31 ms·
Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%
- deleted 3y ago[deleted]
- gtop3 3y agoI would like anyone that considers Microsoft to be a recent champion of Open Source to reflect on corporate doublespeak. It's plausible that this bug was engineered as an attack on Firefox.
- DonHopkins 3y agoIf Microsoft were so good at software engineering that they could pull off such an attack on Firefox, then maybe they do deserve to have a monopoly. /s
- layer8 3y agoNever attribute to malice…
- alpaca128 3y agoNowadays a lot of malicious acts are intentionally disguised as stupidity and incompetence. Not necessarily in this case, but that quote really is showing its age.
- CatWChainsaw 3y agoIncompetence and malice are one and the same.
- DoctorOW 3y agoDevils advocate, why then did they fix it?
- mistrial9 3y agoslow walk.. or.. in comparison, have you contacted your local city government to fix obvious holes in the road recently? Around here, a two-year wait time to fix it is common.
- justinclift 3y agoBecause it became public knowledge that it was happening?
- princevegeta89 3y agoVery interesting point. They might have had the intentions of pushing everyone to use Edge, and it is not surprising after their so many consistent nags and misleading messages to think its the "better" browser compared to anything else.
- maccard 3y agoHave you any semblance of proof of this? By the looks of it took Firefox a few years to figure out what the repro was, they reported it to MS, it was (very) promptly fixed and they were warned that the syscall they were using isn't being used as intended and they should consider changes to FF for future use cases.
- mrb 3y agoIt's the AV that was calling TdhFormatProperty(), not FF. The problem was mostly on the AV side, not FF. FF itself was generating many events due to too many VirtualProtect() calls which in itself was only a smaller part of the problem.
- xutopia 3y agoI've lived through the browser wars and I can tell you that this would not surprise me one bit.
- maccard 3y agoThere's a difference between something not surprising you and a wild, totally baseless accusation. Ill happily eat my words if there is a shred of proof, but right now it's "company fixes old bug when it was reported to them"
- JustSomeNobody 3y ago>> It's plausible that this bug was engineered as an attack on Firefox. > Have you any semblance of proof of this? Does it need proof? Someone can make a statement like this solely based upon past behavior. They're merely stating that it is plausible.
- maccard 3y ago> Does it need proof? Yes, it does. Stringing together a narrative and ignoring the proof that contridts your claims is conspiracy theory territory. > Someone can make a statement like this solely based upon past behavior. Yet all the evidence (the bug linked) implies nothing of the sort. > They're merely stating that it is plausible. I can state that it's _plausible_ that the US government conspired with Disney to fake the Moon landing as a show of power to the USSR in the 60's, but I'd expect to be asked for proof, and I'd expect to be accused of spreading absolute nonsense.
- vntok 3y agoWhat a weird take. If this bug was engineered as an attack on Firefox, then it seems like the project has been infiltrated by bad actors, because the bug comes from Firefox's codebase. Indeed, the developers themselves contradict your comment in the linked bug conversation: > This problem has two sides: Microsoft was doing a lot of useless computations upon each event; and we are generating a lot of events. The combination is explosive. Now that Microsoft has done their part of the job (comment 82), we need to reduce our dependency to VirtualProtect. (https://bugzilla.mozilla.org/show_bug.cgi?id=1441918#c90 https://bugzilla.mozilla.org/show_bug.cgi?id=1441918#c90) Compare how many calls other browsers make (this is also quoted in the link): Firefox was generating up to 46 times more (costly) events than Chrome. It is a bit ludicrous to shame Microsoft for the whole situation. > Firefox with normal configuration: ~14000 events, 98% of which are PROTECTVM_LOCAL; > Firefox with the preferences from comment 83: ~6500 events, 95% of which are PROTECTVM_LOCAL; > Edge: ~2000 events, 91% of which are ALLOCVM_LOCAL; > Chrome: ~300 events.
- stalfosknight 3y agoDo we have to assume negative intent every time something like this happens?
- uoaei 3y agoWe should at least be aware of it as an option. Many call this "healthy skepticism". It becomes unhealthy when you veer into blind optimism/pessimism/cynicism.
- agloe_dreams 3y agoWell no, but I also would question the inverse. Holding accountable companies that gain from possibly bad actions and asking the questions is helpful. See: Microsoft's Supreme court case over their preference for IE and forced monopoly. While Microsoft 'won' the case, the outcomes were exactly what the case feared but "convenient" political climate helped them avoid travelling back to court of course. Microsoft took extreme steps to avoid being broken up in the 1990s however and it's arguable that one of their political mitigation methods, investing in Apple, actually had worse effects on them. (Prior to the iPhone in 2007, it was assumed that RIM and Microsoft would be the big two players in the smartphone space, Apple and Google have basically become the big two players in the Computing space mindshare) https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor....
