4 ms·

I spent Sunday researching alternatives, then uninstalling KIS and trying to install BitDefender. From this I conclude that the current state of AV/Security ap

I spent Sunday researching alternatives, then uninstalling KIS and trying to install BitDefender. From this I conclude that the current state of AV/Security apps is dismal. Researching alternatives is difficult, it falls directly into the cesspool that is web product recommendation in 2022. Trying to weed out the garbage articles, I find a handful of apps that are consistently rated that the top. I discarded the recommendation of McAfee. I'm forced to use that awful thing at work, and I won't deal with the performance penalty it exacts. I wound up deciding that BitDefender was the best choice. But setting up the new software has been an awful out-of-box experience. Configuring the tool was a serious chore. The tools (like for the firewall) were clunky and difficult to use, and once I finished on one machine there's no way to export the settings to apply to other devices. Going to their website to make suggestions, I found another post indicating that their tool is unable to restore from quarantine, files that belong in protected parts of the filesystem. The support analyst had replied "thanks for the interesting suggestion" - for something that seems like a Severity 1 bug! I'm not trying to advocate for Kaspersky - I can see that with security being its raison d'etre, they're a bridge too far. But come on, the rest of the industry really needs to get their act together. The KIS product is really head and shoulders above other products I've seen, and we should be competing on the merits, not just "the Russians are a*holes".

legalcorrection 5y ago
I'm curious, can you tell me why Windows Defender is inadequate? I also gather that Microsoft sells an enhanced version for businesses with needs beyond local machine antivirus.
- CWuestefeld 5y ago
  I guess that's a fair question, as it does seem to suffice for most people. I have a few reasons: * Extensive use of Chinese sites, which are quite a mess. I think the risks of visiting that part of the Internet are much greater than someone engaged in more typical usage. * Features like firewall are useful for things other than protecting against direct hacks, and I use it to ensure privacy and occasionally even to simulate failures when testing my code. I think that Defender has such a thing, but less sophisticated? * Probably just being more paranoid than most, having lived through an era when less protection was available, and having to un-hack family members. ETA: also, it's good to have a different sort of protection when the majority is all homogeneous. Windows Defender is the obvious high-value target for hackers. Same kind of weakness and monoculture.
  - jaywalk 5y ago
    The Windows Defender firewall is pretty sophisticated. I can't imagine what functionality you'd need from a local firewall that it doesn't offer.
    - jabroni_salad 5y ago
      I'm in the space and it's actually pretty rare to see a real 3rd party host-based firewall. Most AV products that have firewall really just offer a different control surface for the built-in windows firewall or iptables.
- Maursault 5y ago
  I can't speak to its inadequacy, but I can point out that it is obviously unethical for Microsoft to sell a broken operating system and then separately profit from a product that mitigates part of what is broken in Windows. Microsoft now has no incentive to fix Windows, and, in fact, benefits from not fixing it. Seems to me that is a job for Linux, anyway, and this one time Linux fell down on the job and failed utterly, iow, not even Linux can make Windows secure. Does anyone else see the irony of the FCC banning Kaspersky? It is as silly and ineffective as banning viruses and malware. If they had any concern for security as opposed to security theater, they'd ban Windows.
  - legalcorrection 5y ago
    That's not really a fair critique. Maybe if this was the year 2000. But modern 'antivirus' isn't about fixing a poorly designed OS. It looks for known malware signatures, detects suspicious activity in other software, and so forth. You need that kind of thing on any platform, especially ones that run a web browser and/or let users install the software of their choice. All of that functionality is available in the free version. The paid version is for managing the security of entire large networks of devices from things like ransomware and advanced persistent threats.
    - Maursault 5y ago
