10 ms·
Not having an exclusion for a development directory is like using a 10yo machine or using a laptop without the power brick connected: it’s basically leaving hal
by alkonaut 3y ago
Not having an exclusion for a development directory is like using a 10yo machine or using a laptop without the power brick connected: it’s basically leaving half the perf on the table.
Still, a second seems a bit much for a real-time scan.
- 0cf8612b2e1e 3y agoClearly you do not work for corporate America. Any amount of performance loss is acceptable to check a security compliance checkbox somewhere.
- alkonaut 3y agoI work for a large, slow moving US company in traditional industry. Of course there is an exclusion list, and it contains a few commonly used dirs like “C:\dev” and so on. If that would change (or if the request years back to have company wide exclusions wouldn’t have been listened to), it’s the kind of thing I’d insta-quit a job over, even after 20 years. So anecdotally (N=1) it’s not automatically horrible in US orgs.
- wkat4242 3y agoDon't forget the enterprise market has a whole different threat model. Even though blanket exclusions are often used, a determined attacker will quickly figure out to dump their remote exploration tool in c:\dev .
- josephcsible 3y agoIf the attacker gets far enough to be able to put something in c:\dev and run it, your protections have already failed.
- DanielHB 3y agoThis is the number 1 reason to use macbooks instead of windows laptops at any job. Security compliance software is like a cancer on windows, macos has some of this kind of crap as well but is nowhere near as bad.
- pacoverdi 3y agoUnder Windows 11, a "dev drive" can also make a big difference. https://learn.microsoft.com/en-us/windows/dev-drive/ https://learn.microsoft.com/en-us/windows/dev-drive/
- throwaway888abc 3y agoThanks for tip, TIL