4 ms·

I have to ask what motivates that. Defender has been extremely unproblematic and pretty good as far as MS software goes, for my experience at least.

tredre3 2y ago
Defender slows down build times significantly. You can set exclusions of course, but it does get tedious because every time you have a new project you need to add exclusions for its folder and the toolchain. Then every time a toolchain is updated (eg .../gcc/11.5 changes to gcc/11.5.2 you have to enter the 20 new exe exclusions and of course windows won't let you mass delete the old ones so it's click->confirm->click->confirm x50). I might not do it myself but I can see why someone would just say "enough is enough".
- felipelemos 2y ago
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths
  - andyayers 2y ago
    Or https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-antivirus-performance-mode https://learn.microsoft.com/en-us/defender-endpoint/microsof... (DevDrive + Defender's "performance mode")
- gtsteve 2y ago
  You can use the powershell command Add-MPPreference -ExclusionPath[0] and ship a script with your app if you want. I do the same for Terraform providers - whenever a new version comes out, for a time the process can be randomly killed as I suppose a process that spawns a child process that starts talking to lots of endpoints looks somewhat suspicious. [0] https://learn.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2022-ps https://learn.microsoft.com/en-us/powershell/module/defender...
- RockRobotRock 2y ago
  JetBrains does it for you with one click when you create a new project.
- com2kid 2y ago
  In the old days at MSFT, developers had a separate HD for code and builds that was completely excluded from virus scanners. Sometimes a big blunt hammer does the trick!
Eisenstein 2y ago
It adds a non trivial amount of time for each file access.
maccard 2y ago
I see about a 100x slowdown on some applications[0] and IO heavy operations with defender in win11. It's unbelieveable how slow it is. I was a huge proponent of it in Win10, but I'm finding it hard to do so now. [0] The software I'm using does a scan over a few hundred thousand files to read file headers. Without windows defender it takes about 30 seconds, but with defender it takes about 300.
- mananaysiempre 2y ago
  That’s 10× though, not 100× (still a lot for something you can’t turn off). Typo?
  - maccard 2y ago
    Yes, typo! My bad and I can’t edit.
- voidwtf 2y ago
  The answer in this scenario is to exempt that application and/or folder. Don’t throw the baby out with the bath water. In my environment we have to add exceptions for Developers git folders for the realtime scanning for a similar reason. Apps with large numbers of small files or high frequency writes of smalls files, like temp files during the build process, need to be exempted unless you’re willing to pay the performance penalty for the security.
  - maccard 2y ago
    I don’t understand why, but I have an exemption for that folder and I’ve disabled real time scanning. It still shows the slowdown on first launch. The only thing that works is disabling windows defender entirely. I’ve been through the troubleshooting loop a few times with this.
    - xnyan 2y ago
      Out of curiosity, does Dev Drive do anything for you? https://learn.microsoft.com/en-us/windows/dev-drive/ https://learn.microsoft.com/en-us/windows/dev-drive/
Suppafly 2y ago
I'm generally in favor of Defender, but it can definitely cause performance issues, especially in relationship to other windows processes like windows update. If you keep your system regularly updated, it's less of a problem, but I often help people who basically never update or leave their computer on long enough for Defender to do complete scans. After a certain point it basically becomes impossible to update because defender fights update and chrome and discord and etc etc etc, for access to the files and you end up with the cpu and harddrive maxed out for a couple of days before everything completes.

tredre3 2y ago

Defender slows down build times significantly. You can set exclusions of course, but it does get tedious because every time you have a new project you need to add exclusions for its folder and the toolchain. Then every time a toolchain is updated (eg .../gcc/11.5 changes to gcc/11.5.2 you have to enter the 20 new exe exclusions and of course windows won't let you mass delete the old ones so it's click->confirm->click->confirm x50). I might not do it myself but I can see why someone would just say "enough is enough".

felipelemos 2y ago
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths
- andyayers 2y ago
  Or https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-antivirus-performance-mode https://learn.microsoft.com/en-us/defender-endpoint/microsof... (DevDrive + Defender's "performance mode")
gtsteve 2y ago
You can use the powershell command Add-MPPreference -ExclusionPath[0] and ship a script with your app if you want. I do the same for Terraform providers - whenever a new version comes out, for a time the process can be randomly killed as I suppose a process that spawns a child process that starts talking to lots of endpoints looks somewhat suspicious. [0] https://learn.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2022-ps https://learn.microsoft.com/en-us/powershell/module/defender...
RockRobotRock 2y ago
JetBrains does it for you with one click when you create a new project.
com2kid 2y ago
In the old days at MSFT, developers had a separate HD for code and builds that was completely excluded from virus scanners. Sometimes a big blunt hammer does the trick!

Eisenstein 2y ago

It adds a non trivial amount of time for each file access.

maccard 2y ago

I see about a 100x slowdown on some applications[0] and IO heavy operations with defender in win11. It's unbelieveable how slow it is. I was a huge proponent of it in Win10, but I'm finding it hard to do so now. [0] The software I'm using does a scan over a few hundred thousand files to read file headers. Without windows defender it takes about 30 seconds, but with defender it takes about 300.

mananaysiempre 2y ago
That’s 10× though, not 100× (still a lot for something you can’t turn off). Typo?
- maccard 2y ago
  Yes, typo! My bad and I can’t edit.
voidwtf 2y ago
The answer in this scenario is to exempt that application and/or folder. Don’t throw the baby out with the bath water. In my environment we have to add exceptions for Developers git folders for the realtime scanning for a similar reason. Apps with large numbers of small files or high frequency writes of smalls files, like temp files during the build process, need to be exempted unless you’re willing to pay the performance penalty for the security.
- maccard 2y ago
  I don’t understand why, but I have an exemption for that folder and I’ve disabled real time scanning. It still shows the slowdown on first launch. The only thing that works is disabling windows defender entirely. I’ve been through the troubleshooting loop a few times with this.
  - xnyan 2y ago
    Out of curiosity, does Dev Drive do anything for you? https://learn.microsoft.com/en-us/windows/dev-drive/ https://learn.microsoft.com/en-us/windows/dev-drive/

Suppafly 2y ago

I'm generally in favor of Defender, but it can definitely cause performance issues, especially in relationship to other windows processes like windows update. If you keep your system regularly updated, it's less of a problem, but I often help people who basically never update or leave their computer on long enough for Defender to do complete scans. After a certain point it basically becomes impossible to update because defender fights update and chrome and discord and etc etc etc, for access to the files and you end up with the cpu and harddrive maxed out for a couple of days before everything completes.