9 ms·

Is there any point in using antivirus these days anyway? I'm open to being wrong here, but I'm under the impression that antivirus exists only to tick boxes in

Is there any point in using antivirus these days anyway? I'm open to being wrong here, but I'm under the impression that antivirus exists only to tick boxes in outdated security compliance checklists. How big of a threat are viruses compared to, say, rogue antivirus products themselves?

henryw 5y ago
I'm wondering this too since Windows has built-in antivirus now. https://www.microsoft.com/en-us/windows/comprehensive-security https://www.microsoft.com/en-us/windows/comprehensive-securi...
- teh_klev 5y ago
  Windows has had "Microsoft Security Essentials" built-in for longer than I can remember (10+ years?). It's not a terrible thing and keeps out of your way and doesn't seem to bog your machine down. Unlike the steaming pile of crap that my work computer runs (EndPoint) that consumes 60-80% CPU when doing its weekly full scan for over an hour right in the middle of the working day. MSE is really all I've used since binning AVG which turned into bloatware.
  - stjohnswarts 5y ago
    Took me a while to figure out why my browsers always seem to randomly pause for about 30 seconds. It's that piece of crap McCaffee. I can watch it's process go to 100% when the browser (firefox and vivaldi) freeze. It's garbage and I wish I could turn it off and just use MS AV but the IT staff swear by McAffee so I live with it.
    - teh_klev 5y ago
      > but the IT staff swear by McAffee I feel your pain. We have a load of other crap loaded such as Umbrella that is supposed to protect us from harmful websites. It does stuff like intercept DNS lookups etc. It's such a pile of shite and doesn't work properly when I need VPN into our cloud infrastructure. When it's configured so badly it feels really anti-work. But hey ho, "security reasons".
binarymax 5y ago
It’s a good question for the Windows ecosystem, because it was absolutely necessary for Windows 7 and earlier, but I haven’t used later versions. I’ve been using Linux/Mac exclusively for the past 10 years and never even considered it.
- pjmlp 5y ago
  Then you are lucky not to work in companies where IT security policies apply to everyone regardless of the OS being used.
  - nix23 5y ago
    >IT security policies apply Insecurity policies is correct, what you mean is protecting managers a* aka the antivirus failed on us ;)
- gtirloni 5y ago
  You actively disable Windows Defender?
  - binarymax 5y ago
    No. What in my message made you think that?
hans1729 5y ago
It’s a thing in big orgs, where macros are enabled in excel and employees can be tricked into opening mail attachments. Windows defender should suffice, but like you said, from a compliance/insurance perspective it may me valuable to say “look, we scanned for signatures according to the latest knowledge of [insert vendor]”. Personally I think that it’s ridiculous that these huge orgs fail to address the actual underlying issue, excel macros. But hey, it’s easier to fight the Symptome than to deal with the root cause, especially if the latter would impact established work flows god knows how far down the line.
- beamatronic 5y ago
  The class of risky employees should perhaps be limited to Chromebooks only.
  - hans1729 5y ago
    Unfortunately I don’t think belittling these employees helps much here, especially considering how good a dedicated phisher can become at their craft.
  - d3ad1ysp0rk 5y ago
    CEOs?
  - 29083011397778 5y ago
    This may work some of the time, but expect "I need $windows_program" to foul your chances of this. It may not always be legitimate, but telling heavy-duty transport mechanics they can't have Cummins or Bendix software (for engines and brakes) to help them diagnose, when that's the only output for troubleshooting supported by the OEM, will not end well.
    - jmrm 5y ago
      This makes me thing: When we are going to see those Windows software directly on the web? For me makes a lot of sense being able to sell a software subscription instead of a one time product sell, and for the other hand making available to use in any device in the world with internet connection. This also can be done like Chrome apps (like Docs) or some Electron apps (like Spotify), where you can use content without Internet for some time without any problem. For a mechanic who is looking for the amount of torque needed on a bolt this could be perfectly viable, for example.
lotsofpulp 5y ago
I assume it is a cover your ass thing for executives to point to when malware happens on systems they are responsible for.
- xtracto 5y ago
  More than that. It's still required by cert standard bodies such as PCI and SOC2 . Even if you as an exec know they are security theater you are forced to comply due to these certifications.
brightball 5y ago
While it's fairly easy to bypass them, half of the point seems to be making sure that people still NEED to put in the effort to bypass them.
the8472 5y ago
> rogue antivirus products themselves? It's not just rogue AV software. Buggy, insecure AVs are a big problem too. They're attack surface! Especially when running parsers and interpreters for untrusted inputs in kernel space.
- commandlinefan 5y ago
  Even when they don't expose any security holes, they bog the computer down so much that I'd almost rather have a virus - at least a command-and-control virus might take steps to make me unaware of its presence.
  - vetinari 5y ago
    In the '90s, there was a joke: What's the difference between Windows and viruses? Viruses do something.
- iso1210 5y ago
  > rogue AV software You repeat yourself sir
- mumblemumble 5y ago
  If I were a black hat, I think that the best gift I could hope for would be a 3rd-party program, likely developed on the cheap, whose entire purpose for existing is to sit in kernel space and promiscuously open Every. Single. File. in order to process its contents. (Granted, I'm a complete layperson in computer security, so there's likely something I'm missing.)
b0afc375b5 5y ago
I have not thought about 3rd party antivirus software in a long time. Granted my only use case for windows 10 is gaming, and any binary (or any file really) that I download goes straight to virustotal before I open it.
Damogran6 5y ago
Our bog-standard business ultrabooks have been requested to perform a full disk scan each Friday. Which means their CPUs and Fans are running solid, most all Fridays. I'm CERTAIN there are massive hidden costs in fan replacement and Laptop repairs and nothing useful discovered as a result.
- _joel 5y ago
  I wonder how much unnecessary AV scans across the world contribute to carbon emissions? I bet it's not insignificant, full CPU and disk access!