      > That's not really a fair critique.... You need that kind of thing on any platform This is the boilerplate response to the valid complaint that Windows security is a nightmare. While in theory, other platforms (Linux, BSDs, and idk, OS/400, OS/2, etc.) technically can get infected by viruses, in practice, infection on these platforms would be a vanishingly rare oddity, even compared to the also incredibly rare cases of intrusion. That said, every major non-Windows platform in its default install configuration is inherently more secure than a Windows system that has had all of its known default security issues addressed, even those beyond what Windows Defender provides. Windows is not simply a more attractive target for malware authors because it is a more popular platform with a larger install base, it is a more popular target because it is inherently insecure, and we know it is inherently insecure because it would be foolish for anyone to run Windows and access the WWW without first addressing its security issues. It is possible, and likely even probable, that someone could use an unhardened, non-Windows system in its default install configuration for ordinary personal computing for years without ever experiencing the security threats that online Windows users face on a minute by minute basis. But to be fair to Windows, it honestly often is a turnkey solution to whatever office computing needs there be, and without it, information security, as an area of study, as a profession, and as an industry, would not even exist as we know it today. The fact of the matter is that Windows' security issues (and other issues Windows exhibits unrelated to security) creates jobs, and this can not be ignored. Arguably, the jobs Windows creates are more important than the security issues it introduces. Also, to be fair, without C, C++, .NET, Python, Perl, and JavaScript, Windows would probably be 90% more secure, so it is not all Microsoft's fault and, in a sense, some of the problem is beyond their control.
Jamie9912 5y ago
Did you take a look at ESET?
- omgmajk 5y ago
  I run ESET for the only reason that it was offered to me cheaply and has worked fine over the years without feeling intrusive.
- CWuestefeld 5y ago
  That was actually going to be my first choice. From what I read it seems better polished than others. But then I read some recent lab tests in which ESET missed blocking a ransomware attack. And that's the threat model that worries me the most.
  - timbit42 5y ago
    Any anti-virus can miss a malware at any time because they rely on updates which take at least a day if not more to be prepared and tested before being distributed in the updates. Don't worry about ESET missing one ransomware attack in a lab test. Do backups daily.
Arubis 5y ago
I fully agree that the antivirus market is a cesspool, and long has been so. The upside is that Microsoft’s first-party solution is decent and ships with the OS, so you can sidestep the entire project of figuring out which third-party AVs somehow manage to do more good than harm. I haven’t looked into AV for macOS in ages; when last I did (~5y?), Sophos (if corporate/paid) and ClamAV (fine for home use) seemed reasonably non-interfering.
deleted 5y ago
[deleted]
dangus 5y ago
I think your last sentence is what Putin counts on, that the West won’t risk “hurting the business environment” to respond to his military campaign. I think one of the flaws of Western culture is how much business efficiency is put on a pedestal above all other priorities. Because of that type of mindset, the West can’t even manufacture simple cloth or paper masks during a healthcare crisis (as an example).
- CWuestefeld 5y ago
  Devils advocate: that efficiency is one important reason why we're rich enough to be able to afford so much else. Like, CO2 emissions are best controlled by societies who are able to shoulder the greater expense of avoiding coal and such. If we can't count on these efficiencies, we're going to lose a huge amount of positives. This sounds to me kind of like the fallacy of "if it saves even one life, it's worth it". That's of course ridiculous, because saving that life costs so much that we'll be unable to save countless other lives. In reality, the balancing of costs and benefits is much more subtle and complex.
  - dangus 5y ago
    To be clear I’m not saying to move to the extreme end of the spectrum. My point is that the West often seems to consider low costs and efficiency above long-term implications. I’m not saying the West should pull an Argentina [1], but the West also shouldn’t always be metaphorically choosing the lowest bidder. [1] https://www.npr.org/sections/money/2017/02/17/515850029/episode-755-the-phone-at-the-end-of-the-world https://www.npr.org/sections/money/2017/02/17/515850029/epis...
p1peridine 5y ago
It's possible to use Kaspersky Free but block the apps internet connection* Network Settings > uncheck Traffic processing Network Settings > Do not scan encrypted connections Once in a while, allow internet connection, do a quick database update then immediately block the internet connection again. * Firewall (router or software).
- mmastrac 5y ago
  With something that has hooks that deep in your OS, blocking internet access via the application itself is not going to be effective in any way if it's hostile software (or turns into hostile software via government decree).

