5 ms·

Non-ironic question: do many people on HN use anti-virus of some form or another? Generally i'd probably trust people's judgement here as far as that goes. I na

Non-ironic question: do many people on HN use anti-virus of some form or another? Generally i'd probably trust people's judgement here as far as that goes. I naively use Linux with no externally accessible services running and no active anti-virus -- am i an idiot, should i clean-install everything ASAP? Or do yous reckon this is reasonable? edit: clarification

grimman 12y ago
I do, but a very basic kind; ie. Microsoft Security Essentials. That doesn't change my distrust of binaries though, and if I must run things I don't trust, I frequently do it in a VM. But the gist of it is that if I can alleviate some of the risk that comes from running Windows, with no discernible cost (ie. no noticeable system slowdown), I will do so (obviously in addition to "common sense" security measures). It'd be foolish not to.
- toothbrush 12y ago
  Yeah, if i had to use Windows i would consider it essential to use some form of active anti-virus, but then again, i don't think that would alleviate my (unfounded?) general unease and feeling of still not being that "safe". But i'm trying to get a reality check here :)
  - freehunter 12y ago
    Windows 8 and Windows 10 come with AV built-in. It's generally "good enough" for home users. It will flag suspicious downloads before they download and before they run, and then scan them as they're running. With those two OSes, I never use an AV. I'd prefer user education over a stricter AV. On the other hand, my work laptop is Red Hat 6 and Linux, Mac, or Windows, we're required to run Symantec by corporate policy. Then again I work for a security company, so...
- 01Michael10 12y ago
  Microsoft Security Essentials/Windows Defender is one of the few antivirus software that fails AV-TEST certification. http://www.av-test.org/en/antivirus/home-windows/windows-7/ http://www.av-test.org/en/antivirus/home-windows/windows-7/ http://www.av-test.org/en/antivirus/home-windows/windows-8/ http://www.av-test.org/en/antivirus/home-windows/windows-8/ How old is your PC that modern antivirus software noticeably slows it down?
oneeyedpigeon 12y ago
Nope, I use OSX and, maybe naively, assume that gives me a greater level of protection than if I were running Windows. I'm also pretty careful when it comes to the most obvious attack vectors. In my experience, anti-virus software really slows a machine down, almost to the point that it might be better off with the virus instead - of course, that is highly dependent on the nature of the virus! I'm deeply cynical about virus companies and what involvement they might have in virus creation in the first place, although I understand how conspiracy-theory-crazy this might sound.
- ionised 12y ago
  > In my experience, anti-virus software really slows a machine down, almost to the point that it might be better off with the virus instead That's ridiculous. It has been a hell of a long time since antivirus applications affected the performance of a machine that way. The performance impact on any remotely modern machine is negligible. And under no circumstance is it 'better off with the virus instead'.
  - Karunamon 12y ago
    I know of at least, Intego's product for Mac OS as late as a couple months ago (got it as part of a bundle, installed, was horrified, uninstalled a day later), as well as CheckPoint endpoint security live up to the stereotype of antivirus programs being bloated system hogs. Really, look at what they do. They pre-emptively scan every executable program you run at the least. Unless you're on an SSD, and probably not even then, this is a blocking operation that is impossible to not notice.
    - Someone 12y ago
      But Mac OS X scans all code you run to verify code signatures, doesn't it? If so, the performance impact of scanning isn't that high. I think the main problem with antivirus on modern hardware is that commercial entities selling antivirus have to add bells and whistles. Few people would be willing to pay $x a year for a program they aren't even aware of running. So, that $x program makes sure you see it frequently by adding progress displays, toolbars, task bar items, etc. they also make sure they have stuff to report, even if that includes meaningless stuff such as registry keys on Windows. Detecting that meaningless stuff takes time, too.
kodr 12y ago
it depends on the market share. Windows is the most used OS, that's why you see virus on it. I heard OSX started getting some after becoming popular once again a few years back. As long as linux isn't too mainstream, it will be less a problem. But you could still use ClamAV if you share some files with other computers.
- toothbrush 12y ago
  "Sharing some files" seems vague though: i'm not sure if i correctly understand the attack vectors, but apart from running untrusted binaries (and as a normal user even that doesn't sound too scary -- or does it?), i guess it'd be via things like targeted exploitation e.g. buffer overflows or somesuch? Other than that it seems unlikely (but far from impossible of course) that an adversary could simply make my machine do evil stuff like spamming or leaking my files. (edit 2:) Also, i have to trust my distribution... That's actually the part i find most worrying. edit: Also, i'm not sure i agree with you that Windows being the most widely used OS is the reason for the proliferation of viruses for that platform. As i understand it (not wanting to start a flamewar here, i genuinely don't know), it also suffers from some poor security architecture -- but maybe my information is outdated. But sure, the fact that "everyone" uses it makes it a more valuable target, of course.