dblohm7 5y ago
I used to work on the team at Mozilla that got stuck with dealing with all the terrible shit that AV programs do to web browsers. My recommendation for Windows users is to just use Defender. All that other crap does the exact same stuff to other programs that malware does, except they do so in the name of "security."
- account42 5y ago
  > I used to work on the team at Mozilla that got stuck with dealing with all the terrible shit that AV programs do to web browsers. Yet Mozilla contributes to the terrible shit that Google Safe Browsing is doing to independent and open source developers hosting their software.
bastardoperator 5y ago
I don't think you're wrong at all. Considering symantec is mining with your computer on top of all the other terrible things anti-virus companies do to your computer, at this point a virus might be less intrusive.
orev 5y ago
Corporate “anti-virus” is much more than just anti-virus these days. Most of them don’t even call themselves anti-virus, but endpoint protection. Other than anti-virus, they let you set policies on USB ports, block web browsing by categories or specific domains, let you run software inventory reports, etc. These things are very important, especially with work from home, as you can’t really block things at the office firewall anymore.
- lostlogin 5y ago
  They also slow your machine down, report back to the company and throw annoying pop ups at you multiple times per day. Never again.
KronisLV 5y ago
It surprises me how much many posters on Hacker News seem to be against using any sort of AV software - not even the built in Defender solution in Windows, if you have to use the OS for whatever reason, but i often see the sentiment expressed that supposedly the entire class of software is useless. What happened to defense in depth with all of the layers you can introduce? Surely if you run a Linux server, you might want a secure password for it, or better yet, key based authentication. Port knocking? Why not, throw it in there as another layer. Maybe deny authentication on an IP range basis? Why not. What about fail2ban or some other solution like that to disallow brute forcing? Sure. Or maybe require using a VPN to connect to it at all? Even better! Actually, even running your SSH server on a non-standard port will be enough to get rid of some attempts to brute force the password. Sure, key based auth makes many of those moot points so i probably have the order of some of those steps wrong, but surely there's a lot of merit in combining whatever solutions you can to make the end result more secure, right? Hell, if you're running a web service of some sort or an application for yourself, adding basicauth in front of it at a web server level is enough to act as a safety net should the auth functionality of the actual application be broken, until you patch it. So why should Windows be any different? If i'm stuck using that OS, i'd surely want to use whatever software is available to me to make the uphill battle towards something vaguely secure more doable, no?
- larrik 5y ago
  > What happened to defense in depth with all of the layers you can introduce? What happened was antivirus itself became your biggest attack vector, so you were more secure without it. Plus Microsoft actually cares about security now, which wasn't the case 10+ years ago.
- guelo 5y ago
  what happened was the security industry proved over and over again that it cant be trusted. most windows recommendations i see say to use defender since Microsoft already owns you
- x0x0 5y ago
  Part of this surely is that most apps are now delivered in the browser, so increasingly windows is a terminal to run chrome or edge.
fatnoah 5y ago
Current AV software bloatware is a scourge on the world. I spent about 30 minutes this weekend helping my sister-in-law debug a slow internet. My observations were that attempting to do anything resulted in about a 5-10 second pause, and general sluggish response when trying to anything online. I disabled anti-virus, etc. and it was still slow. I tried Edge and everything was super-fast. Digging further, the issue was McAfee Safe Search (powered by Yahoo). It was singlehandedly adding 5-10 second lag on every mouse click and character typed in the browser. Disabling and blocking that resolved everything.
- null_deref 5y ago
  How can a software this bad hit production? I had a good laugh
  - neurostimulant 5y ago
    The developers probably test it using beefy machines and very small latency to their dedicated test servers in the same building. On the other hand, their users probably use old or slow machines connected to busy oversubscribed servers halfway across the world causing significant latency.
  - fatnoah 5y ago
    It was brutal. I first suspected terrible Wi-Fi, or underpowered computer, but everything worked great in Edge and the computer is a 3.2GHz i7 w/12GB RAM. I think my favorite part of it is that the issue itself of blocking everything for network calls is like one of the first things I learned about Windows programming in the early 2000's.
irrational 5y ago
My company forces all of us to use a product called Zscaler. I have no idea if it is effective, but it is constantly running and uses the vast majority of my CPU. The degree to which is slows down my computer and slows down development is astonishing. I have to wonder, across the entire company, if the potential cost of stuff lost that zscaler supposedly protects us from is worth more than the real cost of lost productivity, not to mention whatever they are paying for zscaler itself.
- jacobr1 5y ago
  You should see if you get them to debug the situation. Unlike plenty of bloatware discussed on this posting, zscaler is usually not that resource intensive. It is more of a better corporate VPN, than it is a AV tool.
chemmail 5y ago
There really is not. Windows Security is insanely good at detecting everything nowdays. I still use Malwarebytes Antimalware as that was really good at detecting things back in the Windows Defender days, and i still have a lifetime subscription. But i feel even that is not really necessary, you can run the free one every once if a while to find bad cookies and such.
mmis1000 5y ago
To disable the build-in one. Windows defender acts wild randomly during you do serious work is a huge pain for many people. Can you imagine. You play FPS happily at 120fps and windows defender suddenly kick in and you got 10fps, shoot down by the enemy team. It happens all the time.
bytematic 5y ago
EDR is the future, not impenetrable by any means but it protects enterprise a great deal. And it allows the network admins some control, which makes everyone feel good.

