Slashdot Mirror
Google Chrome Engineer Says Windows Defender 'the Only Well Behaved Antivirus', Cites 'Tons of Empirical Data' (onmsft.com)
Days after former Firefox developer Robert O'Callahan said that antivirus security suites are not necessary, and AV vendors are of little help. A Google Chrome engineer has echoed the same message, reaffirming that Microsoft's built-in software is indeed the most well-behaved security suite. From a report: Apparently the disdain for 3rd party AV solutions runs deep amongst browser developers, as in response to the threads a Google engineer, Justin Schuh, had this to say: "Browser makers don't complain about Microsoft Defender because we have tons of empirical data showing that it's the only well behaved AV."
I tend to agree. I used to have third party anti-virus on the wife's machine and the kids' machine, but really the most effective malware prevention is to take away root/admin privileges altogether. Anti-virus doesn't protect against the stupidity of users. If they install malware, no anti-virus will stop them. Almost everything that the anti-virus software caught was benign and were false alarms. And despite being useless, the crap software was a resource hog.
I have since uninstalled anti-virus. I will do an occasional malware bytes scan, but have done so less and less frequently as I find little but tracking cookies.
So, yes, I agree with this report.
I have a friend who's a Windows Defender and he just goes on and on about how great Microsoft's products are. Pretty intrusive if you ask me.
I clicked on the link, get a popup asking me to disable my ad-blocker...fine. Done. Turns out the article is about a paragraph and just regurgitates some twitter garbage. Utterly useless site.
The problem is that every company other than Microsoft has a built in conflict of interest. The AV software companies profit motives are not aligned with providing a good user experience. A good anti-virus system should be nearly invisible. Hard to convince customers to pony up a lot of money for security software unless you are always in their face and an anti-malware system that does this inherently results a bad product. Worse they have to keep tacking on extra "features" and products to convince customers their product is better than the next guys. Their business model is based on scaring customers so they buy their product based on perceptions rather than actually keeping them safe.
It's probably the "best-behaved" because it is one of the least effective anti-virus. It has terrible detection rates compared to its competitors. The other anti-virus programs may be pushier and embed themselves deeper into the host system, but that's necessary in order for them to (try to) root out the infections.
Arguably end-users do not need this sort of protection offered from better AV packages, that Microsoft's product is "good enough" for most users. Certainly, better Antivirus is no panacea; even the best scanner can still miss some viruses. Personally - having cleaned out too many virus-infected machines - I'd rather the end-user have the maximum available protection if only to slow down the infection rate a little, although that still doesn't help when the end-user deactivates the AV, never updates it or just flat-out ignores its warnings . But regardless of your opinion of the /necessity/ of the software, you can't simply judge Microsoft's offering without taking into consideration its effectiveness. It is "best behaved" (for whatever that means) because it simply /does less/.
These engineers forgot the most effective, powerful anti-virus product that is an absolutely essential install; the ad blocker.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
All the AVs today pretty much catch the same low-hanging fruit, and there's no good reason to buy a third-party bolt-on anymore.
That said, I'm getting annoyed with AV packages still not being able to flag things like base-64-encoded Powershell scripts or Office doc VBS scripts that make direct references to system libraries. Almost all the malware that's made it through our defenses in the past six months has used one of these two techniques (plus a little code obfuscation, but still), and none of the AV packages I've tested (via sites that scan against dozens of packages) have ever flagged any of the most effective offenders.
Far too often, antivirus products follow the "cable television" market strategy:
"Yes, we know you already pay us for a subscription, but we can get so much more out of you by forcing you to see all kinds of shit you really don't want, including adverts for all our other services."
And, in the case of free antivirus, this too:
"We can see that you really dont want our full package, otherwise you would have bought it instead of opting for the free version-- but we feel compelled to try to upsell you each and every possible opportunity, and wont relent at all. We will even be really obnoxious with your notification area, and make your system play audio adverts, because that's how much we really want you to have a subscription (but see the prior market strategy-- we wont let up on the ads even if you do!)"