  - kodr 12y ago
    your linux could be used as a shared drive (samba), without executing stuff. It could be nice to scan files if they can be used on other OSes. As for Windows being unsafe, sure, it's easier to propagate stuff since you have root access. But like I said, viruses on OSX do exist.
    - toothbrush 12y ago
      I'm not sure i understand: do you mean i should scan my files, in case i share a file which would infect a Windows box? If so, i don't think i care. If you mean something else (i.e. somebody planting evil files on my "share"), please elaborate. I also stated i do not run external-facing services. That applies to the Samba example, too (although i was fibbing: i allow keypair-only login via sshd).
tptacek 12y ago
No.
- etiam 12y ago
  To all?
- HCIdivision17 12y ago
  Whelp, if that's not a succint answer I dunno what is. I ended up asking the search engine what you thought on the topic [0], and I think it was informative. At least, it made me feel a bit less bad about my stance. (Confirmation bias / appeal to authority ahoy.) [0] https://hn.algolia.com/?q=tptacek+antivirus#!/comment/forever/0/tptacek%20antivirus https://hn.algolia.com/?q=tptacek+antivirus#!/comment/foreve...
- toothbrush 12y ago
  I'll take the bait: what kind of system would you run? Linux? No evil web browser plugins? A personal computer which you never use to browse the web (RMS style)? Anything more exotic?
  - tptacek 12y ago
    I have a Macbook, like most of us. I turn the firewall on, and I use Chrome. That's about it.
Karunamon 12y ago
Myself, no. It's been my experience that AV programs only warn after it's too late and you've already been owned by some nasty bit of code. Gee, thanks for nothing, time to flatten and reinstall. There's also the problem that literally every one I've found on a Windows platform appears to be designed for the lowest common denominator, easily frightened end user - scary warnings and dire predictions about what might happen if I don't renew my subscription (another problem, you have to subscribe to all of these on a recurring basis), Fisher-Price level UI, and so on. To borrow a phrase from the /g/ community, I run Common Sense 2014 platinum edition. I.e. I don't download stuff from sketchy websites in general, I don't click email attachments, I don't use the Java web plugin, I do use things like Adblock and Noscript, etc. If I do end up with a possibly suspicious file it gets sent off to a multi-scanner environment like VirusTotal or Jotti where I can get about 30 different opinions simultaneously. The last few infections I've gotten were due to doing something boneheaded. Running something from a torrent without checking it first, or turning my browser security off temporarily and forgetting to reenable it.
- wmt 12y ago
  I'd rather get informed after getting owned than be unaware of an infection, at least you then know to bin your system and start fresh. However, I'd also run EMET to make it a bit harder for an exploit getting past NoScript to operate correctly.
  - deleted 12y ago
    [deleted]
  - Karunamon 12y ago
    The average vulnerability bug that you're likely to get having taken those precautions (no open ports to the internet, no live code running on untrusted webpages, etc ) easily sidesteps antivirus protection anyways. I know, security is all about layers, but the usability and performance tradeoff gained for this paper tiger protection is not worth it, in my mind.
psuter 12y ago
I do on my (Windows) work laptop, because the company that owns it justifiably insists I do. It's completely transparent, except for the odd days where an upgrade to VirtualBox or VMPlayer will introduce new "hardening" features, that the AV software will happily flag as a terrible threat.
acdha 12y ago
Not since a brief period in the 90s. You're much better spending your time staying on top of updates and not having plugins disabled in your default browser. As long as you don't run an email client which executes code[1] trying to enumerate badness is a losing game - it's too easy to try to bypass signatures, particularly since a malware author can simply test against the various AV clients before releasing something. 1. i.e. not Outlook managed by an enterprise IT department
wglb 12y ago
On one of my systems I do, but that is required by my client when I attach my device to their network. And my wife's desktop has MS security essentials. Keep in mind that when New York Times was hacked a while back that 50 kinds of malware was found, and only one of them was detected by multiple AV products. So depending upon AV to protect you is fraught with peril. Consider the possibility that adding AV to your system increases the attack surface. Does anyone remember the Michelangelo Virus from a while back? A well-known firm' AV software caused more damage than the virus itself. (It wiped out the boot sector.) Don't count on AV to protect you.
busterarm 12y ago
Total non-antivirus user here. I worked for 5 years in the trenches in the anti-malware industry and countless times I've seen antivirus software completely hose up computers and worse: having its own insecurity and hooks into the Windows API used directly to infect a system (I'm looking at you, AVG circa fall'09). Most importantly, no antivirus seems to do a very good job of dealing with emerging threats and malware is rapidly getting more sophisticated than the AV vendors can cope with. The major problems these days all seem to come down to an insufficiently secured operating system. The only real, effective antivirus is user education.