legalcorrection 5y ago

I'm curious, can you tell me why Windows Defender is inadequate? I also gather that Microsoft sells an enhanced version for businesses with needs beyond local machine antivirus.

CWuestefeld 5y ago
I guess that's a fair question, as it does seem to suffice for most people. I have a few reasons: * Extensive use of Chinese sites, which are quite a mess. I think the risks of visiting that part of the Internet are much greater than someone engaged in more typical usage. * Features like firewall are useful for things other than protecting against direct hacks, and I use it to ensure privacy and occasionally even to simulate failures when testing my code. I think that Defender has such a thing, but less sophisticated? * Probably just being more paranoid than most, having lived through an era when less protection was available, and having to un-hack family members. ETA: also, it's good to have a different sort of protection when the majority is all homogeneous. Windows Defender is the obvious high-value target for hackers. Same kind of weakness and monoculture.
- jaywalk 5y ago
  The Windows Defender firewall is pretty sophisticated. I can't imagine what functionality you'd need from a local firewall that it doesn't offer.
  - jabroni_salad 5y ago
    I'm in the space and it's actually pretty rare to see a real 3rd party host-based firewall. Most AV products that have firewall really just offer a different control surface for the built-in windows firewall or iptables.
Maursault 5y ago
I can't speak to its inadequacy, but I can point out that it is obviously unethical for Microsoft to sell a broken operating system and then separately profit from a product that mitigates part of what is broken in Windows. Microsoft now has no incentive to fix Windows, and, in fact, benefits from not fixing it. Seems to me that is a job for Linux, anyway, and this one time Linux fell down on the job and failed utterly, iow, not even Linux can make Windows secure. Does anyone else see the irony of the FCC banning Kaspersky? It is as silly and ineffective as banning viruses and malware. If they had any concern for security as opposed to security theater, they'd ban Windows.
- legalcorrection 5y ago
  That's not really a fair critique. Maybe if this was the year 2000. But modern 'antivirus' isn't about fixing a poorly designed OS. It looks for known malware signatures, detects suspicious activity in other software, and so forth. You need that kind of thing on any platform, especially ones that run a web browser and/or let users install the software of their choice. All of that functionality is available in the free version. The paid version is for managing the security of entire large networks of devices from things like ransomware and advanced persistent threats.
  - Maursault 5y ago
    > That's not really a fair critique.... You need that kind of thing on any platform This is the boilerplate response to the valid complaint that Windows security is a nightmare. While in theory, other platforms (Linux, BSDs, and idk, OS/400, OS/2, etc.) technically can get infected by viruses, in practice, infection on these platforms would be a vanishingly rare oddity, even compared to the also incredibly rare cases of intrusion. That said, every major non-Windows platform in its default install configuration is inherently more secure than a Windows system that has had all of its known default security issues addressed, even those beyond what Windows Defender provides. Windows is not simply a more attractive target for malware authors because it is a more popular platform with a larger install base, it is a more popular target because it is inherently insecure, and we know it is inherently insecure because it would be foolish for anyone to run Windows and access the WWW without first addressing its security issues. It is possible, and likely even probable, that someone could use an unhardened, non-Windows system in its default install configuration for ordinary personal computing for years without ever experiencing the security threats that online Windows users face on a minute by minute basis. But to be fair to Windows, it honestly often is a turnkey solution to whatever office computing needs there be, and without it, information security, as an area of study, as a profession, and as an industry, would not even exist as we know it today. The fact of the matter is that Windows' security issues (and other issues Windows exhibits unrelated to security) creates jobs, and this can not be ignored. Arguably, the jobs Windows creates are more important than the security issues it introduces. Also, to be fair, without C, C++, .NET, Python, Perl, and JavaScript, Windows would probably be 90% more secure, so it is not all Microsoft's fault and, in a sense, some of the problem is beyond their control.

Jamie9912 5y ago

Did you take a look at ESET?

omgmajk 5y ago
I run ESET for the only reason that it was offered to me cheaply and has worked fine over the years without feeling intrusive.
CWuestefeld 5y ago
That was actually going to be my first choice. From what I read it seems better polished than others. But then I read some recent lab tests in which ESET missed blocking a ransomware attack. And that's the threat model that worries me the most.
- timbit42 5y ago
  Any anti-virus can miss a malware at any time because they rely on updates which take at least a day if not more to be prepared and tested before being distributed in the updates. Don't worry about ESET missing one ransomware attack in a lab test. Do backups daily.

Arubis 5y ago

I fully agree that the antivirus market is a cesspool, and long has been so. The upside is that Microsoft’s first-party solution is decent and ships with the OS, so you can sidestep the entire project of figuring out which third-party AVs somehow manage to do more good than harm. I haven’t looked into AV for macOS in ages; when last I did (~5y?), Sophos (if corporate/paid) and ClamAV (fine for home use) seemed reasonably non-interfering.

deleted 5y ago

[deleted]

dangus 5y ago

I think your last sentence is what Putin counts on, that the West won’t risk “hurting the business environment” to respond to his military campaign. I think one of the flaws of Western culture is how much business efficiency is put on a pedestal above all other priorities. Because of that type of mindset, the West can’t even manufacture simple cloth or paper masks during a healthcare crisis (as an example).

CWuestefeld 5y ago
Devils advocate: that efficiency is one important reason why we're rich enough to be able to afford so much else. Like, CO2 emissions are best controlled by societies who are able to shoulder the greater expense of avoiding coal and such. If we can't count on these efficiencies, we're going to lose a huge amount of positives. This sounds to me kind of like the fallacy of "if it saves even one life, it's worth it". That's of course ridiculous, because saving that life costs so much that we'll be unable to save countless other lives. In reality, the balancing of costs and benefits is much more subtle and complex.
- dangus 5y ago
  To be clear I’m not saying to move to the extreme end of the spectrum. My point is that the West often seems to consider low costs and efficiency above long-term implications. I’m not saying the West should pull an Argentina [1], but the West also shouldn’t always be metaphorically choosing the lowest bidder. [1] https://www.npr.org/sections/money/2017/02/17/515850029/episode-755-the-phone-at-the-end-of-the-world https://www.npr.org/sections/money/2017/02/17/515850029/epis...

p1peridine 5y ago

It's possible to use Kaspersky Free but block the apps internet connection* Network Settings > uncheck Traffic processing Network Settings > Do not scan encrypted connections Once in a while, allow internet connection, do a quick database update then immediately block the internet connection again. * Firewall (router or software).

mmastrac 5y ago
With something that has hooks that deep in your OS, blocking internet access via the application itself is not going to be effective in any way if it's hostile software (or turns into hostile software via government decree).