- chaostheory 3y agoThis is a relic of Bill’s tenor. Satya is different in good way.
- markphip 3y agoIt is amusing that anyone thinks a company with > 200K employees and probably 10K products is organized enough for something like this.
- naremu 3y agoInaction is a pretty low "bandwidth" form of action, and can sometimes produce the results you're looking for just as well, if not more effectively. Microsoft has a storied history of anti-competitive views leaking to public eyes/ears, something like this is quite literally a matter of not organizing anyone.
- echelon 3y agoWhy would Microsoft attack Firefox specifically and not Chrome? Chrome is the bigger threat to their business. Firefox has become almost too small to care about - little revenue, small browser market share.
- agloe_dreams 3y agoThere's an argument that Microsoft's Edge use of Chromium and then the Surface Duo would cause 'don't bite the hand that feeds you" problems. Not agreeing with OP, but it would make sense.
- babypuncher 3y agoThis seems incredibly unlikely and overly cynical just for the sake of being cynical.
- garbagecoder 3y agoThe WWEification of every discourse is the worst thing about $current-year
- MuffinFlavored 3y agoWhat apps other than Firefox might this have affected that badly (75% CPU usage)?
- xnx 3y agoI'm hoping that this fixes other apps, because Defender active scanning is a huge and near constant strain on my CPU.
- snerbles 3y agoNewer versions of Thunderbird have been rendered completely unusable unless I exclude %userprofile%\AppData\Local\Thunderbird from real-time scans.
- Avamander 3y agoThunderbird is atrociously slow even without an AV with any mailbox that isn't tiny. Could it be that yours has just grown over the years and Defender amplifies it?
- snerbles 3y agoIt went from ~20 seconds of freezing on every server request to no freezing at all after adding the exception. That's quite the amplification.
- Culonavirus 3y agoAll of them? From IDEs through games to email clients. Remove that malware as soon as you can. Either replace it with some more competent antivirus (not sure there are any) or don't use any antivirus at all - as a visitor of this site you should generally know what you're doing and what is and what isn't safe. I use https://github.com/jbara2002/windows-defender-remover https://github.com/jbara2002/windows-defender-remover and have been running my Windows machines without any antivirus and without any issue for years (if you ask how do I know Defender sucks if I don't run it - I do run it at work where I can't remove it - only disable it temporarily and it turns itself on again after a while).
- jeffbee 3y agoThat's one way to look at it, but a very biased take. An equally valid take is that Firefox was calling an expensive platform feature too often, and even though it has been killing performance for years (possibly, for the entire history of the project) nobody noticed or bothered to fix it on the application side.
- jupp0r 3y agoThe platform feature in question was normally cheap and just made artificially expensive by Defender intercepting calls to it and blocking until analysis was performed. I don't think it's the FireFox' team's responsibility to be aware of and take into account arbitrary software intercepting system calls.
- jeffbee 3y agoWindows Defender real-time protection is enabled by default.
- vntok 3y ago> I don't think it's the FireFox' team's responsibility to be aware of and take into account arbitrary software intercepting system calls. Per the bug report, Firefox was generating up to ~14,000 calls where Chrome was generating ~300, though. Surely it is Firefox' team's responsibility to use system calls in a sane way, say not almost 50x more than the competition?
- jupp0r 3y agoDid you read the bug report? This is literally about writing to files in a temp folder. Surely you can optimize that but you should also be able to assume that this does not use excessive amounts of CPU on a modern operating system.
- vntok 3y agoYes, I have read the bug report. It mentions that Firefox writes wayyyyy too much in the temp folder. It also mentions that the team should fix this behaviour independently of the fact that some of those calls are more costly than they should be because of the bug in Defender: > With a standard Firefox configuration, the amount of calls to VirtualProtect is currently very high, and that is what explains the high CPU usage with Firefox. The information that the most impactful event originates from calls to VirtualProtect was forwarded to us by Microsoft, and I confirm it. In Firefox, disabling JIT makes MsMpEng.exe behave much more reasonably, as JIT engines are the source of the vast majority of calls to VirtualProtect. > On Firefox's side, independently from the issue mentioned above, we should not consider that calls to VirtualProtect are cheap. We should look for opportunities to group multiple calls to VirtualProtect together, if possible. Even after the performance issue will be mitigated, each call to VirtualProtect will still trigger some amount of computation in MsMpEng.exe (or third-party AV software); the computation will just be more reasonably expensive.
