Hacker News Reader

Comment by silviogutierrez | Hacker News Reader

I'm currently picking the OS stack for all machines at my company. All guidance, even people I respect, point towards antivirus protection. Yet I lean towards nixing that. I know it's hugely ineffective. In fact, it opens up holes of its own[1].

And yet... it's like scaffolding in NYC[2]. Absolutely useless[3]. But if you are all for removing it, and a brick falls and hurts someone, heads will roll. Quite a quandary I - and other C-levels - face.

[1] https://www.computerworld.com/article/3089872/security/secur... [2] Another contrarian passion of mine. [3] Bricks do fall and hurt people. But no more than scaffolding itself falls with the same effect.

View on HN

I would recommend against antivirus. If you force developers to use an annoying configuration of a specific OS, you make it much harder to hire top talent. Why would someone work at your company when they could go to Google and use their favorite Linux tools running on their favorite model ThinkPad?

It totally makes sense to lock down machines that can access production, but for development? Just let people use what they like. You'll have less work for IT, happier developers, and an easier time recruiting talent.

Microsoft Defender typically doesn't hurt performance or security much. The alternative is to run Mac or Linux stacks instead of a Windows stack, of course.

Microsoft Defender destroys WSL performance unless you create exclusions.

Then there’s NTFS behind that. Just use a VM. Ten times faster.

For what I am using it for, a VM is not faster than WSL. Maybe in the early days, but not now.

Ten times faster at what? Do you have any benchmarks?

Writing and reading lots of small files on disk. Which is basically what 90% of Unixes are.

While running a Linux stack may still work, your Mac info is outdated by three years, at least. Macs have entered the zoo in 2015.

For practical purposes, that's not true.

Macs do not allow running unsigned software by default, and no one runs antivirus on Mac, ever. So even if they were commonly being infected, which they aren't, the person above would have organizational indemnity if someone were infected because they're following industry best practices by not running antivirus on Mac.

If you want, you can further restrict Macs to only App Store software, which is heavily sandboxed. Then you can go even further by not allowing the individual users to install software on their own, if you really want to be draconian about it.

Unless someone is being individually targeted, running very outdated software, or is intentionally trying to get themselves infected, it will not happen. Even if all three conditions are true, it's still very unlikely.

Anyone who says otherwise is just fear mongering. That same level of fear mongering could point to the dozens of pieces of malware that have been released for Linux.

I say this as someone who uses a Linux laptop for work and a Windows desktop at home. I don't have a dog in this fight. I do, however, try to stay very informed about the state of software security.

> Macs do not allow running unsigned software by default, and no one runs antivirus on Mac, ever.

My company-issued MBP is running something called "Cylance Protect" (and "TrendMicro" earlier). And also something called "Forecpoint DLP". I have no control over any of that, software just appears and disappears. I think it's done by something called "Jamf".

I don't really care either way. The only thing I actually use on the Mac is Chrome for email/calendaring/vidconf and some intranet sites. Actual work is all on Linux servers via ssh (and even that has "ClamAV" antivirus running). So I'm just using it as an expensive terminal/chromebook.

It sounds like we might work together; the only difference is that I do most of my dev work on my MBP so I consider it an expensive Linux machine instead of a chromebook :)

Haha I just made another comment to a similar effect. We had McAfee but I stripped it out because it was just so terrible.

We also have the Forcepoint nonsense.

> and no one runs antivirus on the Mac, ever.

Working at a large company (also not one of the famous silicon valley tech companies) and if you get a macbook, they are managed remotely and have BitDefender installed.

I sometimes forget how much big companies enjoy spending money. I once worked for a large company where every developer was issued a full copy of Microsoft Office, even though most of them worked inside a fullscreen Linux VM all day. Outlook was the only piece of Office that my coworkers and I used, and I would have been happier using a tab open to a webmail provider inside the VM than having to use Outlook to connect to Exchange. That was far from the only unnecessary software they paid for. Why use Git when you can pay for Perforce!

If you're working in the game industry, and your repository includes a lot of huge binary files that are mergable, perfoce is a godsend.

Also, p4merge is the best merging utility for any VCS, and I always install it alongside git if I work in Windows.

>p4merge is the best merging utility for any VCS

What makes it "the best" ? Honest question, i found it kludgy and settled for Kdiff3.

p4merge is indeed awesome. I work exclusively in Linux environments, but p4merge always gets installed. The experience has actually gotten better in that regard since git started supporting it straight as one of its 'mergetools'.

> every developer was issued a full copy of Microsoft Office

Enterprise volume licenses. It probably cost them less than the time/money they'd lose if you spenta few minutes trying to figure out how to open some file sent by non-devs.

> Why use Git when you can pay for Perforce!

Nice graphical tooling and sane developer experience.