They invest tons of resources (both computational and time-wise) into making needlessly flashy UIs with big colorful buttons, and scary "CSI: Miami"-esque dialogs, when really--- the part that really matters-- how well they can trap execution events without bogging the system down-- seems to get nearly no love, and appears to get shittier and shittier.
Then you have Windows Defender. It's so plain, you instinctively ignore its presence. Excepting on older XP systems, (where there was a CPU utilization bug), it runs with a very modest system footprint. It does not constantly vomit spam into your system tray, and does not try to milk you for additional service agreements, or to switch to a paid version. It behaves itself very well.
If Avast or AVG behaved like that, instead of trying to be garishly tawdry and whorishly self-promoting like prostitutes, and reduced their system resource consumption habbits accordingly, they would win hands down.
But no, fleecing idiots is much more profitable.
I started doing PC support in my Field with Grandmas and small business.
AV software WAS USEFUL in the XP/98 era. I would argue with slashdoters calling them morons for not running it as you had 1 min max before infection on Windows 2000 or XP with no firewall!!L
We all ran admin istrator aka root and Win32 even had account personation services. Gee a dialup with no firewall or shitty software one with IE 6 running Java and Adobe flash without a sandbox on a local admin account was the norm so what could possibly go wrong!!??
Vista god bless it made UAC, privilege speration, scrambled ram addresses with aslr, buffer overflow protected buffers in c/c++, and psuedo local admin accountants which instead used a token to run something. Thanks Theo from OpenBSD for inspiration.
Windows 10 goes further too by using x86 features to separate data from executable bits directly on the CPU and signed bootloaders.
AdBlock and sandboxed Adobe products and AdBlock all make Windows OK now. Not perfect, but OK.
I just reused an Asus sabertooth I threw out in storage 2 years ago . I thought it was broken! Why? Esset kept making my ssds loose data. I thought SATA ports were bad. Went thru 3 expensive ssds. It was my damn AV software glitching them.
Keep updates current, run AdBlock, DNS service like the free Norton DNS servers on your router's, and heaven sakes don't click everything you download and you will be fine in 2017. AV software forges SSL certificates too which is dangerous
http://saveie6.com/
I used to work for an AV vendor in their IT department. Others in my family have continued working in the software security industry for decades. They really are just bloated resource suckers with little value. As such, I haven't run anti-virus beyond windows defender for a little over 10 years, not even on my kids computers. They're kept up to date, ads are blocked on my network, and I have taught my kids how to recognize an executable from other kinds of files (thank god for re-enabling file extensions being shown, the stupidest Windows default of them all).
We had one virus when my daughter opened an email that gave her some nasty popups constantly. She learned a valuable lesson that day, but I was able to reverse it in less than an hour booting into safe mode and removing the files. Been fine otherwise.
This forum Sig is licensed under the LGPL.
Regardless of anyone's particular sentiments on aPK (he doesn't bother me), black-holing garbage domain names (something something hosts file) and IP addresses (if possible) is an excellent source of additional protection.
That said, no AV is a poor prospect too, especially for business. I work for a local break-fix shop that also is branching into MSP work for out small to mid biz clients. Out system uses a modified Bitdefender + site blacklisting. It works well but does have a foot print. I say it is useful though because some of our clients are 30-50 seat law firms, insurance companies, and financial institutions - you would not believe how heavily targed they are with social engineer attacks designed to install malware. Mostly through email attachments, but there have been DOS attacks, password attacks against open ports, and DNS redirect attacks.
User training is #1, but AV and good backups have saved the bacon more than once. We see constant removals of crypto virus installers, only 2x in the past 3 years has one actually gotten through by being too new for detection. How many would that be without an AV with a 95%+ catch rate?
Silence is a state of mime.
I don't use any AV software. I don't need to. I have ClamAV in a live session for customers. And that way there's no files locked.
...Browser makers don't complain about Microsoft Defender because we have tons of empirical data showing that it's the only well behaved AV....
There is more, a lot more, to an a/v than what is seen via the myopic view of a browser developer.
They're not glorifying effectiveness (though most testing shows they all are pretty equal now) instead they're explaining that Microsoft's solution behaves well with applications which is generally true as it's less invasive.
