Hacker News Reader

Comment by nxc18 | Hacker News Reader

I don't understand how these antivirus vendors are still in business. Even when they do have marginally better detection rates than the built in solution, the licensing, annoying popups, system slowdown, and security-defeating 'features' make them a losing proposition.

Pre-bundled and even purchased AV is so dramatically deleterious to PC performance that MS should kill it as public service. It gives the entire ecosystem a bad reputation and nowadays is completely unnecessary.

View on HN

That's part of why I keep pointing new PC buyers to the "Signature Edition" program [1] where Microsoft does forbid pre-bundled AV on PCs sold through that program (at Microsoft Stores and participating Best Buys and other stores if you know to ask).

[1] https://www.microsoftstore.com/store/msusa/en_US/cat/categor...

I can't wait until retail stores start trying to charge more for signature edition. Pay more for less!

To be fair, many internet business models operate on the principle of paying to get less garbage (such as ads). And it makes sense from an economic perspective that if you're not being bribed by crapware vendors you'd want to recoup the opportunity cost.

It's hard to compare Signature Edition models directly to OEM direct models (because OEMs don't want you comparing store-to-store in most cases), but from what research I attempted it did seem like the Signature Edition builds I was examining cost roughly $50-$100 to their direct equivalent the last time I tried to do that math, which seems about what I'd expect crapware vendors are throwing at the PC OEMs to get their stuff installed. (It says a lot about the long term revenue expectations of the crapware vendors if the potential value of a single "trial install" might be worth as much as $100.)

They've done a wonderful job convincing the majority of people that anti-virus is something that you absolutely need, full stop. Once you have that ingrained in someone, they'll put up with all the annoyances.

> They've done a wonderful job convincing the majority of people that anti-virus is something that you absolutely need, full stop.

I think Microsoft did that for them by being so terrible at security for so long. Windows Defender came out 5 years after XP shipped and several years after average XP systems were riddled with malware.

Microsoft had a statute of limitations against shipping anti-virus with the operating system because it was "anti-competitive" according to the EU/DOJ anti-monopoly decisions. Anti-virus wasn't seen as a core security need for an operating system at the time, because the third party AV vendors fought hard for that and used the "Browser Wars" as justification to do that.

Then they should have made a much more secure operating system. You only need an AV if your OS has already failed.

Depending on your definition of "AV", of course, but: intrusion/threat detection is a need for every modern OS in some capacity regardless of how "secure" the OS is or not.

Even if you have the most secure kernel and no threat might ever escape user space, you'll still have pissed off users when they find out their stuff is all up for ransom or deletion.

"AV" is a component of a secure operating system, not an "add on" you only need for a "bad operating system".

If only!

No OS security can beat user stup^W cluelessness or accidental mistakes. Also, sometimes trusted providers get hacked and malware is distributed in disguise.

So literally every OS of any notable use in the world has failed then? Because I'm not aware of any widely deployed OS that hasn't had a successful exploitation written for it.

Most OS have some level of penetration, but it is so clearly not the same with windows. Even with the latest exploits free spreading viruses on android are rare but hook a windows machine up to the Internet without a router or firewall and get a virus in seconds.

Android easily outnumbers windows, by some counts 5 to 1, yet it has a smaller percentage and absolute level of malware installation.

The old truism of computer security arms race is bullshit. Computers that are secure from general mass spreading infections it not even all that hard (securing from governments is much harder). Simply ignore all incoming connections and don't execute downloaded data (or give to untrusted executables. The only hard part about this is making sure that network card drivers can be trusted, this isn't hard on most operating systems, but most windows users are totally at the mercy of some low budget buggy vendor.

Windows is well positioned to fail at computer security and they have done a great job at leveraging their position.

> Even with the latest exploits free spreading viruses on android are rare but hook a windows machine up to the Internet without a router or firewall and get a virus in seconds.

I don't buy this at all. Unless you are comparing Android with Windows XP?

First of all, you'd have to go out of your way to disable the firewall on a modern Windows install.

Secondly, there have been tons of Android infections: http://arstechnica.com/security/2016/07/virulent-auto-rootin...

I'm sure the percentage is lower than "all infected Windows machines" but I very much doubt it's lower than "all Windows 10 installations" or even "all Windows XP SP2 + Windows 7 + Windows 10 installations with updates enabled".

Nonetheless, it's definitely the case that an app sandboxing model provides some defence in depth, at the cost of reduced flexibility w.r.t. e.g. a real generic filesystem, ability to distribute/install without an app store, etc.

The Windows Security Development Lifecycle material is worth reading: https://en.wikipedia.org/wiki/Microsoft_Security_Development... https://www.microsoft.com/en-us/sdl/

Ultimately, if you were to allow Android devices to by default, open and run arbitrary native code that users download from the internet, you'd see the same host of problems (probably much worse for the average Android device given the fragmented OS patching nightmare).