- 29athrowaway 3y ago[flagged]
- jupp0r 3y agoYou'd think they'd target Chrome (>60% market share on Desktop) rather than Firefox with < 8% market share.
- uoaei 3y agoThe new Edge browser is basically a revamped Chromium, so that'd be a pretty dumb move.
- recursive 3y agoSeems less dumb than targeting Firefox though. Presumably, in the universe of this conspiracy hypothesis, they would do it in a way that wouldn't effect Edge.
- uoaei 3y agoThen they would lose any semblance of plausible deniability, which would expose them to being positively identified as bad actors. What it looks like now is mere incompetence in the face of enormous complexity, which means they lose a lot less face compared to doing what you suggest. Put bluntly, they're hiding within the space covered by Hanlon's razor.
- dylan604 3y agoif processName != Edge {}
- dgellow 3y ago> mpengine.dll version 1.1.20200.4 was released on April 4, so the fix should be available for everybody now. See the end of comment 91 to know what version you are using. Also, the latest discoveries in bug 1822650 comment 6 suggest that we can go even further down in CPU usage, with all antivirus software this time, not just Windows Defender. Really nice to see open collaboration between Mozilla and Microsoft development teams resulting in a net improvement for everybody.
- 0x4c6565 3y agoThis update is causing intermittent browsing issues in Firefox and Chrome for me and several others (not Edge, though). Getting 'PR_END_OF_FILE_ERROR' in Firefox, with Chrome experience issues at the same time (though Chrome does eventually load the page)
- bornfreddy 3y agoYes. I mean it took 5 years, but who would count. /s
- dan-robertson 3y agoPeople care about open Firefox bugs much older than that. Basically any long-lived program will have ancient bugs that never made it onto someone’s todo list.
- sicariusnoctis 3y agoFor example, it only took 20 years (!!) to stop Ctrl+Q from quitting Firefox on Linux. :) IIRC, a couple of patches did get submitted, but never accepted for unknown reasons.
- bscphil 3y agoIsn't Ctrl-Q quitting the program normal and expected behavior? For example, right now on Firefox 111, I can see in the File menu that the "Quit" option has the keyboard shortcut Ctrl-Q. I'm fairly sure it works.
- crest 3y ago"bug"
- tcfunk 3y agoI wonder if this is why Firefox often gets killed when I have other high-resource apps open?
- whalesalad 3y agoMy only interaction with Windows Defender is the (undefeatable) nag popup every boot that warns me it is disabled.
- _8j50 3y agoHaha, you should enable it with exclusions. It's the best AV out there that isn't an EDR. I disable it in labs but I can't imagine running windows in prod with defender enabled. Don't use windows like it's Linux.
- TecoAndJix 3y agoDefender, under certain licenses, is an EDR - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/def...
- deleted 3y ago[deleted]
- mesebrec 3y agoWhat is an EDR?
- libraryatnight 3y agoendpoint detection and response: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/def...
- deleted 3y ago[deleted]
- _8j50 3y agoWell they call a LOT of things Defender now anything from email and azure specific alerting to EDR and DLP. It's all "Windows Defender ______". But I meant the consumer license AV. But also even with the most basic win10, cloud submission (if privacy is no biggie) gets you EDR detections to a point but without the edr console and logs. When I simulate attacks with defender on, I would spend a lot of time bypassing it but then as soon as I break opsec (e.g.: run whoami.exe) if cloud submission is on I basically burn that technique because the edr in their cloud blacklisted it but with that off I can last as long as I want so long as I don't execute things flagged as malware by the defender on the host (and even then, usually that thing gets blocked not my original technique which I can still reuse).
- arnaudsm 3y agoQuick napkin math of the wasted power : Firefox has ~300e6 users, let's assume the bug wasted 5 extra watts 4 hours a day. That's 250 megawatts saved, the equivalent of an average coal power plant. Because some Microsoft engineer missed a bug.
- drumttocs8 3y agoHow are you calculating 5W? And subsequently 20Wh?
- pjmlp 3y agoIf it isn't on the Sprint board it doesn't exist.
- dylan604 3y agoYou also have to assume that at least one Microsoft employee has Firefox installed. There's no bug if there's no users
- sterlind 3y agoI work at MS, tried to use Firefox but couldn't because FF doesn't integrate with the Windows cert store. Crucially, this keeps Windows Hello (TPM auth) from working, which makes it useless for any internal websites. For a while I used a hand-compiled PKCS#12 plugin that bridged to the cert store, but that was extremely fragile and eventually I gave up. I think this is probably a major blocker for many enterprise users, and wish Mozilla would have fixed it. edit: it looks like they may have fixed this in the past couple years, though you might have to go poking around in about:config.