As a former developer of web browsers (6 years of it), I can confirm that from a developer's point of view, Microsoft hooks more cleanly into the sockets API than the other's I've used.
Don't get your panties in a bunch.
Black-holing garbage domains (ad sources and trackers especially) is definitely a good idea but the problem with a hosts file is that you can't do wildcards, so while you can easily block "foo.domain.com" and "bar.domain.com", you can't block "{random string}.domain.com" unless you know what "{random string}" is in advance - to do that requires either a DNS based blocklist or some other software tool. That's getting to be a problem given that marketing/tracking companies are slowly (and it's taken them long enough) waking up to the possibilty that you can use "{random string}" as a wildcarded DNS entry to track whether a link was looked at or not just as effectively as a custom URL or cookie.
Also, to add to the GP's comment about the importance of an Ad-Blocker, let's not forget blocking auto-run of certain browser plugins and the ability to whitelist sites that can run JavaScript / save cookies.
UNIX? They're not even circumcised! Savages!
I had bitdefender installed on my machine about a year ago and I was writing c++ HPC software. Everything was compiled with the Intel compiler and mkl with profile guided optimizations. Bitdefender started detecting my binaries as virus infected and deleting them. This happened a few times and I disabled it for a month and later turned it back on with newer virus definitions and the same issue kept happening. It even detected some of the binaries I had on a shared drive and deleted them also.
The false positive rate on some of these scanners is just too high.
I will just stay with windows defender since it has not interfered with any of my debugging or profiling and has never deleted the software I am compiling.
Computer modeling for biotech drug manufacturing is HARD!
Well, it would be considering the Defender developers have full access to Windows.
Agreed. Twitter is an utterly useless site.
I read the entire thread up to my standard filter level, and this is what I concluded: the singular of anecdote is "one size fits all".
It's pretty clear from what I've read here that for a low-value target, I'd just settle for the low-hanging fruit of Windows Defender, ad blocking, a DNS block list, etc.
It's also pretty clear that for a high value target (e.g. law firm, bank) where the minimum system install is a bulked-out i7 I'd elect to suffer the bloat & obtrusiveness in order to obtain the somewhat better catch rate of a first-tier third-party solution. The people working for these kinds of institutions are pretty demoralised to begin with, it will just look like business as usual (and so it is).
The other side of this is that "one size fits all" is directly connected to the competency porn carapace. "Well, I work for banks and law firms and YOU can't handle the truth". But what actually gets written is this "YOU can't handle compensating my clients for a 48-hour loss of service". This tends to be a person whose amygdala has swollen to such a painfully large size that he or she can no longer multiply 1% times 365 (the constant friction of a badly behaved "solution") and can only multiply 100% times 2 days (as specified under the total availability-loss Weimar Reparations Act).
I think it's a bit more than just "Microsoft unfair advantage". Other AV products have always been monstrously bloated affairs, and have become all the worse over then last decade as they throw all kinds of other shit like firewalls and the like in. Products like mcafee and Norton have become almost as bad as the disease they purport to treat. So far as I can tell, Defender really doesn't do much more than sniff out viruses and malware, and while I agree Microsoft's insider knowledge probably gives it a bit of an edge, I think the narrower intent of the software has a lot to do with its better performance.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Thanks for your reply.
"... the most they [Microsoft managers] want is information on how to be either a middleman or true supplier for the things you want to buy."
That seems correct to me. However, it seems to me that Microsoft managers have little social ability. They can be self-destructive and not detect that they are being self-destructive. One example: In Windows 10, Microsoft tries to sell "APPS" to people who are employees of companies doing routine work.
It seems to me that Microsoft managers saw the success of Google's Android and search abusiveness, and wanted some of that success for themselves.
Nice Fanboi flamebait post. Beau, did MicroShaft PAY you to put this up?
I can back this up based on my end-user servicing experience, and I'm not even a Microsoft fan. Recent versions of Windows before 10 are better protected with Microsoft Security Essentials (free from MS) plus periodic manual scans with MalwareBytes Free than the bloated antivirus scanners that bog down PCs for the first hour after every reboot. In Windows 10, the antivirus is finally built in once again, so long as you enable Windows Defender.