3 ms·

Microsoft itself recommends developers use a "dev drive" where defender is partially disabled because of how bad it is.

• stackskipton 2y ago
  Dev Drive isn't because Defender is so bad but because Dev behavior can look like malicious behavior. Creating a bunch of random executables, connecting to running processes, decompiling files. Stuff that would be malicious behavior from normal user but normal for a dev.
  • vlovich123 2y ago
    I could be wrong but I don’t believe that even these days anti viruses look at behavioral patterns to identify viruses. They look for signatures of running executables to match malicious patterns in their database. Instead dev drives recommendations are because of performance. There’s substantial overhead & dev patterns, particularly for native code like C/C++/Rust etc, create a lot of intermediary files as part of the build and AV can cause a slowdown. Traditionally the advice for Windows devs was to turn off Defender or exclude your project folders but maybe there was a reason dev drives were still beneficial (maybe it can avoid even more work by working at a drive level).
    • mook 2y ago
      Anti-viruses do both signatures and behavior tracking; I believe for the Microsoft ones they're the ones with a !ml suffix.
  • saagarjha 2y ago
    Ok, and where exactly will malware place its artifacts when it comes to infect your company's developers?