- pixel16 3y agoMicrosoft now blocks non edge browsers with conditional access policies.
- reynoldsbd 3y ago
- Brosper 3y agoWow Microsoft should say at least sorry to Mozilla and somehow repay them for this!
- neilv 3y agoWhen I've heard people speak of changing Web browsers in recent years, I think the two most common reasons given are performance and privacy. I wonder whether this situation with Microsoft Defender cost Firefox some market share.
- dalmo3 3y agoI can count at least one user that Firefox lost to this bug. Pretty happy with Brave now, won't even bother trying FF again.
- andrewstuart 3y agoDOS ain’t done till lotus won’t run.
- NelsonMinar 3y agoIt's so frustrating this discussion took five years. I'd be grateful for an overview of the bug. I don't think I've seen it on my two systems but I can't be confident.
- stronglikedan 3y agoFive years is nothing for MS. You should see how long the bug in File Explorer has been there, where after navigating to a folder and pressing the down arrow, the second item is selected instead of the first. And it's one of those things that, even though I'm aware of it, it still always catches me causing extra keystrokes. It's like they're trying to force me to use the mouse for some reason.
- zamadatix 3y agoThat one I can almost agree with the reasoning for. The first item is selected by default but also by default you have to intentionally trigger a keyboard navigation for it to go into that mode since most don't intend to do that when hitting enter on a freshly loaded directory. As evidence of this behavior instead of hitting a directional key to change the selection whacking space should activate the highlight on the first item and then another navigation action is needed to actually do anything. I think it'd be more convenient (for me as a keyboard centric user at least) if it were done differently but I don't think it's actually a bug as much as an intentional decision at the cost of keyboard user. This is unlike the Defender issue where it's of no purpose to be significantly slower than it needed to be.
- deafpolygon 3y agoWanted to chime in with this. Agreed, it's not a bug. Just a UX decision that was made to prevent people from hitting Enter over and over and constantly launching/navigating stuff. I often accidentally rename files in macOS Finder (hitting Enter activates rename).
- forgotmypw17 3y agoI think you can press Space to select the first item.
- Animats 3y agoHow fast would this have been fixed if was Microsoft Edge that was wasting CPU time?
- jahsome 3y agoDepends on how fast google patched it.
- MagicMoonlight 3y ago“Bug”
- subarctic 3y agoWhen you say reduced by 75%, would that mean, say, going from %40 to 10% or from 75% to 0%?
- chucksmash 3y agoIt means the former. If you reduced something to zero, you reduced it by 100%.
- nabakin 3y agoPrevious post: https://news.ycombinator.com/item?id=35458746 https://news.ycombinator.com/item?id=35458746 @dang
- GrumpyNl 3y agomaybe AI helped them out.
- nabakin 3y agoFirefox-related CPU use is only reduced by 75% when this bug is caused. NOT in the general case as this title implies
- cronix 3y agoIf you're on a Mac and using FF (probably not FF specific), turning off "ambient mode" in youtube can save 30% cpu. I just found this out while searching why FF was taking 90% of my cpu while watching youtube videos in normal mode, but went down to 40% use if viewing in full screen. Turns out that this youtube "ambient mode" was the culprit. My lap is now cooler and the fan doesn't turn on anymore. I wonder how much power I've wasted due to this new "feature" they added 6 months ago that I didn't know about.
- emoII 3y agoSame behaviour for me using Safari.
- winter_blue 3y agoThis is one of the myriad reasons why I have a strong preference for Linux.
- fiddlerwoaroof 3y agoThis has nothing to do with macOS vs. Linux, though
- ezfe 3y agonot sure what your point is... ambient mode is a visual effects thing YouTube does and reading the descriptions, not surprised it causes increased CPU usage regardless of OS.
- DevKoala 3y agoSomething happens > This is one of the myriad reasons why I have a strong preference for Linux.
- xen2xen1 3y agoBecause browser users on Linux have never, ever been shafted by a browser bug? Riiiiiight.
- 3y ago
- swamp40 3y ago[flagged]
- somid3 3y agoConspiracy theory — could this have been done on purpose for browser share dominance purposes?
- shadowgovt 3y agoSometimes, but probably not in this context. a) That'd be a very untargeted way to get that effect; Firefox isn't the only app that's going to be making calls like that. b) Mozilla doesn't need any help losing marketshare in this era.