grimman 12y ago

I do, but a very basic kind; ie. Microsoft Security Essentials. That doesn't change my distrust of binaries though, and if I must run things I don't trust, I frequently do it in a VM. But the gist of it is that if I can alleviate some of the risk that comes from running Windows, with no discernible cost (ie. no noticeable system slowdown), I will do so (obviously in addition to "common sense" security measures). It'd be foolish not to.

toothbrush 12y ago
Yeah, if i had to use Windows i would consider it essential to use some form of active anti-virus, but then again, i don't think that would alleviate my (unfounded?) general unease and feeling of still not being that "safe". But i'm trying to get a reality check here :)
- freehunter 12y ago
  Windows 8 and Windows 10 come with AV built-in. It's generally "good enough" for home users. It will flag suspicious downloads before they download and before they run, and then scan them as they're running. With those two OSes, I never use an AV. I'd prefer user education over a stricter AV. On the other hand, my work laptop is Red Hat 6 and Linux, Mac, or Windows, we're required to run Symantec by corporate policy. Then again I work for a security company, so...
01Michael10 12y ago
Microsoft Security Essentials/Windows Defender is one of the few antivirus software that fails AV-TEST certification. http://www.av-test.org/en/antivirus/home-windows/windows-7/ http://www.av-test.org/en/antivirus/home-windows/windows-7/ http://www.av-test.org/en/antivirus/home-windows/windows-8/ http://www.av-test.org/en/antivirus/home-windows/windows-8/ How old is your PC that modern antivirus software noticeably slows it down?

oneeyedpigeon 12y ago

Nope, I use OSX and, maybe naively, assume that gives me a greater level of protection than if I were running Windows. I'm also pretty careful when it comes to the most obvious attack vectors. In my experience, anti-virus software really slows a machine down, almost to the point that it might be better off with the virus instead - of course, that is highly dependent on the nature of the virus! I'm deeply cynical about virus companies and what involvement they might have in virus creation in the first place, although I understand how conspiracy-theory-crazy this might sound.

ionised 12y ago
> In my experience, anti-virus software really slows a machine down, almost to the point that it might be better off with the virus instead That's ridiculous. It has been a hell of a long time since antivirus applications affected the performance of a machine that way. The performance impact on any remotely modern machine is negligible. And under no circumstance is it 'better off with the virus instead'.
- Karunamon 12y ago
  I know of at least, Intego's product for Mac OS as late as a couple months ago (got it as part of a bundle, installed, was horrified, uninstalled a day later), as well as CheckPoint endpoint security live up to the stereotype of antivirus programs being bloated system hogs. Really, look at what they do. They pre-emptively scan every executable program you run at the least. Unless you're on an SSD, and probably not even then, this is a blocking operation that is impossible to not notice.
  - Someone 12y ago
    But Mac OS X scans all code you run to verify code signatures, doesn't it? If so, the performance impact of scanning isn't that high. I think the main problem with antivirus on modern hardware is that commercial entities selling antivirus have to add bells and whistles. Few people would be willing to pay $x a year for a program they aren't even aware of running. So, that $x program makes sure you see it frequently by adding progress displays, toolbars, task bar items, etc. they also make sure they have stuff to report, even if that includes meaningless stuff such as registry keys on Windows. Detecting that meaningless stuff takes time, too.

kodr 12y ago

it depends on the market share. Windows is the most used OS, that's why you see virus on it. I heard OSX started getting some after becoming popular once again a few years back. As long as linux isn't too mainstream, it will be less a problem. But you could still use ClamAV if you share some files with other computers.

toothbrush 12y ago
"Sharing some files" seems vague though: i'm not sure if i correctly understand the attack vectors, but apart from running untrusted binaries (and as a normal user even that doesn't sound too scary -- or does it?), i guess it'd be via things like targeted exploitation e.g. buffer overflows or somesuch? Other than that it seems unlikely (but far from impossible of course) that an adversary could simply make my machine do evil stuff like spamming or leaking my files. (edit 2:) Also, i have to trust my distribution... That's actually the part i find most worrying. edit: Also, i'm not sure i agree with you that Windows being the most widely used OS is the reason for the proliferation of viruses for that platform. As i understand it (not wanting to start a flamewar here, i genuinely don't know), it also suffers from some poor security architecture -- but maybe my information is outdated. But sure, the fact that "everyone" uses it makes it a more valuable target, of course.
- kodr 12y ago
  your linux could be used as a shared drive (samba), without executing stuff. It could be nice to scan files if they can be used on other OSes. As for Windows being unsafe, sure, it's easier to propagate stuff since you have root access. But like I said, viruses on OSX do exist.
  - toothbrush 12y ago
    I'm not sure i understand: do you mean i should scan my files, in case i share a file which would infect a Windows box? If so, i don't think i care. If you mean something else (i.e. somebody planting evil files on my "share"), please elaborate. I also stated i do not run external-facing services. That applies to the Samba example, too (although i was fibbing: i allow keypair-only login via sshd).

