. Trend Micro is the same way. The only thing that eventually made it bearable was getting an SSD, but it still sucks.
- Damogran6 5y ago
  Then Tanium needed tuning. There's no reason any of it's processing should have taken 1 core for more than 2 minutes...and that's the highest load task. Mostly it sits in the background, capped at 5% cpu. But there's only so much you can do with a 7th gen dual core mobile i7 Now...McAfee? a)Was a pig, but b)did we really need to scan the entire disk every Friday afternoon?
  - imwillofficial 5y ago
    No tuning of Tanium will make it not garbage.
    - Damogran6 5y ago
      I shouldn't take that personally, but I manage Tanium and my experience doesn't mirror yours. That said, I know they have some HUGE deployments in the Military and my piddly little 25000 client install may not be comparable.
      - imwillofficial 5y ago
        I used to help Tanium manage their stuff for the US Navy on NMCI. I stand by my statement. But it’s not personal at all. Neither you nor I made Tanium, and I’m sure your deployment is the gold standard of Tanium deployments that would change my mind.
omni 5y ago
The problem is definitely hardware. If you actually read the linked sources, it sounds like the Air Force bought a ton of spinning rust HDD machines in 2018 for the lowest possible price they could. They probably only have 4GB of RAM too, then, given what low end specs were like at the time. Good luck getting anything done today with those specs.
- AnIdiotOnTheNet 5y ago
  Ha, you're blaming hardware yet the likely reason that those systems are slow isn't because the hardware can't do things quickly, but because the modern software they run on it is bloated and slow.
  - Cromation 5y ago
    You both are correct. Its a combination of shit hardware, shit software, and poor timing on daily scans that should be run after hours instead of on login. I use AF computers on a daily basis and can attest to bringin in my own laptop and using alternatives to login on my personal.
- praash 5y ago
  That's not actually such "low end spec" that would cause logins and mails to take an hour to process. To me, the whole ordeal screams: software bloat, software misconfiguration, background service overload. You could snappily send mail 15 years ago, and the computational task itself hasn't grown much, besides bloated browser login windows. Try booting a 2 GB RAM machine to some RAM-preloading Linux thumbdrive and you'll see why the problem is not "spinning rust HDDs" and "only 4 GB RAM"
  - sjcoles 5y ago
    Have you tried using Windows 10/11 with on-access and behavioral AV (not defender) on 4gb of RAM and a 5400rpm spinning disk? I find it entirely plausible that they have to wait an hour plus for the machine to become remotely responsive.
ngc248 5y ago
Oh man ... the cruft that corporate IT installs slows down the computers so much. Its better if companies start handing out linux machines if they cant afford macs. I would trade my windows laptop with IT cruft any day for a linux machine.
- hn_version_0023 5y ago
  IT will cruft it up no matter the OS. I’ve had to run TrendMicro on AWS linux instances because of the gov’ts settlement with Sony re: “North Korean hacking”. It destroyed performance. Also it was poorly configured by the checkmark-brigade in their “security & compliance” department. All I’m saying is careful what you wish for. Edit: spelling
- unionpivo 5y ago
  You have too much faith in corporate IT. They can fuck up macs and Linux just as well.
  - abawany 5y ago
    Can confirm: got Symantec End-Point Protection rolled out on macs here and it has turned them in slow crashy pieces of ... garbage; I've had to restore my machine from backup a couple of times already when a macos update with this thing running would result in an unbootable machine. It would have been more cost-efficient and secure to smash our machines with sledgehammers than force us to run this ... junk.
devwastaken 5y ago
Windows admins are some of the worst, especially in government. They don't understand how computers work, and so they pipe on anti-virus, anti this and that, hoping a product will magically solve the issue. But they won't move the default browser, or install an ad blocker. They won't put in policies preventing running the software in the first place or isolating its abilities. After years of having terrible, exploitable software on windows, it's the natural result. Some manager gets a pdf exploit, and on windows there's simply nothing you can do about it. But IT has to do something, so to make them look good they throw another anti-virus on.
- k12sosse 5y ago
  Looks like you need to meet some better Windows admins. Being a moron is operating system agnostic.
MrFoof 5y ago
I'm currently on an engagement at a retail bank for a project that went entirely off the rails (they brought me in to right it). All of the following are currently running simultaneously: * McAfee * Tanium, which is constantly firing off massive Python scripts * Aternity * Windows Defender (which is well-behaved as expected) ... wait for it ... on an SSD that has no DRAM. Yes, a cacheless SSD. Performance isn't much better than a cheap USB flash drive, which is expected when an identical SSD costs $18 on NewEgg. The system is effectively I/O bound all the time. The quad-core (8th gen Intel core) idles at 70% utilization, constantly spiking to 100%. The commit charge for getting into the Explorer shell is 13.8GB of the 8GB of physical memory. The laptop itself appears to have a street value of about $240 on eBay. Quality unit with a 1366x768 TN display. ----- The 30 day discovery period is about to end. I am not supplying an SoW for any further work. I told them the reason nothing gets done by their teams is because the hardware they give everyone is trash, and I can't solve their architectural issues when IT doesn't supply tools to get work done. I wish them the best of luck.
- NikolaeVarius 5y ago
  Seems about right. I've done engagements will multiple financial clients and they seem to make it their job to make every engineer as unproductive as possible.
  - geenew 5y ago
    Makes me think of the oft-repeated joke on MobileTechReview about bottom-of-the-line thinkpads with low-quality screens: "The laptop the IT department gets you when they hate you"
nitwit005 5y ago
I've decided that anti-virus and other security software slowing down the computer is a feature. If the software was super-efficient, people would think it wasn't doing anything. The slowness provides the appearance of work being done.

