You Don't Need an Antivirus (Except Microsoft's Built-in on Windows), Says Former Firefox Developer (ocallahan.org)

Former Firefox developer Robert O'Callahan believes that antivirus software is not necessary, AV vendors are of little help, and that you should uninstall your antivirus software immediately. From a blog post: Users have been fooled into associating AV vendors with security and you don't want AV vendors bad-mouthing your product. AV software is broadly installed and when it breaks your product, you need the cooperation of AV vendors to fix it. (You can't tell users to turn off AV software because if anything bad were to happen that the AV software might have prevented, you'll catch the blame.) When your product crashes on startup due to AV interference, users blame your product, not AV. Worse still, if they make your product incredibly slow and bloated, users just think that's how your product is.

Comments

This is obvious even to AV vendors

[The-Ixian]

The writing has been on the wall for a while now. You rarely get "just AV" when you install an AV product these days. You end up with a whole suite of value added applications like password managers, system optimizers, registry cleaners, web site scanners, IPS and content filters, etc.

The reactionary system we have been living in was never very good. Relying on signatures to detect malware is a fundamentally flawed system. As the operating systems and, more importantly, the applications that run on them become increasingly secure, the need for the signature-based AV systems declines.

Any AV software company has seen this coming for a long time. At least I would hope they have.

AV Free for years

[Anonymous Coward]

Further, any software you install likely creates new security holes in your system. By installing an AV you are likely opening up more holes then you are closing.

There are three main sources of security holes:
1) Holes in the OS that the OS manufacturer needs to close
2) Holes in installed software that the software manufacturer needs to close
3) Holes in the user's general security intelligence.

None of those are solved by adding ANOTHER software suite.

Re:AV Free for years

[tepples]

Holes in the user's general security intelligence.

None of those are solved by adding ANOTHER software suite.

Not even whitelist-based security tools that allow only vetted applications to run? I thought that was the point behind Apple's App Store, game consoles' app stores, and the PC Matic tool for Windows.

Re:hyper-v and don't install chrome extensions

[Anonymous Coward]

Another benefit of using a virtual machine is just powering it off when you are finished and having it reset to the last snapshot. Every month or so apply patches and move your snapshot forward.

AV is a joke

[n0w0rries]

I started removing AV from clients computers years ago. All it does is slow your PC down. Every time I had to deal with an infection, the PC involved had AV, that was sometimes very hard to remove.

malware removal services should just be a tax on the easily confused.

Re:AV is a joke

[FyRE666]

Exactly. I do the same, if we get a new PC with commercial AV installed (usually some trial) it's the first thing I uninstall to installing improve disk performance by 50-100%. The Windows 10 built-in AV works fine and doesn't make a PC perform like it has a 5400rpm drive from 2001, instead of a modern SSD.

The average user still needs AV

[entropy01]

I don't use AV, but the average person still needs it. The average person either doesn't know or doesn't care what they are clicking on. As part of a layered defense strategy for the average user, it is still needed. Personally, I don't like AV stealing my CPU cycles. I use other methods, common sense chief amongst them, to prevent infection.

Re:The average user still needs AV

[DarkOx]

The average person does need A/V but the built in stuff that come with Windows is more than adequate. Signatures are really only good if they are nearly to the moment up to date and with the present rate of churn on the internet that model just does not really work. To the degree it does still work Microsoft does as good a job as anyone. Its the heuristic side where there is still some effectiveness but even the high dollar stuff like Cylance falls down more than it succeeds. They claim 99% and maybe that is true if you just grab random malware off the internet and throw it at their stuff. We did some internal testing with more recent exploit code from metasploit and what have become downright common powershell and rundll payloads; if all we did is make the most trivial modifications to them we saw more like a %2 detection rate, other endpoint packages did about the same as well.

Long story short A/V won't protect you from even a broadly targeted (hey I know these guys are using windows 8 because I Trojaned my "stat button" replacement app for windows 8/8.1, now I'll just wait and here and see how my hosts join my botnet) attack using updated tools. It certainly won't help you against an actual targeted attack.

Should everyone leave Windows Defender on, yes its free and MS has done a pretty good job making sure their own AV package does not foul up their own OS. I would NOT recommend any third party A/V solution at this point for individuals or SMBs. There might be some residual value in endpoint packages for larger businesses but there is an equal strong cases for going without and focusing on a systems management solution instead where you simply make sure everything is patched and you have tight control over what gets run. Unfortunately Applocker bypasses are fairly trival now so you do need a third party solution800,000 to take a true white list approach.

Ad Block

[EvilSS]

These days one of the best AV products is a good ad blocker. I can protect myself from sketchy downloads: don't download sketchy software or from sketchy sites. I can't prevent some asshat from exploiting a zero day in a browser through an ad on a mainstream site, except by blocking all ads on all sites.

*Yes, trusted sites can be comprised and it's happened in the past where downloads were infected but the odds that I'll download that software during that window where the infected files are being handed out are about the same as me getting stuck by lightning.

Re:Ad Block

[interkin3tic]

I use addblock, ghostery, and noscript to protect myself from viruses

"YOU'RE KILLING THE INTERNET!"

Yeah, well the internet infected and killed one of my computers, so I'm going to be wearing an internet condom from now on. Besides, you can't tell me no one is viewing ads anymore when my aunt still is using windows XP.

"What websites were you LOOKING at that killed your comptuer?"

Oh the usual ones, porn, porn, yahoo, and more porn.

"You pervert! Use google instead!"

I agree with the summary

[DatbeDank]

Let's be real with ourselves. Nowadays the vectors for attack are easily protected so long as you use a modern browser that sandboxes itself and use an ad blocker you really don't need anything more than the built in AV and firewall tools for windows. I don't even think OSX provides an AV tool.

I haven't paid for antivirus software since 2005 which was coincidentally when I discovered Firefox and Adblocking extension.

I'll stick with the free tools.

Re:hyper-v and don't install chrome extensions

[CaptnCrud]

I do the same thing, except I have the song ~smooth operator by sade playing in the background when im in "secure" mode.