3 ms·

AV software bothers me so much. It's not just that it's generally ineffective. It's that when you bother dissecting it, you usually find it make users less safe

AV software bothers me so much. It's not just that it's generally ineffective. It's that when you bother dissecting it, you usually find it make users less safe (e.g. non ASLR/NX injected binaries, dangerous root certs, vulnerable hooks and format handlers, etc.). That said, Avast has caused me unique pain, and my personal experience correlates with the author's. Chrome's sandbox blocks all access to system resources, so it's a very bad idea to inject hooks into our sandboxed processes, because they usually just break. So, we often have to use the sandbox's loader hooking mechanism to block third-party DLL hooks that are known to cause crashes (ie. "security" software and other process-hooking utilities). Of course, Avast shows up regularly as a crasher, so eventually I added their DLLs to the block-list and then tried to start Chrome. So, imagine my surprise when blocking the offending Avast DLLs breaks Chrome by preventing all content--even internal content--from loading. I dig into it a bit more and find that Avast is hanging all our sandboxed processes, because their system-level hooking is so invasive that they won't let any process run if their injected DLL hooks don't attach. At that point I was forced to give up, because there's not much you can reasonably do against such recklessly invasive software already present on the system. It's really not very different from malware.

nolok 14y ago
Microsoft Security Essentials does so much right. When they put their mind into it, Microsoft really does great software.
- ambrop7 14y ago
  You have to take into account that Microsoft can modify their own OS and implement what needs to be done in a proper way. On the other hand, third-party vendors can only use the public interfaces exposed by the OS, or resort to unreliable and/or undocumented methods that may break at any time. There probably is no solution to that, any third-party software that needs tights integration with the OS is going to have that problem.
  - nolok 14y ago
    MSE for windows XP had no associated patch or service pack, was using the same api as every other AV out there, and was about a thousand time better. One could argue Microsoft doesn't need to turn a profit so they can afford to be less intrusive, but the truth is that I would pay for MSE. I wouldn't pay for any of the others.
    - T-hawk 14y ago
      That argument is indeed the core of it. Every other antivirus needs to be in your face constantly so you think you're getting value out of the purchase. They all suffer from the "this rock keeps tigers away" problem, that their enemy shows up too infrequently to justify their own existence. So they need to noisily invent enemies. MSE's existence makes a ton of sense when you realize the reason for its creation. It was developed to reduce Microsoft's own support workload, as a significant proportion of Windows support tickets are caused by both malware and belligerent antimalware. MSE justifies its existence by reducing OS support costs rather than by annoying users into paying for antivirus. So Microsoft's incentive is simply to have users use MSE, which is nicely aligned with delivering a clean quiet positive user experience.
    - criley 14y ago
      a thousand times better I was under the impression that MSE routinely did OK in AV benchmarks and rarely even ever held the top spot. How is it a thousand times better? Or does it's ability to keep you safe not really factor into your analysis of the software?
      - nolok 14y ago
        To be honest with you, my point of view is that no antivirus is going to protect me 100%, I always have to care about what I open, where it's coming from, ... What I want from my AV then, is to catch the most obvious (and thus numerous) ones, and do so in a way that doesn't bother me. MSE just doesn't get in the way. It updates silently. It scans silently. It detects silently, ask you for something but take the safe course by default. You are in a full screen app ? It doesn't crash everything trying to take control, it just deals with the threat and show a red icon in the tray. It doesn't make my computer safer than the other, but it makes me lose way less time when it does its job.
- simonh 14y ago
  So true, every third party AV I've installed on Windows has been a pain in the arse, but MSE just works. It's a crazy mixed up world in which they're actually afraid to ship MSE with the OS, because a third party application industry relies on the default OS release to be insecure. Edit: I didn't realise MSE was included in Win8.

nolok 14y ago

Microsoft Security Essentials does so much right. When they put their mind into it, Microsoft really does great software.

ambrop7 14y ago
You have to take into account that Microsoft can modify their own OS and implement what needs to be done in a proper way. On the other hand, third-party vendors can only use the public interfaces exposed by the OS, or resort to unreliable and/or undocumented methods that may break at any time. There probably is no solution to that, any third-party software that needs tights integration with the OS is going to have that problem.
- nolok 14y ago
  MSE for windows XP had no associated patch or service pack, was using the same api as every other AV out there, and was about a thousand time better. One could argue Microsoft doesn't need to turn a profit so they can afford to be less intrusive, but the truth is that I would pay for MSE. I wouldn't pay for any of the others.
  - T-hawk 14y ago
    That argument is indeed the core of it. Every other antivirus needs to be in your face constantly so you think you're getting value out of the purchase. They all suffer from the "this rock keeps tigers away" problem, that their enemy shows up too infrequently to justify their own existence. So they need to noisily invent enemies. MSE's existence makes a ton of sense when you realize the reason for its creation. It was developed to reduce Microsoft's own support workload, as a significant proportion of Windows support tickets are caused by both malware and belligerent antimalware. MSE justifies its existence by reducing OS support costs rather than by annoying users into paying for antivirus. So Microsoft's incentive is simply to have users use MSE, which is nicely aligned with delivering a clean quiet positive user experience.
  - criley 14y ago
    a thousand times better I was under the impression that MSE routinely did OK in AV benchmarks and rarely even ever held the top spot. How is it a thousand times better? Or does it's ability to keep you safe not really factor into your analysis of the software?
    - nolok 14y ago
      To be honest with you, my point of view is that no antivirus is going to protect me 100%, I always have to care about what I open, where it's coming from, ... What I want from my AV then, is to catch the most obvious (and thus numerous) ones, and do so in a way that doesn't bother me. MSE just doesn't get in the way. It updates silently. It scans silently. It detects silently, ask you for something but take the safe course by default. You are in a full screen app ? It doesn't crash everything trying to take control, it just deals with the threat and show a red icon in the tray. It doesn't make my computer safer than the other, but it makes me lose way less time when it does its job.
simonh 14y ago
So true, every third party AV I've installed on Windows has been a pain in the arse, but MSE just works. It's a crazy mixed up world in which they're actually afraid to ship MSE with the OS, because a third party application industry relies on the default OS release to be insecure. Edit: I didn't realise MSE was included in Win8.