5 ms·

This isn't surprising, frankly. AVs have a history of accidentally removing other software. That a browser that does really sketchy things (ie: things malware d

This isn't surprising, frankly. AVs have a history of accidentally removing other software. That a browser that does really sketchy things (ie: things malware does) was flagged is not news, it's just an unfortunate bug. I see no malice here.

LeifCarrotson 3y ago
The news here is that Microsoft Defender have revealed that they have no adequate release testing process. Third-party AVs are a crapfest of dark patterns and false positives and resource hogging, if you install one and it does something bad that's kind of on you. But Windows Defender is built into the OS and enabled by default. Tor.exe should certainly be in a list of top 1000 common software packages that any tester would want to ensure don't get flagged and quarantined/deleted in a new virus definitions database. An update candidate that went out to a fraction of a percent of installs or to Microsoft's own employees, scanned without taking action, and posted to a dashboard reviewed by the Defender team that a file called "tor.exe" would be flagged if they continued the rollout would have stopped this. I can think of a dozen ways that a testing process would catch this. The fact that it happens proves there's either a lot of incompetence, or malice that was able to subvert a testing process.
- insanitybit 3y ago
  You're acting like it's really easy to avoid these problems. Something like TOR has updates over time. Unless TOR pre-submits every patch to MS before every release, there's no guaranteed way to handle it. And something like TOR can change in all sorts of ways between releases.
  - selfhoster11 3y ago
    Or Microsoft could just poll their extremely easy to access download site (https://archive.torproject.org/tor-package-archive/torbrowser/ https://archive.torproject.org/tor-package-archive/torbrowse...) every hour or two to detect new versions, and then automatically add them to an exclusion list.
    - insanitybit 3y ago
      OK and then how long for the signature updates to proliferate to clients? This is not an easy problem. Even with your suggested solution: 1. You are up to 1-2 hours behind on every update 2. If your job fails for whatever reason you're now N hours behind until an engineer fixes it. 3. Are you going to write one of these jobs for literally every good binary? 4. What happens if TOR changes any aspect of how it's packaged? Today it's a tar, tomorrow it could be a zip.
mmis1000 3y ago
A program that interpret (and sometimes compile and run, writing executable into random memory segmant and execute in place) random file fetched from random network location. You would definitely say it is a malware if you didn't know you are looking at a browser. The behavior of browser and malware really isn't that much different. I guess there really isn't a good way to know a browser binary is safe without manual intervention.
Arnavion 3y ago
Not even just "software". Back in 2018 when I still used Windows, Defender one day decided to quarantine a single text file generated by my IRC client from a few years ago, containing a plaintext log of one day's posts in a channel. After some binary search I realized it was tripping on a comment containing a URL, which I guess was to some malware. I was very amused.
Dylan16807 3y ago
> really sketchy things (ie: things malware does) It depends on how they got here, but if they literally had a heuristic to detect use of tor and didn't think about how it would affect tor.exe then that's really bad.

LeifCarrotson 3y ago

The news here is that Microsoft Defender have revealed that they have no adequate release testing process. Third-party AVs are a crapfest of dark patterns and false positives and resource hogging, if you install one and it does something bad that's kind of on you. But Windows Defender is built into the OS and enabled by default. Tor.exe should certainly be in a list of top 1000 common software packages that any tester would want to ensure don't get flagged and quarantined/deleted in a new virus definitions database. An update candidate that went out to a fraction of a percent of installs or to Microsoft's own employees, scanned without taking action, and posted to a dashboard reviewed by the Defender team that a file called "tor.exe" would be flagged if they continued the rollout would have stopped this. I can think of a dozen ways that a testing process would catch this. The fact that it happens proves there's either a lot of incompetence, or malice that was able to subvert a testing process.

insanitybit 3y ago
You're acting like it's really easy to avoid these problems. Something like TOR has updates over time. Unless TOR pre-submits every patch to MS before every release, there's no guaranteed way to handle it. And something like TOR can change in all sorts of ways between releases.
- selfhoster11 3y ago
  Or Microsoft could just poll their extremely easy to access download site (https://archive.torproject.org/tor-package-archive/torbrowser/ https://archive.torproject.org/tor-package-archive/torbrowse...) every hour or two to detect new versions, and then automatically add them to an exclusion list.
  - insanitybit 3y ago
    OK and then how long for the signature updates to proliferate to clients? This is not an easy problem. Even with your suggested solution: 1. You are up to 1-2 hours behind on every update 2. If your job fails for whatever reason you're now N hours behind until an engineer fixes it. 3. Are you going to write one of these jobs for literally every good binary? 4. What happens if TOR changes any aspect of how it's packaged? Today it's a tar, tomorrow it could be a zip.

mmis1000 3y ago

A program that interpret (and sometimes compile and run, writing executable into random memory segmant and execute in place) random file fetched from random network location. You would definitely say it is a malware if you didn't know you are looking at a browser. The behavior of browser and malware really isn't that much different. I guess there really isn't a good way to know a browser binary is safe without manual intervention.

Arnavion 3y ago

Not even just "software". Back in 2018 when I still used Windows, Defender one day decided to quarantine a single text file generated by my IRC client from a few years ago, containing a plaintext log of one day's posts in a channel. After some binary search I realized it was tripping on a comment containing a URL, which I guess was to some malware. I was very amused.

Dylan16807 3y ago

> really sketchy things (ie: things malware does) It depends on how they got here, but if they literally had a heuristic to detect use of tor and didn't think about how it would affect tor.exe then that's really bad.