Hacker News Reader

Comment by AdmiralAsshat | Hacker News Reader

You ever noticed that these "secure" forks of browsers put out by antivirus companies are usually security trainwrecks?

cf: "Chromodo" and the vulnerabilities disclosed by this same researcher[0]

[0] https://code.google.com/p/google-security-research/issues/de...

EDIT: And let's not forget TrendMicro's recent blunder with the enabled-by-default HTTP server for "Password Manager" that is installed as part of their antivirus program.[1]

[1] https://code.google.com/p/google-security-research/issues/de...

View on HN

Which makes you wonder about the quality of the products they develop 100% in-house.

In the case of the browsers, it "only" the bits they tampered with that's more insecure. For their own stuff, anti-virus, firewall and what not, they've "tampered" with the entire code base.

Worse still, that stuff hooks into you OS at just about every level.

In my experience non-OSS security software is not worth having. There are some exceptions but they are exactly that, exceptions. More often then not by installing this garbage you are putting yourself in a worse position than not having it at all.

The (closed-source) security software Microsoft ships with modern Windows is quite good. I don't think OSS/non-OSS is the real dividing line, but rather motivation of the vendor is.

In the case of Microsoft, their motivation is to make Windows work better, in the case of OSS the motivation is often to scratch personal itches, both of these motivations trend towards positive results.

In the case of 3rd party security software vendors, their motivation is usually to upsell you from whatever version you are using to a higher level of "security", so it is in their best interest to go nuts with false positive reports (eg. finding some browser cookies in a scan, posting up such severe looking warnings that you'd think your system is rooted), bog your system down, etc.

Many AV vendors have national security concerns.

What gives you the impression that Windows Defender is any good? It hasn't had a consistently decent detection rate since 2012.

(See: https://www.reddit.com/r/YouShouldKnow/comments/40zh69/ysk_t... https://www.av-test.org/en/antivirus/home-windows/)

Personally I think Microsoft wasted their money with their built-in security software, and should have just ignored it. In fact, they're wasting money pouring resources into security patches. They should just leave security holes wide open until they feel like getting around to fixing them, if ever.

Think about it: all this stuff is costing them money, and that reduces their profitability. What is it gaining them? Nothing.

Why? Simple: if customers get pissed off, what are they going to do, switch to Linux or Mac? Maybe a few, but the vast majority will just put up with it and gripe and complain. They're never going to leave Windows, so it would make sense for Microsoft to screw them over.

Bitlocker and Applocker are among the exceptions, but I stand by my statement they are just that - exceptions to the rule.

The only AV scanner I've found that is worthwhile is Malwarebytes. Honestly, my mothers friend had got Norton Antivirus, so I installed it and ran a scan. Found 3 bits of malware. Then installed Trend's AV scanner after uninstalling Norton - found 2 more malware. Ran Malwarebytes - found 45 and removed them!

To be fair, I doubt they know the Chromium code base as well as they know their own (also why they shouldn't fork it.)

>Which makes you wonder about the quality of the products they develop 100% in-house.

You might be interested in reading up on tavis Ormandy and his adventures with Sophos antivirus. He was able to find several holes in sav with [allegedly] very little effort. Which was especially comical because they could be used to pwn Sophos' network firewall product which is used by enterprises.

I've lost weeks of my life to hacking around problems caused by antivirus software.

Oh, I got paid for the time, but which is more satisfying and looks better on my resume: "Hacked around antivirus bugs" or "Built a cool and awesome feature"? :-)

Here's my previous rant on the topic with specific details:

https://news.ycombinator.com/item?id=10248084

And a mention of one of the debugging techniques that was helpful here:

https://news.ycombinator.com/item?id=10250001

I know most consumers don't really care about this stuff until it bites them, but products like this are supposedly (I guess) marketed to consumers who care about security. I think it's worth it to be skeptical of claims made by any vendor, and ask some key questions:

- what changes have been made in the fork? - can I (or people in the software development community) see the source code? - what peer review policies are applied to changes made in the fork? - when (not if) something goes wrong, what policies and mechanisms are in place to fix it?

... just to name a few. No software is perfect. No engineer is perfect. There will always be bugs. There should just be an expectation that people will take reasonable precautions.

Reply on news.ycombinator.com