- toenailtag 3y agoI would bet it is more likely that MS devs noticed but just didn't care. The farthest it would have gotten in conversation with QA triage would have been "does this issue affect any of our services? Ok then that is Mozilla's problem."
- simondotau 3y agoMS?
- tinglymintyfrsh 3y agoNope. MDE is shitty. It pushes updates to millions/billions of machines without sufficient testing and monitoring. There was a MDE bug that caused Chrome to crash whenever dragging tabs. Another time, MDE also appeared to "remove" all of some users apps when it deleted shortcuts.
- shadowgovt 3y agoWoof, that's a long time for a bug like that to have sat around and Mozilla to not have come up with a workaround for it.
- dbg31415 3y agoI have screamed about this like a crazy person and filed bugs and was always told, "Meh there's nothing there..." But if you use Firefox to call yourself on Chrome... you'll see that Firefox takes up a TON more energy on an Intel MBP than Chrome does. You can tell because Firefox literally heats your laptop up to do streaming videos. You hear the fans kick on, the laptop gets hotter to hold. Anyway I'm sure there are more bugs like this! Glad Firefox is getting some of the people to fix their code... but look, Microsoft isn't the only culprit. Until Firefox takes as little power as Chrome in MacOS & Windows... I think we should all stay outraged! (=
- jiggawatts 3y agoLooks like there's more work left to do to catch up to Chrome: https://bugzilla.mozilla.org/show_bug.cgi?id=1823634 https://bugzilla.mozilla.org/show_bug.cgi?id=1823634 That bug is more subtle. Apparently the various ways to use VirtualAlloc is not self evident, and some variations have wildly different performance characteristics due to undocumented interactions with Event Tracing for Windows (ETW) events that get sent to anti virus products. So it's not only the original problem of the events being handled inefficiently, it's also that the way they're generated is a bit of a black box and hard to predict without detailed performance tracing work.
- deleted 3y ago[deleted]
- pomsense 3y agoMost likely their devs using GPT4 and finally "fixed" it
- dang 3y agoRecent and related: Firefox engineers discover a Windows Defender bug that causes high CPU usage - https://news.ycombinator.com/item?id=35458746 https://news.ycombinator.com/item?id=35458746 - April 2023 (215 comments) Is the current post significant new information* or just a repeat of that submission? * https://hn.algolia.com/?dateRange=all&page=0&prefix=false&sort=byDate&type=comment&query=%22significant%20new%20information%22%20by%3Adang https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...
- mmis1000 3y agoGuess that's why I never feel firefox laggy but others said it is. The first thing I do after installing windows is always installing some other antivirus to disable defender. Because the defender start routine scanning at weird time and lag games randomly, which is really annoying. I really have no clue why engineer at ms think such behavior is ok. Shouldn't scans like these scheduled at some time slot that people are not actively using computers?
- TaylorAlexander 3y agoI haven't run in to this issue either. The first thing I did when I bought my windows laptop, before ever booting it, was plug in a debian installer disk and then boot to that, erase the entire drive and install debian. More windows users should try this little trick!
- nnurmanov 3y agoSomeone should create a website to list bugs that haven’t solved for years. Hall of shame. I myself could add couple from Oracle, hibernate
- wankle 3y agoSomeone diverged the thread into Linux vs Mac. The point is, how did the evil Microsoft monolopy get away with not fixing this bug for so long.
- taeric 3y agoI feel like this could/should be a metaphor for airport security...
- adithyassekhar 3y ago[flagged]
- mrtweetyhack 3y ago[dead]
- xyst 3y agoyet another reason why I don’t touch Windows for any professional/sensitive workflows. Only keep a license around for the occasional gaming session. Disable all of the Windows features (ie, firewall, auto updates, antivirus) and telemetry. Strip the OS to bare minimum and manage the GPU, mobile drivers manually. Limit it to only games
- qikInNdOutReply 3y agoGood thing its a bug though, not a monopolistic attempt to sabotage the competition running on your platform, by doing strange things with API rodeo. This surely ruined the performance of other software too..
- NelsonMinar 3y agoInteresting comment on Reddit from a Mozilla engineer: https://www.reddit.com/r/firefox/comments/12hxqjl/comment/jfs5tvy/?utm_source=reddit&utm_medium=web2x&context=3 https://www.reddit.com/r/firefox/comments/12hxqjl/comment/jf... Careful to talk about how this is entirely a fix for Windows and will improve the experience of folks using other software, not just Firefox.
- PaulHoule 3y agoIt’s hard to say that anti-virus isn’t worse than the virus.