5 ms·
The news here is that Microsoft Defender have revealed that they have no adequate release testing process. Third-party AVs are a crapfest of dark patterns and
by LeifCarrotson 3y ago
The news here is that Microsoft Defender have revealed that they have no adequate release testing process.
Third-party AVs are a crapfest of dark patterns and false positives and resource hogging, if you install one and it does something bad that's kind of on you.
But Windows Defender is built into the OS and enabled by default.
Tor.exe should certainly be in a list of top 1000 common software packages that any tester would want to ensure don't get flagged and quarantined/deleted in a new virus definitions database. An update candidate that went out to a fraction of a percent of installs or to Microsoft's own employees, scanned without taking action, and posted to a dashboard reviewed by the Defender team that a file called "tor.exe" would be flagged if they continued the rollout would have stopped this. I can think of a dozen ways that a testing process would catch this. The fact that it happens proves there's either a lot of incompetence, or malice that was able to subvert a testing process.
- insanitybit 3y agoYou're acting like it's really easy to avoid these problems. Something like TOR has updates over time. Unless TOR pre-submits every patch to MS before every release, there's no guaranteed way to handle it. And something like TOR can change in all sorts of ways between releases.
- selfhoster11 3y agoOr Microsoft could just poll their extremely easy to access download site (https://archive.torproject.org/tor-package-archive/torbrowser/ https://archive.torproject.org/tor-package-archive/torbrowse...) every hour or two to detect new versions, and then automatically add them to an exclusion list.
- insanitybit 3y agoOK and then how long for the signature updates to proliferate to clients? This is not an easy problem. Even with your suggested solution: 1. You are up to 1-2 hours behind on every update 2. If your job fails for whatever reason you're now N hours behind until an engineer fixes it. 3. Are you going to write one of these jobs for literally every good binary? 4. What happens if TOR changes any aspect of how it's packaged? Today it's a tar, tomorrow it could be a zip.