Hacker News Reader

Comment by jswinghammer | Hacker News Reader

I don't understand why people install antivirus software on their machines. I read once that their catch rate is something like 20-30% which strikes me as no better than 0% for all the good it does most of their customers. It just seems to slow down computers a lot and yield little benefit other than protection for the IT staff when things go wrong.

I could make antivirus software that does nothing and probably make people happier by virtue of the fact that I'm not taking their system's resources.

View on HN

You read Hacker News, which means you probably know more about computers than at least 99% of the population, and far more than 98%. Seriously, consider that.

Take something you don't know about. For me it's cars. If prevailing wisdom was that unless you bought some $40 item for your car, it could easily be stolen, you'd probably buy it right?

This is what people are told: Windows is insecure and anyone with a clue can just steal your credit card number. I know that if I just don't install crap from the internet, and have a reasonable firewall, I'm not going to get a virus. I haven't had antivirus in over a decade, though I've run some web-based ones on occasion to check, and have never had a problem. I know that, and you know that. My dad (who is much closer to the other 98% of the population) doesn't know that.

(As for corporate use, you answered your own question. IT staff installs it for no reason other than to be able to prove to their boss that it isn't their fault when stuff goes wrong. )

> If prevailing wisdom was that unless you bought some $40 item for your car, it could easily be stolen, you'd probably buy it right?

Oh, you mean "The Club", which slows down a car thief by about 10 seconds ;)

For the IT staff, the fact that your computer slows down is an externality; it is not their problem. If the anti-virus can catch a few viruses and doesn't result in many help-desk tickets, then it makes their lives easier. Cleaning up a virus is a tedious task, as even a simple re-imaging can take a while, and that's if you can use a standard image.

They also don't know how smart their users are. Some of them are great, and might read HN, but others will go download any game or smiley pack they can find.

If IT staff were paid based on how smoothly the computers run, they might have a different opinion. Their current goal is usually just to make sure it runs at all.

> Their current goal is usually just to make sure it runs at all.

Indeed. I'm the lead of the "IT Staff" at a small non-profit (~70 users) running mostly on second-hand desktops. Two-thirds of our staff is unpaid, usually interns who are here a few days a week for 3 months, and then they're gone and someone new takes their place. Training proper computer behavior is hard.

So... we run A/V (not McAffee), because we have to. We also lock down the systems hard, not because I think that's a nice thing to do to your users, but because we have to. Imaging all these different desktop models is difficult, and we have very limited resources for doing re-imaging/re-installs/virus cleaning/whatever.

My goal is to enable you to sit down at your computer and be able to perform your job. A 20% performance hit on all computers is worth it if it means that 20% of the computers aren't down for maintenance. :)

There are a couple of ways to address the virus problem besides installing anti-virus on Windows.

Here's a few things I'd consider if I wanted to run an office with minimal computer support:

  - run the LTS Ubuntu instead of Windows
  - maybe run OS X, on Mac Minis if buying new hardware
  - install one Windows terminal server for critical Windows-only software
  - lock down firewall to permit only whitelisted web-sites
  - run locally hosted (I believe this is possible) Google Docs as office software

Windows virus problems, people surfing Facebook, porn, you-tube, Twitter etc., will suck away time in an office if you don't get some kind of a handle on it. I hate offices where stuff is super locked-down, but put in charge, I'd want to screw things down pretty tight.

Obviously developers, salespeople might be somewhat of an exception... it's a hard call to make.

Or you could just install the free AVG, the cost is zero (if money is what worries you), the impact on performance is negligible (I do photo and video processing, the antivirus doesn't seem to make Vista slower than it already is), and it's definitely better than nothing (caught a few cockroaches trying to sneak into my system already).

But what do I know, my laptop is running Ubuntu, my primary desktop has always been Linux since 1997.

I don't understand how even having a 20% detection rate isn't better than 0%. Am I missing something? Are there a lot of viruses popping over the net that even the 20% detection is already too late?

Given the cost in equipment purchases, user annoyance, lost productivity and purchasing the software itself it strikes me that you need much higher success rates to be worth all that.

The 20% figure that was "once read" about is pure fiction. Any up to date test figures reveal something closer to 99.8% of a 3 million sample testbase for the better AVs.

It's all a bit moot though as before this happened, McAfee was probably worse than anything a PC can get infected with. Now it's gone and proved it beyond any doubt.

But that's totally meaningless!

Think of it in another way, at any point in time you have x number of virus that you are likely to come across through whatever means. If all those viruses are in the 0.2%, then the catch rate isn't going to be 99.8% it's going to be 0%.

So being able to catch 99.8% of 3 millions viruses when new ones are released all the time is a pointless comparison for efficiency.

20% is totally meaningless as well, but you posted it.

No, he didn't. But that doesn't change his point.

The 99.8% includes a known test set for historic viruses from the 80s and 90s. The stuff you really care about are the new things that sweep the web (Blaster, Slammer, Code Red, etc.). AV is inherently reactive, and that .2% you miss is likely the latest stuff.

Old (meaning a year or two) viruses are still around, and can still do a lot of damage. A large part of the reason they don't is because people run virus scanners that catch them, and stop them from spreading.

Well, I mean, patching...

Reply on news.ycombinator.com