Hacker News Reader

Comment by TFoxBrewster | Hacker News Reader

Just wanted to chime in to clarify that I contacted Netflix directly without having ever spoken to SentinelOne. When I contacted SentinelOne after the interview they said they couldn't even go on the record about the Netflix contract. Much love, Sucker at Forbes.

View on HN

Thomas, I suspect that thaumaturgy is responding at least indirectly to writing like this:

    In 2014, Lastline Labs discovered only 51 per cent of AV scanners were able to detect new malware samples.

Let's unpack this statement.

First, consider that for some definition of "new" you can get that number up to 100% or down to 0 (stuxnet). Second, the fact that over half of a crowded, very uneven field accomplish something really difficult is remarkable, and yet you use the word "only" as if all antivirus should detect modern threats. Third, you somehow manage to imply that it's rational to dump any AV because 51% of your options fail at doing something hard.

Perhaps I'm old-fashioned but I think reporters should work hard to avoid spin. In this case, removing the "only" and fully explaining what the take-away is (and isn't) would help a lot.

Can you say what prompted you to contact Netflix then? The article really reads like a love letter to SentinelOne, and includes some pretty odd bits that work well with their marketing for their endpoint product, like describing it as not an anti-virus product.

And what does "post-AV anti-malware" mean?

Sure. So it turns out Netflix is this really big company, and I met one of their security architects at Black Hat. I thought, hey, I wonder if they're up to anything interesting at Netflix. I'll give them a call.

A love letter? You send love letters like this to people? Are you like a post-modern Keats?

OK, so then you talked to someone at Netflix, and they said, what, "umm... well, we just replaced our anti-virus product with this other thing called SentinelOne that isn't really an anti-virus product", and then you looked at their site and called them and decided they totally weren't an anti-virus product? And that the real story here was that this was the death knell for anti-virus, or the beginning of "post-AV anti-malware", or something?

Clearly you have technical chops. But the most technical part of your article, concerning whatever technology somehow separates this product from the rest of the industry (let alone makes it "not anti-virus"), is this single line:

"Its end-point security doesn’t rely on signatures, it monitors every process on a device to check for irregularities and does not perform on-system scans or require massive updates like anti-virus..."

If SentinelOne is doing something truly new, something that merits coverage from tech journalists, it would be nice to read about it.

And btw, you said earlier, "When I contacted SentinelOne after the interview they said they couldn't even go on the record about the Netflix contract", which is an odd thing for them to have told you, since they have a Netflix logo and an official statement from them under the testimonials section of http://www.sentinelone.com/?show_epp=true -- wait a minute, in fact the quote from your article is a word-for-word match for the testimonial on SentinelOne's site: "The direction we decided to go was with a company called SentinelOne, who we’ve been working with for year and a half. They were a true replacement for end-point protection".

Your contact at Netflix must've been reading from Rob Fry's script...

See above.

I disagree with the statement that it reads like a love letter, but I very much agree that you should clarify what's meant by "the post-AV anti-malware game"..

It comes across as a wannabe-buzzword, and something of a contradiction. Further, I can't find any reference elsewhere.

Oh and post-AV anti-malware game: AV sucks and doesn't really do much to protect you against decent malware. Post-AV anti-malware systems do better.

Perhaps I'm just not privy to this terminology - but to me this sounds like "kernels suck, and don't really do much to run your PC. Post-kernel operating systems do better."

Calling it post-AV just doesn't seem to offer anything. That's what's making this sound like PR for SentinelOne - maybe they do have a better offering than anybody else, but drawing an arbitrary line (the 'post-AV' line, where everyone else is 'left behind in AV-land') doesn't lend any credibility.

For those below...

Another timeline: Reporter writes story, company sees story, takes it and uses it for marketing. This is a common occurrence across teh interwebz.

We could get into the nitty-gritty of what anti-virus is and isn't, but frankly I don't think we'll agree. Because what else is HN for other than to argue points ad infinitum until we all realize we've wasted a significant portion of our lives that should have been spent to more altruistic, worthwhile ends?

Reply on news.ycombinator.com