3 ms·

It surprises me how much many posters on Hacker News seem to be against using any sort of AV software - not even the built in Defender solution in Windows, if y

It surprises me how much many posters on Hacker News seem to be against using any sort of AV software - not even the built in Defender solution in Windows, if you have to use the OS for whatever reason, but i often see the sentiment expressed that supposedly the entire class of software is useless. What happened to defense in depth with all of the layers you can introduce? Surely if you run a Linux server, you might want a secure password for it, or better yet, key based authentication. Port knocking? Why not, throw it in there as another layer. Maybe deny authentication on an IP range basis? Why not. What about fail2ban or some other solution like that to disallow brute forcing? Sure. Or maybe require using a VPN to connect to it at all? Even better! Actually, even running your SSH server on a non-standard port will be enough to get rid of some attempts to brute force the password. Sure, key based auth makes many of those moot points so i probably have the order of some of those steps wrong, but surely there's a lot of merit in combining whatever solutions you can to make the end result more secure, right? Hell, if you're running a web service of some sort or an application for yourself, adding basicauth in front of it at a web server level is enough to act as a safety net should the auth functionality of the actual application be broken, until you patch it. So why should Windows be any different? If i'm stuck using that OS, i'd surely want to use whatever software is available to me to make the uphill battle towards something vaguely secure more doable, no?

larrik 5y ago
> What happened to defense in depth with all of the layers you can introduce? What happened was antivirus itself became your biggest attack vector, so you were more secure without it. Plus Microsoft actually cares about security now, which wasn't the case 10+ years ago.
guelo 5y ago
what happened was the security industry proved over and over again that it cant be trusted. most windows recommendations i see say to use defender since Microsoft already owns you
x0x0 5y ago
Part of this surely is that most apps are now delivered in the browser, so increasingly windows is a terminal to run chrome or edge.
Melatonic 5y ago
For Windows one of the best things you can do, AV or not, is to NOT make your daily driver account an administrator. Create an admin account with a secure password and then another standard user account for yourself and use that standard user for everything. When installing something you will need to put in your admin password but it is really not a big deal to do so. Massively reduces your chance of ransomware and all kinds of crapware. Enabling protected folder access and process isolation in Windows 10 is also a good idea.
- alternatetwo 5y ago
  The last point is probably the more important one. Basically all data people care about is not protected by UAC.
  - copperx 5y ago
    > Basically all data people care about is not protected by UAC. Sure, any program can delete the Documents folder, but how can you prevent that from happening?
  - Melatonic 5y ago
    It is not just UAC though - when your daily driver is NOT an adminsitrator then how is most ransomware or malware or whatever going to run and install itself in the first place? UAC still pops up whether you use an admin account or not - it just requires the admin password when you use a standard account (which is, of course, still more secure). But the real advantage is that the account you are using does not have those admin privileges in the first place. The other big advantage is that if this account is compromised in anyway (say if you used the same password to login to Chrome and Windows on your standard account) the hackers only get the password to your non privileged account. Of course this can be mitigated as well by really good password policy but I find for the average user they often re-use passwords and separating the two accounts forces them to often re-use the one that matters least.
JamesBarney 5y ago
tptacek could probably weigh in with a much better explanation. The tradeoff for having AV is having a giant application in admin land which increases the surface area available for an attack. Combine this with the that fact you don't get much protection because a virus can just be modified until the AV doesn't detect it and AV's just aren't worth it. This trade off made sense 20 years ago because OS's were less secure so you were increasing your surface area by relatively less than you are now.
account42 5y ago
> but i often see the sentiment expressed that supposedly the entire class of software is useless. AV software, including Defender, is not useless, it is actively harmful because it prevents people from running legitimate software without any recourse for non-experts or the original developer.

larrik 5y ago

> What happened to defense in depth with all of the layers you can introduce? What happened was antivirus itself became your biggest attack vector, so you were more secure without it. Plus Microsoft actually cares about security now, which wasn't the case 10+ years ago.

guelo 5y ago

what happened was the security industry proved over and over again that it cant be trusted. most windows recommendations i see say to use defender since Microsoft already owns you

x0x0 5y ago

Part of this surely is that most apps are now delivered in the browser, so increasingly windows is a terminal to run chrome or edge.

Melatonic 5y ago

For Windows one of the best things you can do, AV or not, is to NOT make your daily driver account an administrator. Create an admin account with a secure password and then another standard user account for yourself and use that standard user for everything. When installing something you will need to put in your admin password but it is really not a big deal to do so. Massively reduces your chance of ransomware and all kinds of crapware. Enabling protected folder access and process isolation in Windows 10 is also a good idea.

alternatetwo 5y ago
The last point is probably the more important one. Basically all data people care about is not protected by UAC.
- copperx 5y ago
  > Basically all data people care about is not protected by UAC. Sure, any program can delete the Documents folder, but how can you prevent that from happening?
- Melatonic 5y ago
  It is not just UAC though - when your daily driver is NOT an adminsitrator then how is most ransomware or malware or whatever going to run and install itself in the first place? UAC still pops up whether you use an admin account or not - it just requires the admin password when you use a standard account (which is, of course, still more secure). But the real advantage is that the account you are using does not have those admin privileges in the first place. The other big advantage is that if this account is compromised in anyway (say if you used the same password to login to Chrome and Windows on your standard account) the hackers only get the password to your non privileged account. Of course this can be mitigated as well by really good password policy but I find for the average user they often re-use passwords and separating the two accounts forces them to often re-use the one that matters least.

JamesBarney 5y ago

tptacek could probably weigh in with a much better explanation. The tradeoff for having AV is having a giant application in admin land which increases the surface area available for an attack. Combine this with the that fact you don't get much protection because a virus can just be modified until the AV doesn't detect it and AV's just aren't worth it. This trade off made sense 20 years ago because OS's were less secure so you were increasing your surface area by relatively less than you are now.

account42 5y ago

> but i often see the sentiment expressed that supposedly the entire class of software is useless. AV software, including Defender, is not useless, it is actively harmful because it prevents people from running legitimate software without any recourse for non-experts or the original developer.