Hacker News Reader

Comment by gavinray | Hacker News Reader

Oh you need to fucking disable Window's Defender though, or add exclusions for your Linux distro/WSL2 folder, because when installing "node_modules" it will attempt to do realtime scans for threat-protection which absolutely cripples the speed.

https://www.cicoria.com/improving-windows-subsystem-for-linu...

https://www.reddit.com/r/bashonubuntuonwindows/comments/eok7...

"I noticed a significant performance difference after adding exclusions to the Windows Defender. My Rails server and NPM installs sped up dramatically (I mean like 4x faster, no joke)."

Stupid.

View on HN

This is nothing specific to WSL though, Windows has always had this problem. I expect there are many Windows developers who have no idea how much time they spend waiting for their code to be virus scanned every day.

Some IDEs have started warning about this performance hit. IntelliJ + Gradle for example, but I'm guessing other Jetbrains products do the same.

That's what made me aware of the problem. Now I need a comfortable gui for managing just those folders.

To give an idea how bad it is, building Firefox on a Threadripper 3970X on Windows takes slightly over 12 minutes if you don't disable Defender and somewhere around 7 minutes if you do.

What a horrible amount of overhead. Why does Defender need to scan the contents of a bunch of non-executable files? I suspect the answer runs deep and is at least somewhat horrifying.

because windows has no concept of an executable bit, so a rename could make it runnable? or a benign looking program has a built-in interpreter run code from external file?

> windows has no concept of an executable bit

Sure it does. Execution is a permission you can set in the security tab.

> a rename could make it runnable

This is more likely why.

> because windows has no concept of an executable bit, so a rename could make it runnable

This much I understand - but why can something so tightly integrated into the OS not instead intercept a file rename event and scan at that point?

I seem to be lacking sufficient information as to what specifically about Windows necessitates scanning everything on the filesystem when macOS and the various common Linux distros seem to do fine without it. It's not as if Windows is the only OS with interpreters, either.

Virus do abuse non executables like js, vbs, or whatever script file. Antivirus can't really know if it is the case without open it.

What is it about Windows that makes this a problem where macOS and Linux seem to be fine? The same mechanisms exist in all three major operating systems, which is to say that technically any executable I choose to run on my computer can load a file and interpret it.

Is it really just that Windows users download and run random junk? It's been so long that I've seen a virus of any kind anywhere at all that I genuinely have no clue how people become infected with them or indeed whether it still really happens at all.

It certainly feels to me that the era of random toolbars and clearly visible desktop malware is over, but at the same time I live in a different bubble than in the past.

It's possible you don't see random toolbars and malware now because Defender works. Microsoft could be smarter and offer default exclusions for some things.

If that was the default, wouldn’t it be immediately exploited?

But even file type that you think it is pretty safe (jpg, wav and some other media foramt) can abuse parser bug in viewers / explore.exe to result in code execution. And how do you prevent the malware just name its .js as .jpg and execute it with some interpreter? Some interpreters definitively don't care about file extensions.

> I genuinely have no clue how people become infected with them or indeed whether it still really happens at all.

I'm a bit late to the conversation, but can confirm that yes, people do still get infected.

We almost always turn something up while doing virus scans at the repair shop I work at, and we mostly use off the shelf products, along with a couple other tricks.

> Why does Defender need to scan the contents of a bunch of non-executable files?

While I agree the overhead is atrocious, buffer overflows and similar bugs can turn an "innocent" non-executable file into an executable, like this[1] JPEG file parser issue affecting a large number of applications using GDI+.

That said, I'd be surprised if it couldn't be smarter about this.

[1]: https://us-cert.cisa.gov/ncas/archives/alerts/TA04-260A

Try "every compile." If you wonder why your .exe takes a couple of extra seconds to start up the first time you run it after a build, well, this is why.

Tip: Add a separate SSD and format it as ext4. Mount it to wsl2 and do all your work there.

https://docs.microsoft.com/en-us/windows/wsl/wsl2-mount-disk

Currently, the mount is not automatic so you can make a startup.ps script and run it on start through group policy.

Ah this is a great tip, I will have to try this one -- thank you!

It may be a great tip but Windows users shouldn’t have to do this. Microsoft needs to fix their shit.

I see you this, and I raise you "the package repository I was mirroring contained an AV module that had a copy of EICAR in its test suite".

AAAAAAAAAAAAAAAAAAAAAAAAAAAARGH.

Oh god yes, I know this pain!

Thanks for this tip! I've already been running into Defender problems myself.

Defender kept trying to quarantine my Windows hosts file so I had to add it as an exception but then 3 weeks later it started doing the same to my WSL2 Ubuntu's unmodified hosts file.

I'm glad I opted for Ubuntu and manually installing tools that I need instead of using the Kali subsystem. I couldn't imagine the headache that'd have created.

Surely this is only a problem if your files live in the Windows filesystem (i.e. inside /mnt/$drive on WSL2)? I can't imagine Windows Defender scanning inside a disk image (/home on WSL2).

I was wondering about the same thing.

Why do you even need a Windows workstation as a Ruby or Node developer? That doesn't make any sense.

You don't need it but it's 1/3 the price of an Apple workstation and just runs with all hardware compared to Linux.

Plus, some people just like Windows and/or don't like macOS.

> runs with all hardware compared to Linux.

No, it doesn't. Linux runs on more architectures than Windows. Linux supports a wider range of machine specs than Windows does. There has never been an operating system in human history having hardware support as vast Linux. The television in your living room might be running Linux. Your refrigerator might be running Linux. Your car might be running Linux. Linux is everywhere.

When it comes to hardware support for laptops, the choice of distro is important. Enterprise linux distros ship with ancient kernels and you do not want to install that on a laptop.

Most hardware compatibility issues come from WiFi cards, and there are solutions for that other than looking for a driver and installing it manually. You can tether WiFi from your phone, or you can get a USB WiFi adapter for like $5 on Amazon.

Windows can run on ARM and x86(-64). Both are the widest used architectures for desktop computing. I don't want to develop on MIPS or Atmel.

> When it comes to hardware support for laptops, the choice of distro is important.

I don't care. I just want to develop my programs. Each minute I need to invest into searching for compatible hardware or drivers is costing me money or my free time.

I'm using Linux at home and on servers but for workstations I don't care for it, at all.

The question was specifically about workstations for Ruby and Node development. You're not going to do that on a refrigerator.

Reply on news.ycombinator.com