5 ms·

> Antivirus software has to have full access to every part of your system so it can scan and remove things. Should the software become compromised, it can becom

> Antivirus software has to have full access to every part of your system so it can scan and remove things. Should the software become compromised, it can become the entry point... That's precisely why it was never necessary. > The internet is full of outdated cybersecurity advice that just won’t die but should, like “public WiFi is unsafe” and “you should change your passwords regularly.” For the more pedantic in the crowd... This was never pedantry and still isn't.

saagarjha 3y ago
Yeah it’s just wrong. Pedantic people are correct but annoying.
- waldrews 3y ago
  To clarify: is the referenced advice (public wifi bad, change passwords) pedantic and/or wrong, or is the statement (this advice is outdated) pedantic and/or wrong?
  - saagarjha 3y ago
    The advice is wrong/outdated.
tzs 3y ago
> That's precisely why it was never necessary How did you keep viruses and worms and such off of Windows systems around say 1995-2002?
- DavidPiper 3y ago
  Not sure why you're being downvoted as I think it's a reasonable question to ask when someone's saying antivirus was never necessary. Having seen a few friends' family computers degrade and behave unexpectedly when I was younger, there were definitely people out there who would have benefited. However I think GP is drawing attention to the irony that, as an attack vector, antivirus software as it was conceived actually increased your surface area of risk in some ways.
- hulitu 3y ago
  Just like today:Think before you click. Antiviruses are crap today.
  - danillonunes 3y ago
    Click? Back in the days you could get infected with blaster by just having a Windows XP machine connected to the internet. No action needed.
    - tzs 3y ago
      Yup. I saw it happen to a machine once less than 15 minutes after installing Windows and putting it on the net. I think a lot of people nowadays forget how wild it was back then.
brevitea 3y ago
> Antivirus software has to have full access to every part of your system so it can scan and remove things. Should the software become compromised, it can become the entry point... To be sure, 3 Critical vulnerabilities patched in April 2024 are Windows Defender RCEs[1]. Insane. [1]https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2024-patch-tuesday-fixes-150-security-flaws-67-rces/ https://www.bleepingcomputer.com/news/microsoft/microsoft-ap...
patrakov 3y ago
> Antivirus software has to have full access to every part of your system so it can scan and remove things. Removal/quarantining of bad files does require elevated privileges, but just scanning and warning, no. Let's take ClamAV as an example. It has three processes: * clamonacc: runs as root, watches for file open/change/close events, does not do any parsing (so it is mostly safe, the only real problems that I encountered are file descriptor exhaustion attacks and slow/hanging filesystems like FUSE or NFS), just forwards the file descriptor to clamd via a socket * clamd: runs unprivileged, gets pre-opened files to scan from clamonacc, runs virus-event scripts also unprivileged * freshclam: runs unprivileged, does nothing except updating the virus databases and telling clamd about that, so no attack surface here

saagarjha 3y ago

Yeah it’s just wrong. Pedantic people are correct but annoying.

waldrews 3y ago
To clarify: is the referenced advice (public wifi bad, change passwords) pedantic and/or wrong, or is the statement (this advice is outdated) pedantic and/or wrong?
- saagarjha 3y ago
  The advice is wrong/outdated.

tzs 3y ago

> That's precisely why it was never necessary How did you keep viruses and worms and such off of Windows systems around say 1995-2002?

DavidPiper 3y ago
Not sure why you're being downvoted as I think it's a reasonable question to ask when someone's saying antivirus was never necessary. Having seen a few friends' family computers degrade and behave unexpectedly when I was younger, there were definitely people out there who would have benefited. However I think GP is drawing attention to the irony that, as an attack vector, antivirus software as it was conceived actually increased your surface area of risk in some ways.
hulitu 3y ago
Just like today:Think before you click. Antiviruses are crap today.
- danillonunes 3y ago
  Click? Back in the days you could get infected with blaster by just having a Windows XP machine connected to the internet. No action needed.
  - tzs 3y ago
    Yup. I saw it happen to a machine once less than 15 minutes after installing Windows and putting it on the net. I think a lot of people nowadays forget how wild it was back then.

brevitea 3y ago

> Antivirus software has to have full access to every part of your system so it can scan and remove things. Should the software become compromised, it can become the entry point... To be sure, 3 Critical vulnerabilities patched in April 2024 are Windows Defender RCEs[1]. Insane. [1]https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2024-patch-tuesday-fixes-150-security-flaws-67-rces/ https://www.bleepingcomputer.com/news/microsoft/microsoft-ap...

patrakov 3y ago

> Antivirus software has to have full access to every part of your system so it can scan and remove things. Removal/quarantining of bad files does require elevated privileges, but just scanning and warning, no. Let's take ClamAV as an example. It has three processes: * clamonacc: runs as root, watches for file open/change/close events, does not do any parsing (so it is mostly safe, the only real problems that I encountered are file descriptor exhaustion attacks and slow/hanging filesystems like FUSE or NFS), just forwards the file descriptor to clamd via a socket * clamd: runs unprivileged, gets pre-opened files to scan from clamonacc, runs virus-event scripts also unprivileged * freshclam: runs unprivileged, does nothing except updating the virus databases and telling clamd about that, so no attack surface here