I consider perforce "views" to be burdonsome and not so sane. The rest of the experience may be less jarring than git for many.

Why use Git when you can pay for Perforce!

Perforce integrates very nicely with a whole bunch of third party tools in a way git does not, and is on the whole a lot easier to use for most people than git (and I'm saying this as someone who doesn't like Perforce at all)

Really? My experience is the opposite - all the tools integrate with git, not perforce.

Said as someone who likes perforce. Having hundreds of developers working with large binary files was incompatible with git until very recently.

I would have to echo this, no problem with perforce, but sayings its ecosystem of plugins is more viable than git?

Maybe 5+ years ago?

In many enterprises you are only allowed to connect laptops into the network if an anti-virus is present, that includes company issued Macs.

And this is why I used to have a laptop in my drawer I used for logging into the proper intranet, booking holidays and organising my pension.

All my actual work was done on Unix/Unix-like machines on our own old network, something we clung on to after acquisition.

The privilege escalation vulnerabilities that have been found in Mac OS in the last few years have made me distrust its security. It's not like Apple can't create secure OSs (see iOS), they just don't seem to care nearly as much about macs. All the "security" changes (that I've seen) they've made have been implementing an iOS-esque walled garden with the premise being that trusting Apple is better for security (which is probably true, but I think many users will turn these limitations off as soon as they hit them).

I used to really like Mac OS X, but nowadays it feels much less polished and much more annoying. It might just be nostalgia, but I remember Leopard being more responsive and having fewer pop-ups (Screw you, iCloud! I don't want to synchronise my files!).

Being individually targeted is a possibility if you work for a high-profile or important software company

Additionally, not sure about you, but the reason I like to develop on macs is due to the fact that I can test nix software on them. That means I am installing and running nix binaries either via browser or through package managers such as pip. There is absolutely a non-zero risk that Linux malware will somehow find its way into my development environment. I am not trying to fear monger, as I do believe macs are still generally the safest, but don’t let them lull you into a false sense of security

> and no one runs antivirus on Mac, ever. Work at small company. Have Eset NOD32 on all Macs. It is possible to install non-signed software (I sometimes install development tools from small companies who do not have signing cert, if I'm comfortable with their reputation). It's also possible something could sneak through in a PDF, Word Doc, homebrew/ports install, etc.

>Macs have entered the zoo in 2015.

What "zoo"?

To this day, Macs are practically virus-less, which they always where (99.999% of the scares in the media were for trojans, and even those at worse affected something like 1-5% of the total user base) -- nothing like the good ole Windows (XP and pre) days where after 1 day surfing the web you'd have a few viruses.

And of course if you go with the default options (gatekeeper, signed packages, etc) you have even less to worry about.

It's also not about "market share" -- Macs had 1/4 the market share they have now in 1990-1997, but there were tons of viruses for them under the old OS.

It's not like the original (pre-many security features were introduced) OS X was specially hardened or anything, but it was much more secure than Mac OS and the old Windows versions just by having a basic UNIX-style design.

> To this day, Macs are practically virus-less

Exactly what I'm talking about. Not to this day, but to some time back in 2015. Right now any trojan toolchain on the black market comes with a Mac-targeted package.

Trojans always existed. But trojans aren't viruses, and if you don't get your stuff from shady websites you don't have much to worry about (and if you just get signed and sandboxed App Store stuff, even less or nothing to worry about).

I believe you mean “finished” not “out of date”.

Actually I chose my words carefully. Even though malware guys have started targeting Macs about three years back actual infestations are uncommon.

>>And yet... it's like scaffolding in NYC[2]. Absolutely useless[3]. But if you are all for removing it, and a brick falls and hurts someone, heads will roll.

This is a question of shifting liability and sharing responsibility. If a brick falls when you knew the facade needed maintenance, then the liability falls solely on the building. If the scaffolding falls, then the liability is borne by the scaffolding company, or at least shared.

If people you respect are pointing towards antivirus protection, you might also want to inquire whether they are saying this purely out of technical reasons (i.e. surface attack area, which could be debated), or if there are financial risk management factors tipping in this direction.

Since you're picking the OS for everybody in your company, which presumably includes multiple departments and staff who are non-technical, it seems like madness that you'd let them run amok without some level of antivirus.

But -- leave the poor developers alone. One hopes that the company was capable of hiring technical staff practicing basic day-to-day security hygene.

Eh, I’d like to see some data on NYC scaffolds. They do collapse and hurt people, but the sheer volume of pedestrians and construction work makes me skeptical that it’s just as bad to have them as not have them. Not to mention the fact that it gives construction workers a way to not block the sidewalk with equipment and personnel.

Keep in mind the reason guidance exists for products that aren’t really all that necessary is largely due to the massive sales teams behind those products, plus (as you mention) cover-your-ass concerns

Reply on news.ycombinator.com