4 ms·

From the referenced Google Code Blog http://googlecode.blogspot.com/2009/11/use-compression-to-make-web-faster.html http://googlecode.blogspot.com/2009/11/use-

From the referenced Google Code Blog http://googlecode.blogspot.com/2009/11/use-compression-to-make-web-faster.html http://googlecode.blogspot.com/2009/11/use-compression-to-ma...: Anti-virus software may try to minimize CPU operations by intercepting and altering requests so that web servers send back uncompressed content. But if the CPU is not the bottleneck, the software is not doing users any favors. Some popular antivirus programs interfere with compression. Users can check if their anti-virus software is interfering with compression by visiting the browser compression test page at Browserscope.org. Serious? Anti-virus software that is doing that is acting almost like malware doing what the user didn't ask it to do. Does compression have any even minor security implications that would legitimize this? And anyone know which anti-virus does this?

pbhjpbhj 17y ago
Does compression have any even minor security implications that would legitimize this? The quote you gave said that anti-virus apps might do it to "minimize(sic) CPU operations" rather than for security reasons.
- sparky 17y ago
  (sic)? Not where the post was written it's not :P
  - pbhjpbhj 17y ago
    But it is not written thus where I wrote my comment, ergo I raise you a smiley ;0P>
hristov 17y ago
Well anti virus software usually checks for signatures of known malware in the incoming data. I imagine compression would slow this down. They would have to uncompress the data and then check for signatures. (You can say that they can just compress the signatures, but that probably wont work for the more complex compression schemes, because they are not that predictable. Or maybe it can work, but it was considered too hard to code by the AV people.)
- tsally 17y ago
  Compression schemes have to be predictable when run on the same data. Otherwise decompression wouldn't work. If signature detection actually is more difficult on compressed data, it's not because the compression is unpredictable.
  - ryanpetrich 17y ago
    Compression schemes have to decode predictably, but they don't necessarily generate the same compressed data. gzip -9 will usually use less space than gzip -1 and decompress to the same data. What's probably happening is virus scanners are taking the easy way out rather than implementing decompression algorithms in their scanning engines (it probably looks better on traditional benchmarks too)
    - tsally 17y ago
      Even if different data are being generated, the compression is still predictable. There must be something in the gzip header indicating the level of compression (to ensure that the correct decompression algorithm is used). Point being, there's nothing stopping the AV program from figuring out which compressed signature is the correct one. It can even compress the raw signature on the fly. On your second point I agree. I'll refrain from ranting about AV programs here, but suffice to say there hasn't been enough innovation in the field because AV companies are able to sell substandard products and still make good money.
      - dmv 17y ago
        To be more specific, compression schemes decode predictably, but any given portion of the compression stream need not be independently predictable. Gzip (and DEFLATE in general) use adaptive compression approaches - the data determines the encoding. If you know your content of interest is in the beginning of the stream, pre-computing different compressions should work out. Otherwise...
      - ryanpetrich 17y ago

pbhjpbhj 17y ago

Does compression have any even minor security implications that would legitimize this? The quote you gave said that anti-virus apps might do it to "minimize(sic) CPU operations" rather than for security reasons.

sparky 17y ago
(sic)? Not where the post was written it's not :P
- pbhjpbhj 17y ago
  But it is not written thus where I wrote my comment, ergo I raise you a smiley ;0P>

hristov 17y ago

Well anti virus software usually checks for signatures of known malware in the incoming data. I imagine compression would slow this down. They would have to uncompress the data and then check for signatures. (You can say that they can just compress the signatures, but that probably wont work for the more complex compression schemes, because they are not that predictable. Or maybe it can work, but it was considered too hard to code by the AV people.)

tsally 17y ago
Compression schemes have to be predictable when run on the same data. Otherwise decompression wouldn't work. If signature detection actually is more difficult on compressed data, it's not because the compression is unpredictable.
- ryanpetrich 17y ago
  Compression schemes have to decode predictably, but they don't necessarily generate the same compressed data. gzip -9 will usually use less space than gzip -1 and decompress to the same data. What's probably happening is virus scanners are taking the easy way out rather than implementing decompression algorithms in their scanning engines (it probably looks better on traditional benchmarks too)
  - tsally 17y ago
    Even if different data are being generated, the compression is still predictable. There must be something in the gzip header indicating the level of compression (to ensure that the correct decompression algorithm is used). Point being, there's nothing stopping the AV program from figuring out which compressed signature is the correct one. It can even compress the raw signature on the fly. On your second point I agree. I'll refrain from ranting about AV programs here, but suffice to say there hasn't been enough innovation in the field because AV companies are able to sell substandard products and still make good money.
    - dmv 17y ago
      To be more specific, compression schemes decode predictably, but any given portion of the compression stream need not be independently predictable. Gzip (and DEFLATE in general) use adaptive compression approaches - the data determines the encoding. If you know your content of interest is in the beginning of the stream, pre-computing different compressions should work out. Otherwise...
    - ryanpetrich 17y ago