henryw 5y ago

I'm wondering this too since Windows has built-in antivirus now. https://www.microsoft.com/en-us/windows/comprehensive-security https://www.microsoft.com/en-us/windows/comprehensive-securi...

teh_klev 5y ago
Windows has had "Microsoft Security Essentials" built-in for longer than I can remember (10+ years?). It's not a terrible thing and keeps out of your way and doesn't seem to bog your machine down. Unlike the steaming pile of crap that my work computer runs (EndPoint) that consumes 60-80% CPU when doing its weekly full scan for over an hour right in the middle of the working day. MSE is really all I've used since binning AVG which turned into bloatware.
- stjohnswarts 5y ago
  Took me a while to figure out why my browsers always seem to randomly pause for about 30 seconds. It's that piece of crap McCaffee. I can watch it's process go to 100% when the browser (firefox and vivaldi) freeze. It's garbage and I wish I could turn it off and just use MS AV but the IT staff swear by McAffee so I live with it.
  - teh_klev 5y ago
    > but the IT staff swear by McAffee I feel your pain. We have a load of other crap loaded such as Umbrella that is supposed to protect us from harmful websites. It does stuff like intercept DNS lookups etc. It's such a pile of shite and doesn't work properly when I need VPN into our cloud infrastructure. When it's configured so badly it feels really anti-work. But hey ho, "security reasons".

binarymax 5y ago

It’s a good question for the Windows ecosystem, because it was absolutely necessary for Windows 7 and earlier, but I haven’t used later versions. I’ve been using Linux/Mac exclusively for the past 10 years and never even considered it.

pjmlp 5y ago
Then you are lucky not to work in companies where IT security policies apply to everyone regardless of the OS being used.
- nix23 5y ago
  >IT security policies apply Insecurity policies is correct, what you mean is protecting managers a* aka the antivirus failed on us ;)
gtirloni 5y ago
You actively disable Windows Defender?
- binarymax 5y ago
  No. What in my message made you think that?

