The Netscaping of Symantec and McAfee

rs232 writes to mention a C|Net article about the uncertain future of the popular anti-virus software companies. "I mention Netscape because, if you believe Symantec and McAfee, a similar situation is about to unfold within the security industry. Microsoft, again recognizing late that it had failed to seize upon this thing called security, is now about to bundle its own security solutions within Windows Vista and further enforce new security policies that lock out some third-party security solutions altogether. Vendors Symantec and McAfee have looked into the future and realized that people may one day speak of them in the way that we now speak reverently of the early builds of Netscape."

Comments

This is NOT the same thing

[Shados]

Netscape had a product, which filled in a need customers had: a web browser.

Symantect and McCafe are only parasites, leeching from Microsoft's -mistakes-. It was unevitable that Microsoft would one day try to fix those mistakes, and unlike things like Office Suites, it is Microsoft's -responsability- to fix this mistake, and it is a feature that SHOULD be part of an operating system (aka: security, though Microsoft's implementation is debatable).

Not only that, but McCafe's and Symantec's products are viruses of their own, doing unthinkable things to the operating system and screwing over their users: They are malwares. I, for one, HOPE these 2 companies die soon, or find a new business model.

Re:This is NOT the same thing

[Anonymous Coward]

not to mention that signature based antivirus is going to die, and companies who do av/as right (don't let unknown stuff run in the first place, instead of trying to clean up after the fact) are going to eat symantec/mcafee's lunch (bit9, etc.)

Re:This is NOT the same thing

[Salvance]

Parasites, yes. But would you rather have them as a parasite or Microsoft to build its own set of Parasitic software. Unfortunately, Microsoft still isn't fixing their O/S to create something as secure as Linux or Mac ... they're just following the same path that McAfee and Symantec have in the past. What's worse is that Microsoft now has an incentive (although an unethical one) to create holes for viruses - they could create insecure code, put the fix in their OneCare product, then exclaim to the world that their virus scanner is the only one that protects against the vulnerability.

Re:This is NOT the same thing

[From A Far Away Land]

There is a big difference between Symantec and Netscape. Netscape was a program that was superior to IE, because you could Compose as well for free. Symantec will never be free, and in fact breaks about as many systems as it protects in my experience. McAfee is about as horrible as Symantec. The world could do with a few less AV vendors.

Re:This is NOT the same thing

[Bemopolis]

Agreed. This is like abortion clinics complaining about lost revenue when condom manufacturers reduce their failure rate.

And no, the fact that in this analogy the end-user is getting screwed either way is not lost on me.

Bemopolis

Re:This is NOT the same thing

[Cherita Chen]

What's worse is that Microsoft now has an incentive (although an unethical one) to create holes for viruses - they could create insecure code, put the fix in their OneCare product, then exclaim to the world that their virus scanner is the only one that protects against the vulnerability.

Ok, everyone... Let's put on our tin-foil hats now. Seriously, that's probably one of the silliest things I've heard (since listening to coast to coast AM w/Art bell).

Unethical things such as what you are describing are not common business practices, especially when you are talking about a multi-billion dollar software company. Perhaps you small start-up my do some stupid crap like that, but when you are talking about a corporation that employs tens of thousands of employees, it becomes more and more difficult to cover up garbage like you are describing. It would literally be the case of "Killing the goose that lays golden eggs" - for supper.

Re:This is NOT the same thing

[ctr2sprt]

But would you rather have them as a parasite or Microsoft to build its own set of Parasitic software.

I don't think it makes business sense for them to use AV as a long-term patch. It takes a lot of time and energy to keep AV signatures up-to-date, which means it costs money. If MS intends to give away or sell below cost its AV software - which it would almost have to do in order to drive McAfee et al. out of business - they could be losing a whole lot of money. And of course, if MS eventually slacks off (as they did with IE) or starts charging big bucks for new signatures, competition will spring back up. Symantec, for example, is a fairly diversified company: I don't see them going broke even if NAV never sells another copy. (They own Veritas now, remember.)

The best use of AV software for MS is as a short-term patch until they can release a real one. Say a zero-day exploit of Outlook is discovered. A new signature can be rolled out in a few days to their AV client, giving them a little breathing room to develop a patch for Outlook and test it to make sure it doesn't break anything else. This way, MS would only have to target the very latest or most serious malware. I expect that would make maintenance of an AV system much easier and cheaper.

Of course, it may not happen that way. This is MS we're talking about. They might be doing this just because it offends their sensibilities to see someone else making money.

Re:This is NOT the same thing

[Tim C]

Netscape was a program that was superior to IE, because you could Compose as well for free.

Disclaimer: Since moving over to a Windows PC, I have only ever used Netscape, then Mozilla, then FF as my main browser. I have never and probably will never use IE.

That said, Netscape 3 was better than IE 3. Netscape 4 was better than IE 3. Netscape 4 was worse than IE4, and wasn't even in the same league as IE 5. NN4 was slow, bloated, and crashed at the drop of a hat. IE4 was faster and much more stable, and IE 5 was better again. There were browser torture tests released during Mozilla development that IE 5 had no trouble with that utterly choked Netscape. Hell, you couldn't even resize Netscape's window without it having to re-request the page from the server!

Don't get me wrong, I used NN4 right up until around about the time that Mozilla M8 or M9 was released, but to say that NN was superior to IE because of Composer is one hell of a stretch, given that Navigator was barely usable.

