Hacker News Reader

Comment by the_common_man | Hacker News Reader

I have never heard of Carbon black... While researching this I also found that VMWare acquired heptio for 550m !? Wow. Isn't pivotal a massive company? It's value is just 4 times that of a 2 year startup?

View on HN

Carbon Black makes great malware that causes your brand new work computer to feel like its 1999.

Yup. You cannot get malware or run non-whitelisted programs if Carbon Black brings your computer to a grinding halt and eats all your battery.

I cannot emphasize this enough: the most amazing thing about carbon black is there are actually options that are worse in terms of performance impact (and much, much worse in terms of increased attack surface). There was a time I would not have thought that possible.

Corporate policy: also install CB on all VMs running too. CB inception.

Do not take your security team for granted. They're already doing more than most, sadly.

Agreed! I've gathered that it's a powerful toolset "if" tuned to your environment. But as a new midsize customer of CbDefense we've encountered many performance issues (many of them network file access related) with sensor v3.4. So rolled back to v3.2 but then found out that only Win7 endpoints could use v3.2 and Win10 requires v3.4... SMH

Where 'tuning' involves turning it off enough to drive a truck through.

My work computer currently locks up at a precise time once a week. It is either Carbon Black or Malwarebytes but I can't diagnose it as it requires a hard reboot. IT refuses to tinker with this sacred software.

You can try to blue screen it and debug the crash dump.

"Forcing a System Crash from the Keyboard":

https://docs.microsoft.com/en-us/windows-hardware/drivers/de...

It's CB. Google "Microsoft Driver Verifier" and use it, focusing on the memory tests. I'd wager a sandwich that doing so will cause a bluescreen within ~10 minutes or so, and that those bluescreens will stop if you remove CB.

At a large video game company I worked for we installed Perforce on the D drive because C drive was constantly scanned by carbon black among other things.

It makes my 2018 MBP run about as well as my 2010 model.

Yes! If not everything else, Carbon Black is the reason du jour to run away from Windos. Provided, your company allows the use of another OS.

Companies install it on Macs as well. It's pretty much everywhere.

Cylance at first used to be pretty good about not doing that, but they took a turn for the worst.

Looking for more anecdotal evidence, if you had to run an AV what would be the lowest impact?

To be fair, Heptio was really baller, and pivotal is not so much

Reply on news.ycombinator.com