tptacek 12y ago

No.

etiam 12y ago
To all?
HCIdivision17 12y ago
Whelp, if that's not a succint answer I dunno what is. I ended up asking the search engine what you thought on the topic [0], and I think it was informative. At least, it made me feel a bit less bad about my stance. (Confirmation bias / appeal to authority ahoy.) [0] https://hn.algolia.com/?q=tptacek+antivirus#!/comment/forever/0/tptacek%20antivirus https://hn.algolia.com/?q=tptacek+antivirus#!/comment/foreve...
toothbrush 12y ago
I'll take the bait: what kind of system would you run? Linux? No evil web browser plugins? A personal computer which you never use to browse the web (RMS style)? Anything more exotic?
- tptacek 12y ago
  I have a Macbook, like most of us. I turn the firewall on, and I use Chrome. That's about it.

Karunamon 12y ago

Myself, no. It's been my experience that AV programs only warn after it's too late and you've already been owned by some nasty bit of code. Gee, thanks for nothing, time to flatten and reinstall. There's also the problem that literally every one I've found on a Windows platform appears to be designed for the lowest common denominator, easily frightened end user - scary warnings and dire predictions about what might happen if I don't renew my subscription (another problem, you have to subscribe to all of these on a recurring basis), Fisher-Price level UI, and so on. To borrow a phrase from the /g/ community, I run Common Sense 2014 platinum edition. I.e. I don't download stuff from sketchy websites in general, I don't click email attachments, I don't use the Java web plugin, I do use things like Adblock and Noscript, etc. If I do end up with a possibly suspicious file it gets sent off to a multi-scanner environment like VirusTotal or Jotti where I can get about 30 different opinions simultaneously. The last few infections I've gotten were due to doing something boneheaded. Running something from a torrent without checking it first, or turning my browser security off temporarily and forgetting to reenable it.

wmt 12y ago
I'd rather get informed after getting owned than be unaware of an infection, at least you then know to bin your system and start fresh. However, I'd also run EMET to make it a bit harder for an exploit getting past NoScript to operate correctly.
- deleted 12y ago
  [deleted]
- Karunamon 12y ago
  The average vulnerability bug that you're likely to get having taken those precautions (no open ports to the internet, no live code running on untrusted webpages, etc ) easily sidesteps antivirus protection anyways. I know, security is all about layers, but the usability and performance tradeoff gained for this paper tiger protection is not worth it, in my mind.

psuter 12y ago

I do on my (Windows) work laptop, because the company that owns it justifiably insists I do. It's completely transparent, except for the odd days where an upgrade to VirtualBox or VMPlayer will introduce new "hardening" features, that the AV software will happily flag as a terrible threat.

acdha 12y ago

Not since a brief period in the 90s. You're much better spending your time staying on top of updates and not having plugins disabled in your default browser. As long as you don't run an email client which executes code[1] trying to enumerate badness is a losing game - it's too easy to try to bypass signatures, particularly since a malware author can simply test against the various AV clients before releasing something. 1. i.e. not Outlook managed by an enterprise IT department

wglb 12y ago

On one of my systems I do, but that is required by my client when I attach my device to their network. And my wife's desktop has MS security essentials. Keep in mind that when New York Times was hacked a while back that 50 kinds of malware was found, and only one of them was detected by multiple AV products. So depending upon AV to protect you is fraught with peril. Consider the possibility that adding AV to your system increases the attack surface. Does anyone remember the Michelangelo Virus from a while back? A well-known firm' AV software caused more damage than the virus itself. (It wiped out the boot sector.) Don't count on AV to protect you.

busterarm 12y ago

Total non-antivirus user here. I worked for 5 years in the trenches in the anti-malware industry and countless times I've seen antivirus software completely hose up computers and worse: having its own insecurity and hooks into the Windows API used directly to infect a system (I'm looking at you, AVG circa fall'09). Most importantly, no antivirus seems to do a very good job of dealing with emerging threats and malware is rapidly getting more sophisticated than the AV vendors can cope with. The major problems these days all seem to come down to an insufficiently secured operating system. The only real, effective antivirus is user education.