>First of all, you'd have to go out of your way to disable the firewall on a modern Windows install.

There is a screen that pops up everytime you plug in a network cable or connect to a wifi network for the first time. It asks what kind of network you are on, personal, work, public. Depending on what you answer here it does stuff to the firewall.

Then there are the multitude of AV products that disable the firewall with their own suboptimal garbage. These wouldn't have been made if they weren't once necessary. Windows should have had a firewall when it got its own networking stack, but it went a couple of decades without one, so people got used to needing to add one.

Even if that article is correct it is Android off of windows by an order of magnitude.

> Ultimately, if you were to allow Android devices to by default, open and run arbitrary native code that users download from the internet

But they aren't setup that way. That is part of why they are more secure.

> I think Microsoft did that for them

I think you'll find nearly everyone in IT and certainly many public bodies, banks, utility companies and $deity knows who else, does that - recommend AV to all users.

It's pretty much a mantra for IT "cognoscenti".

Antivirus are just another attack vector - and due to their often escalated privileges running on a machine, they are a very attractive attack vector.

Not to mention the pitiful detection rate (<50%~ for nearly any antivirus software) makes them nearly useless: once you're pwned, you're pwned.

I agree with the anti-prebundled AV comment. I for one have even disabled Windows Defender on Windows 10. It seems to become just another way of Microsoft tracking you these days. Plus, it's not even that effective as an anti-virus, and anti-virus software is mostly useless as it is (for more tech savvy users).

It would probably be even more practical to kill Windows Defender on Windows 10 considering Microsoft makes updates mandatory now - if only it wasn't for the fact that Microsoft gutted its Q&A team and now Windows 10 updates often break your computer, forcing you to wait on the updates before you're sure your notebook can't be bricked or something.

It's also annoys me that Microsoft is tying its App Guard sandboxing technique to Windows Defender, when it's completely unnecessary, and it will only make it harder to separate the two in the future, if nothing else for branding's sake.

FWIW, I use Kaspersky in a corporate environment with > 250 Macs and I haven't seen any issue thus far. I've seen plenty of HDD failures, fan problems, Chrome hangups, general system slowness due to problems with corrupted preferences and other bening issues, but never ever seen a system slowed down by the AV.

I suspect the "corporate" version of a lot of these AVs are pretty different from the consumer versions.

>Pre-bundled and even purchased AV is so dramatically deleterious to PC performance that MS should kill it as public service.

Ah, so Microsoft would then take the responsibility for preventing malware, and by virtue of preventing the use of third-party solutions make it more likely that they'd be assigned responsibility if sued over losses?

"Microsoft takes its users' security seriously, and it recognizes that third-party antivirus vendors can exacerbate the problem by providing additional vulnerabilities that can be exploited by attackers. Ironically, non-Microsoft software you buy to keep you safe can make you even more vulnerable. To mitigate this, Microsoft is launching a site for white hat penetration testers to report vulnerabilities in antivirus software to a Windows security team, as well as the antivirus vendor itself. If no fix is pushed within 10 business days by the vendor, or a shorter period (at the discretion of the security team) for high-impact vulnerabilities, a subsequent update to Windows Defender will mark that antivirus vendor as insecure, and will provide users the option to disable or uninstall the antivirus software. Vendors requiring additional time to push fixes (for vulnerabilities which have not been exploited in the wild) may purchase a limited reprieve from Microsoft, revenue from which will be used to justify and support this service, as well as to incentivize vulnerability reporters."

Bam.

But muh antitrust!

I don't know why you're being downvoted; this is a serious concern other vendors bring up when discussing windows defender (or whatever the free solution is called). At first blush the situation is very similar to I.E. shoving out other competing browsers.

Ah, but that's only a concern if microsoft has serious marketshare in the market of antivirus. Do they?

If people follow the advice of security practitioners, Microsoft will end up with the majority of the market, yes.

Speaking of...

I started my Surface 4 running Windows 10 up last night. The batter applet in the task tray reported, once I started up Chrome:

____________________

"Chrome is is draining your battery faster

Switch to Microsoft Edge for up to %%% more browsing time"

____________________

(Evidently, this was first reported in July 2016 http://www.nextpowerup.com/news/29282/windows-10-warns-about... )

People with actual knowledge in security, and observing the absurd designs and subsequent holes in 3rd party AV products, are secretly wishing MS do that :p

There's no OS feature you can't say this about.

While I agree, that's the absurdity of arbitrary monopoly law, especially in the EU. (IANAL.)

This is not an actual quote. Using quotation marks for something you are proposing is highly misleading.

It's also a highly effective way to present something as coming from a third party, for comedic or other effect.

Reply on news.ycombinator.com