hans1729 5y ago

It’s a thing in big orgs, where macros are enabled in excel and employees can be tricked into opening mail attachments. Windows defender should suffice, but like you said, from a compliance/insurance perspective it may me valuable to say “look, we scanned for signatures according to the latest knowledge of [insert vendor]”. Personally I think that it’s ridiculous that these huge orgs fail to address the actual underlying issue, excel macros. But hey, it’s easier to fight the Symptome than to deal with the root cause, especially if the latter would impact established work flows god knows how far down the line.

beamatronic 5y ago
The class of risky employees should perhaps be limited to Chromebooks only.
- hans1729 5y ago
  Unfortunately I don’t think belittling these employees helps much here, especially considering how good a dedicated phisher can become at their craft.
- d3ad1ysp0rk 5y ago
  CEOs?
- 29083011397778 5y ago
  This may work some of the time, but expect "I need $windows_program" to foul your chances of this. It may not always be legitimate, but telling heavy-duty transport mechanics they can't have Cummins or Bendix software (for engines and brakes) to help them diagnose, when that's the only output for troubleshooting supported by the OEM, will not end well.
  - jmrm 5y ago
    This makes me thing: When we are going to see those Windows software directly on the web? For me makes a lot of sense being able to sell a software subscription instead of a one time product sell, and for the other hand making available to use in any device in the world with internet connection. This also can be done like Chrome apps (like Docs) or some Electron apps (like Spotify), where you can use content without Internet for some time without any problem. For a mechanic who is looking for the amount of torque needed on a bolt this could be perfectly viable, for example.

lotsofpulp 5y ago

I assume it is a cover your ass thing for executives to point to when malware happens on systems they are responsible for.

xtracto 5y ago
More than that. It's still required by cert standard bodies such as PCI and SOC2 . Even if you as an exec know they are security theater you are forced to comply due to these certifications.

brightball 5y ago

While it's fairly easy to bypass them, half of the point seems to be making sure that people still NEED to put in the effort to bypass them.

the8472 5y ago

> rogue antivirus products themselves? It's not just rogue AV software. Buggy, insecure AVs are a big problem too. They're attack surface! Especially when running parsers and interpreters for untrusted inputs in kernel space.

commandlinefan 5y ago
Even when they don't expose any security holes, they bog the computer down so much that I'd almost rather have a virus - at least a command-and-control virus might take steps to make me unaware of its presence.
- vetinari 5y ago
  In the '90s, there was a joke: What's the difference between Windows and viruses? Viruses do something.
iso1210 5y ago
> rogue AV software You repeat yourself sir
mumblemumble 5y ago
If I were a black hat, I think that the best gift I could hope for would be a 3rd-party program, likely developed on the cheap, whose entire purpose for existing is to sit in kernel space and promiscuously open Every. Single. File. in order to process its contents. (Granted, I'm a complete layperson in computer security, so there's likely something I'm missing.)

b0afc375b5 5y ago

I have not thought about 3rd party antivirus software in a long time. Granted my only use case for windows 10 is gaming, and any binary (or any file really) that I download goes straight to virustotal before I open it.

Damogran6 5y ago

Our bog-standard business ultrabooks have been requested to perform a full disk scan each Friday. Which means their CPUs and Fans are running solid, most all Fridays. I'm CERTAIN there are massive hidden costs in fan replacement and Laptop repairs and nothing useful discovered as a result.

_joel 5y ago
I wonder how much unnecessary AV scans across the world contribute to carbon emissions? I bet it's not insignificant, full CPU and disk access!

dblohm7 5y ago

I used to work on the team at Mozilla that got stuck with dealing with all the terrible shit that AV programs do to web browsers. My recommendation for Windows users is to just use Defender. All that other crap does the exact same stuff to other programs that malware does, except they do so in the name of "security."

account42 5y ago
> I used to work on the team at Mozilla that got stuck with dealing with all the terrible shit that AV programs do to web browsers. Yet Mozilla contributes to the terrible shit that Google Safe Browsing is doing to independent and open source developers hosting their software.

bastardoperator 5y ago

I don't think you're wrong at all. Considering symantec is mining with your computer on top of all the other terrible things anti-virus companies do to your computer, at this point a virus might be less intrusive.

orev 5y ago

Corporate “anti-virus” is much more than just anti-virus these days. Most of them don’t even call themselves anti-virus, but endpoint protection. Other than anti-virus, they let you set policies on USB ports, block web browsing by categories or specific domains, let you run software inventory reports, etc. These things are very important, especially with work from home, as you can’t really block things at the office firewall anymore.

lostlogin 5y ago
They also slow your machine down, report back to the company and throw annoying pop ups at you multiple times per day. Never again.

