Hacker News Reader

Comment by bonch | Hacker News Reader

It says right in the article that AppleCare doesn't cover what users do to their machines. Microsoft doesn't remove malware that Windows users install either.

This thing is coming from Ed Bott's Microsoft column on ZDNet, where he's been hitting this hard for the second day in a row based on an "investigation" that involved him scouring the Apple discussion forums for a couple of hours. Two hundred clueless posts on a web forum out of a userbase of millions doesn't mean there's a "malware explosion," as he described it. Why are people falling for this flamebait?

View on HN

> Microsoft doesn't remove malware that Windows users install either.

Yes they do:

http://support.microsoft.com/kb/129972/en-us

"Call 1-866-PCSAFETY or call 1-866-727-2338 to contact security support."

> Two hundred clueless posts on a web forum out of a userbase of millions doesn't mean there's a "malware explosion," as he described it. Why are people falling for this flamebait?

If Apple is issuing special instructions to its support staff about this malware, then clearly this is a pronounced problem.

Not only that but Microsoft has an anti-virus anti-malware application. AND as part of Windows Update they regularly run the malicious program removal tool.

And I suspect MS would ship antivirus built into Windows if they could. Unfortunately, antitrust makes packaging things that make sense a non-starter if other companies sell it.

Oh they absolutely would. Heck, Windows Defender is the same engine as MSE, they just had to limit its functionality to keep from getting sued. They were even threatened by the third-party antivirus companies when they promoted a link to MSE in Microsoft Update.

But hopefully they can take a more proactive course now that the DoJ's oversight is ending:

http://arstechnica.com/microsoft/news/2011/04/department-of-...

Huh? Windows Defender existed before MSE.

It would be great if they prompted the user to install antivirus on the first boot like they do with browsers in the special edition of Windows 7.

I'm sure it would be a mess, and some programs give a false sense of security, but it would probably be the best trade-off.

That works well with browsers because virtually all browsers are free. With antivirus McAfree and Norton will almost certainly complain if they're not included. And I suspect they'd propose they can host their 3-month trial versions. Yada yada yada... it's a lot messier.

Not only that, but Microsoft isn't a direct retailer, they're a wholesaler. If you have a problem with your machine, it's the responsibility of the person who sold it to you to ensure it is fit for purpose, not the upstream provider.

Apple is a direct retailer.

What happened to the microsoft retail stores? Did they close up already?

Update: checked Wikipedia, they have 8 stores open and two more in development.

Well, if you buy direct from Microsoft, then yes, they need to help you with their product. The overwhelming majority of microsoft products are bought through other agents, though (I was unaware they even had retail).

Not to mention that Apple is the only company to have started building a defence to the 'clueless user' problem,with the Mac App Store. It's going to become increasingly more difficult for trojan horse authors to convince users to install their non-App Store application, the more that people become accustomed to that being the way to install software on a Mac.

The Mac Defender malware is pretty harmless. It downloads as a zip file, and users must manually click through the entire installer just to get it installed. How many Windows viruses are delivered as a setup.exe where you have to click next about 3 times and enter your admin password just to install it?

As usual anti-mac trolls love to jump on the bandwagon and bash the platform with one of the best security track records running.

Most Windows viruses these days have the exact same attack vector, simply tricking the user into installing them. All we're seeing here is that: (1) Despite the marketing, the Mac is not magically immune to these things any more than Windows is, and (2) now that OS X has obtained a reasonable market share it's finally become worth attacking.

Neither of these things should be surprising to anyone, and hopefully the antimalware situation on OS X will improve before progressively more insidious Mac viruses are released.

By definition a "virus" does not have this "attack vector". A virus spreads with no conscious user intervention. This is a "trojan" -- something the user inflicts on themselves, and neither the Mac nor Windows have any real protection against trojans.

Mac OS X 10.6 has virus detection built into the OS. Only a couple of viruses are detected because, oddly enough, that's all that have been found. Again, "viruses" not "trojans".

Most "anti-virus" software is worse than malware on its own -- it slows down the computer it's used on. Microsoft Windows, out of the box, will shut down your computer without asking you, quitting out of applications on the way. This, again, is exactly the kind of thing malware does.