Re:This is NOT the same thing

[WhodoVoodoo]

No, however it may suddenly be much less of a priority to the QA managers to ensure that releases are secure, because any flaw may then bolster a revenue stream for Microsoft. And anyhow if they don't catch it in time they could just push a stopgap to their own AV suite which everybody has by default based on their intimate, insider knowledge of their own territory.

My tinfoil hat might be a bit tight, but this does stink a bit. At the very least, what's going on is questionable.

Re:This is NOT the same thing

[AdamKG]

And, in this analogy, Linux users are still immune!

This IS the same thing

[backwardMechanic]

Symantec and McAfee are only in business because of Microsofts mistakes, true. I'd love to see them go out of business because MS had finally made a secure product. But that's not what MS are doing. Rather than making Windows secure, MS are making it difficult for the AV companies to operate. Sure, they're plugging Windows, but the wrong bits. It's not security, it's monopoly. We've seen this before.

The Netscaping of Symantec and McAfee

[thethibs]

Symantec and McAfee will find new lines of business or fade away because they are selling products that shouldn't exist at all.

These products are based on identifying any of hundreds of thousands of programs and stopping them from executing—in an environment containing a few dozen programs the user actually wants to run. It's far easier to allow the few dozen and deny access to anything that isn't on this short list than to check everything against a very long and growing longer list of signatures and behaviours.

In the fullness of time, MS operating systems will fully implement Default Deny security, a path they have already started down; PatchGuard is part of it. When this is done, there will be nothing for anti-virus software to do.

I run my systems using just this part of F-Secure (Application Control enabled, everything else disabled) and the occasional scan. Same approach to browsers: all is forbidden unless expressly allowed. Scan results are always zero hits.

I look forward to the day when this is written into the OS code. Vista security is a good start.

Everyone is forgetting something...

[PixieDust]

WHY does the AV program NEED to hook into the OS kernel?

When you think about it, this ITSELF introduces another vulnerability. Another point of failure. Why bother exploiting the OS, when you can use the nice convenient path provided to you by the AV software? Everyone seems to forget this.

Microsoft gets bashed for their 'insecurity' and the moment they try and IMPROVE that, they get flamed, and people cry foul and start throwing around such words as 'monopoly', 'abuse', 'lock-out', and the tin-foil hatters come out of the woodwork and start bashing MS security, while somehow totally missing the absurdity in what they're saying!

Other AV companies have managed to adapt to the kernel lockouts, why can't Symantec and McAfee do the same? Instead, they'd rather keep their grubby paws hooked into the OS as deep as they can be, so that they can effectively hose a user's installation, then charge them $80 for phone support to resolve the issue.

People can't have it both ways. You have to give credit where credit is due. Windows One Care is not installed by default, it's a FOR PAY product (which totally differentiates it from IE vs All) that you have to buy IN ADDITION to the OS. Windows Defender is free, and protects against spyware, and comes pre-installed. While I don't particularly like that, it doesn't really bother me either. People install Yahoo Messenger, and it wants to install a Toolbar with Yahoo Anti-Spy. The same goes for Google, AIM, MSN(yes I know that's redundant), and a plethora of other IM options, and even just generic toolbars. Most ISPs now days 'give' you AV/AS to use. So Windows Defender doesn't bother me, there's already another 50 billion people trying to give me spyware protection (none of which I use, the standard Windows Firewall is quite sufficient for me thank you), so why not MS too?

I had the opportunity to participate in the beta for OneCare (wasn't hard, they offered it free, and I liked that idea, since people were inevitably going to ask me about it). I found it to have a rather large footprint, and be fairly slow. Given it's competition in the form of Symantec NIS, and McAfee's Internet Security Suite, and Trend Micro's Internet Security Suite, it's performance was roughly average. It wasn't as fast as TM, but was quicker than NIS and MIS in most cases. What struck me was only TM had a better detection scheme, and even then it was marginal (though I know a single thing getting through can mean the difference between being completely hosed, and being OK, never knowing how close you came to Virtual Armaggedon). MS One Care did a MUCH better job of catching/stopping spyware then all of them (Windows Defender gets lumped into One Care installs generally).

Think of these things from the USER'S perspective. NOT from YOUR perspective. For people who are WAAAAY non-tech savvy, One Care offers a one-stop-shop for performance tuning (uncomplicated), AV, and AS and Firewall protection. It's easier to use than NIS, WAAAY easier than MIS, and TM rounds out the list of being the least user friendly. Bottom line is this is just one more cool way to bash Microsoft for trying to improve things. Do you think they're using kernel hacks for One Care? Probably not right now, as people would LOVE to find a way to exploit One Care to compromise a machine. Will it remain that way? Probably not, because I see things getting into the kernel eventually, and requiring that the kernel be accessible, at least to be scanned and locked so that it can be replaced. But still, NO AV/AS program should EVER be hacked into the kernel. Period.
It opens up the doors for too many things. OneCare also doesn't bombard the user with useless popups and notifications like the others often do, which aids in hosing the system as they USER tells it to do something bad.

One Care is a LEGITIMATE software release by Microsoft, and not at all a surprise. What is surprising to me, is that it took THIS long for it to resurface.

That is all. Please return to your normal dailty activity.