KronisLV 5y ago

It surprises me how much many posters on Hacker News seem to be against using any sort of AV software - not even the built in Defender solution in Windows, if you have to use the OS for whatever reason, but i often see the sentiment expressed that supposedly the entire class of software is useless. What happened to defense in depth with all of the layers you can introduce? Surely if you run a Linux server, you might want a secure password for it, or better yet, key based authentication. Port knocking? Why not, throw it in there as another layer. Maybe deny authentication on an IP range basis? Why not. What about fail2ban or some other solution like that to disallow brute forcing? Sure. Or maybe require using a VPN to connect to it at all? Even better! Actually, even running your SSH server on a non-standard port will be enough to get rid of some attempts to brute force the password. Sure, key based auth makes many of those moot points so i probably have the order of some of those steps wrong, but surely there's a lot of merit in combining whatever solutions you can to make the end result more secure, right? Hell, if you're running a web service of some sort or an application for yourself, adding basicauth in front of it at a web server level is enough to act as a safety net should the auth functionality of the actual application be broken, until you patch it. So why should Windows be any different? If i'm stuck using that OS, i'd surely want to use whatever software is available to me to make the uphill battle towards something vaguely secure more doable, no?

larrik 5y ago
> What happened to defense in depth with all of the layers you can introduce? What happened was antivirus itself became your biggest attack vector, so you were more secure without it. Plus Microsoft actually cares about security now, which wasn't the case 10+ years ago.
guelo 5y ago
what happened was the security industry proved over and over again that it cant be trusted. most windows recommendations i see say to use defender since Microsoft already owns you
x0x0 5y ago
Part of this surely is that most apps are now delivered in the browser, so increasingly windows is a terminal to run chrome or edge.

fatnoah 5y ago

Current AV software bloatware is a scourge on the world. I spent about 30 minutes this weekend helping my sister-in-law debug a slow internet. My observations were that attempting to do anything resulted in about a 5-10 second pause, and general sluggish response when trying to anything online. I disabled anti-virus, etc. and it was still slow. I tried Edge and everything was super-fast. Digging further, the issue was McAfee Safe Search (powered by Yahoo). It was singlehandedly adding 5-10 second lag on every mouse click and character typed in the browser. Disabling and blocking that resolved everything.

null_deref 5y ago
How can a software this bad hit production? I had a good laugh
- neurostimulant 5y ago
  The developers probably test it using beefy machines and very small latency to their dedicated test servers in the same building. On the other hand, their users probably use old or slow machines connected to busy oversubscribed servers halfway across the world causing significant latency.
- fatnoah 5y ago
  It was brutal. I first suspected terrible Wi-Fi, or underpowered computer, but everything worked great in Edge and the computer is a 3.2GHz i7 w/12GB RAM. I think my favorite part of it is that the issue itself of blocking everything for network calls is like one of the first things I learned about Windows programming in the early 2000's.

irrational 5y ago

My company forces all of us to use a product called Zscaler. I have no idea if it is effective, but it is constantly running and uses the vast majority of my CPU. The degree to which is slows down my computer and slows down development is astonishing. I have to wonder, across the entire company, if the potential cost of stuff lost that zscaler supposedly protects us from is worth more than the real cost of lost productivity, not to mention whatever they are paying for zscaler itself.

jacobr1 5y ago
You should see if you get them to debug the situation. Unlike plenty of bloatware discussed on this posting, zscaler is usually not that resource intensive. It is more of a better corporate VPN, than it is a AV tool.

chemmail 5y ago

There really is not. Windows Security is insanely good at detecting everything nowdays. I still use Malwarebytes Antimalware as that was really good at detecting things back in the Windows Defender days, and i still have a lifetime subscription. But i feel even that is not really necessary, you can run the free one every once if a while to find bad cookies and such.

mmis1000 5y ago

To disable the build-in one. Windows defender acts wild randomly during you do serious work is a huge pain for many people. Can you imagine. You play FPS happily at 120fps and windows defender suddenly kick in and you got 10fps, shoot down by the enemy team. It happens all the time.

bytematic 5y ago

EDR is the future, not impenetrable by any means but it protects enterprise a great deal. And it allows the network admins some control, which makes everyone feel good.