iforgotpassword 5y ago

They should switch to Norton to make some crypto money on the side.

3np 5y ago
Wat?
- nucleardog 5y ago
  Few articles floating around from about a month ago, this is one: https://news.ycombinator.com/item?id=29795910 https://news.ycombinator.com/item?id=29795910
  - 3np 5y ago
    Oh wow. And here I thought they were one of the relatively clean ones among the crowd of McAfee and Avast!. Agreed with the top comment there that the whole industry is reeking. Seems like the only reasonable one is Windows Defender, with the only Linux alternative being ClamAV (non-shady but questionable if it's effective at all for a workstation)
    - unionpivo 5y ago
      It's there mostly for the checkboxes on copliance, but it's not that bad, compared to others.
tanjtanjtanj 5y ago
The Norton product that provides the services here is made and sold by a different company than the one shipping crypto-mining software.

eloisius 5y ago

At my last job IT had tanium installed on our machines. It would make your computer nearly unusable for hours. Sometimes I felt like we had computers that were completely consumed by the overhead it took just for us to have them.

tablespoon 5y ago
> At my last job IT had tanium installed on our machines. It would make your computer nearly unusable for hours. Sometimes I felt like we had computers that were completely consumed by the overhead it took just for us to have them. Trend Micro is the same way. The only thing that eventually made it bearable was getting an SSD, but it still sucks.
Damogran6 5y ago
Then Tanium needed tuning. There's no reason any of it's processing should have taken 1 core for more than 2 minutes...and that's the highest load task. Mostly it sits in the background, capped at 5% cpu. But there's only so much you can do with a 7th gen dual core mobile i7 Now...McAfee? a)Was a pig, but b)did we really need to scan the entire disk every Friday afternoon?
- imwillofficial 5y ago
  No tuning of Tanium will make it not garbage.
  - Damogran6 5y ago
    I shouldn't take that personally, but I manage Tanium and my experience doesn't mirror yours. That said, I know they have some HUGE deployments in the Military and my piddly little 25000 client install may not be comparable.
    - imwillofficial 5y ago
      I used to help Tanium manage their stuff for the US Navy on NMCI. I stand by my statement. But it’s not personal at all. Neither you nor I made Tanium, and I’m sure your deployment is the gold standard of Tanium deployments that would change my mind.

omni 5y ago

The problem is definitely hardware. If you actually read the linked sources, it sounds like the Air Force bought a ton of spinning rust HDD machines in 2018 for the lowest possible price they could. They probably only have 4GB of RAM too, then, given what low end specs were like at the time. Good luck getting anything done today with those specs.

AnIdiotOnTheNet 5y ago
Ha, you're blaming hardware yet the likely reason that those systems are slow isn't because the hardware can't do things quickly, but because the modern software they run on it is bloated and slow.
- Cromation 5y ago
  You both are correct. Its a combination of shit hardware, shit software, and poor timing on daily scans that should be run after hours instead of on login. I use AF computers on a daily basis and can attest to bringin in my own laptop and using alternatives to login on my personal.
praash 5y ago
That's not actually such "low end spec" that would cause logins and mails to take an hour to process. To me, the whole ordeal screams: software bloat, software misconfiguration, background service overload. You could snappily send mail 15 years ago, and the computational task itself hasn't grown much, besides bloated browser login windows. Try booting a 2 GB RAM machine to some RAM-preloading Linux thumbdrive and you'll see why the problem is not "spinning rust HDDs" and "only 4 GB RAM"
- sjcoles 5y ago
  Have you tried using Windows 10/11 with on-access and behavioral AV (not defender) on 4gb of RAM and a 5400rpm spinning disk? I find it entirely plausible that they have to wait an hour plus for the machine to become remotely responsive.

ngc248 5y ago

Oh man ... the cruft that corporate IT installs slows down the computers so much. Its better if companies start handing out linux machines if they cant afford macs. I would trade my windows laptop with IT cruft any day for a linux machine.

hn_version_0023 5y ago
IT will cruft it up no matter the OS. I’ve had to run TrendMicro on AWS linux instances because of the gov’ts settlement with Sony re: “North Korean hacking”. It destroyed performance. Also it was poorly configured by the checkmark-brigade in their “security & compliance” department. All I’m saying is careful what you wish for. Edit: spelling
unionpivo 5y ago
You have too much faith in corporate IT. They can fuck up macs and Linux just as well.
- abawany 5y ago
  Can confirm: got Symantec End-Point Protection rolled out on macs here and it has turned them in slow crashy pieces of ... garbage; I've had to restore my machine from backup a couple of times already when a macos update with this thing running would result in an unbootable machine. It would have been more cost-efficient and secure to smash our machines with sledgehammers than force us to run this ... junk.

devwastaken 5y ago

Windows admins are some of the worst, especially in government. They don't understand how computers work, and so they pipe on anti-virus, anti this and that, hoping a product will magically solve the issue. But they won't move the default browser, or install an ad blocker. They won't put in policies preventing running the software in the first place or isolating its abilities. After years of having terrible, exploitable software on windows, it's the natural result. Some manager gets a pdf exploit, and on windows there's simply nothing you can do about it. But IT has to do something, so to make them look good they throw another anti-virus on.

k12sosse 5y ago
Looks like you need to meet some better Windows admins. Being a moron is operating system agnostic.

MrFoof 5y ago

I'm currently on an engagement at a retail bank for a project that went entirely off the rails (they brought me in to right it). All of the following are currently running simultaneously: * McAfee * Tanium, which is constantly firing off massive Python scripts * Aternity * Windows Defender (which is well-behaved as expected) ... wait for it ... on an SSD that has no DRAM. Yes, a cacheless SSD. Performance isn't much better than a cheap USB flash drive, which is expected when an identical SSD costs $18 on NewEgg. The system is effectively I/O bound all the time. The quad-core (8th gen Intel core) idles at 70% utilization, constantly spiking to 100%. The commit charge for getting into the Explorer shell is 13.8GB of the 8GB of physical memory. The laptop itself appears to have a street value of about $240 on eBay. Quality unit with a 1366x768 TN display. ----- The 30 day discovery period is about to end. I am not supplying an SoW for any further work. I told them the reason nothing gets done by their teams is because the hardware they give everyone is trash, and I can't solve their architectural issues when IT doesn't supply tools to get work done. I wish them the best of luck.

NikolaeVarius 5y ago
Seems about right. I've done engagements will multiple financial clients and they seem to make it their job to make every engineer as unproductive as possible.
- geenew 5y ago
  Makes me think of the oft-repeated joke on MobileTechReview about bottom-of-the-line thinkpads with low-quality screens: "The laptop the IT department gets you when they hate you"

nitwit005 5y ago

I've decided that anti-virus and other security software slowing down the computer is a feature. If the software was super-efficient, people would think it wasn't doing anything. The slowness provides the appearance of work being done.