Well if you want to get pedantic, a "virus" spreads by infecting legitimate executables, a technique that hasn't been viable since the days of "Don't Copy That Floppy". In everyday use, the word "virus" is synonymous with "malware" and almost always refers to a trojan or drive-by.

The difference between a virus and a worm has become blurred, since both spread without user intervention. But there's no such blurring with trojans.

> and neither the Mac nor Windows have any real protection against trojans.

It is impossible for any operating system to prevent trojans. As long as the person at the keyboard has admin access, no matter how convoluted the process, they can install whatever malicious program they want.

The only defense is education and awareness.

I'm so tired of this strawman. The Mac was never "magically immune" to malware. Just because technically challenged people believe that doesn't make it true, and there is no reason for us to "disprove" it with great fanfare every chance we get.

But aren't Macs billed as computers for "technically challenged" people? If a large portion of them believe they are getting a "magically immune" machine, wouldn't it make sense to try to remind them that this is not actually the case?

Ironically, if they actually did believe that to be the case, the MacDefender trojan would have never been an issue.

> and hopefully the antimalware situation on OS X will improve before progressively

I don't think antimalware is anything I'd ever want to run on a computer I control. Unfortunately, I think we're being pushed into a world where all applications are vetted and purchased through a trusted marketplace, eliminating this vector.

> I don't think antimalware is anything I'd ever want to run on a computer I control.

Why not? I mean this as an honest question.

EDIT: If you're concerned about performance or system resources, try a PC with MSE sometime, I think you'll be pleasantly surprised at how unobtrusive good antimalware can be.

For my purposes, MSE has been a very large resource hog at inopportune moments. I've taken to shutting it down any time I do anything which touches a lot of files or simply consumes a lot of CPU - the speed difference is often easily visible.

This, for a product which hasn't found a single thing on any of my machines. Ever. It's great that they offer it, but it has been worthless for my use.

This may be a little snarky, but, as Homer Simpson put it: "Well, you bought all those smoke alarms, and we haven't had a single fire!"

For viruses alone, I had been running McAfee's business edition (my school provided it). That was generally far less of a resource hog when doing something that needed compute power.

Have you ever ran a windows machine without all this stupid virus/malware software running? It's dramatically faster. Anti-malware/virus software was a stupid road to go down, the proper solution is to have better security on the machine.

I run MSE, I barely notice it speed wise, and haven't had any malware or viruses.

On your comment: > the proper solution is to have better security on the machine.

Strongly disagree; if you look at this MacDefender issue, there is no flaw in OSX that is causing infection, users are installing it on their own accord. But what anti-malware/virus software can do here is warn or prevent the user from installing this in the first place, as it should detect the virus/malware signature.

This is why you need it even if the underlying OS is secure, to try protect users from themselves.

>I run MSE, I barely notice it speed wise, and haven't had any malware or viruses.

I run several things on both Windows and Mac. The Mac version feels a lot faster. If I shut off all the virus stuff the windows stuff is still slower but not as dramatic. It depends on what the code does, obviously. Any disk or network read/writes take a hit so if you're doing a lot of those it really adds up.

>Strongly disagree; if you look at this MacDefender issue, there is no flaw in OSX that is causing infection, users are installing it on their own accord.

The solution to this is what Apple has already started doing: provide just one place for these kinds of people to get software. Just buy it in the App store. That is the proper approach to "protect users from themselves", not put a 20-30% performance penalty on all Macs.

On the speed front, I'm talking specifically about MSE (that I don't notice it's affect) - I've had bad experiences with Norton grinding my PC down, horrible invasive product that one! Can't comment on Mac v PC speed impact.

I agree with you on the App Store front, think it will help to reduce viruses/malware (I think Windows 8 app store will be a huge win too), but it's unlikely that an app store will be the sole place to get software for some time to come. So until it's impossible to manually install software off the internet, I think we're going to need anti-malware/virus software.

I would leave it as is. After people get viruses from downloading software a few times and are told they should have used the app store they will switch soon enough. Virus software is a horrible patch that enables users to continue bad behavior.

That's a big and undeserved generalization.

I am totally on board with the fact that there are some programs that do this - Norton's suite of anti-malware programs is basically regarded as malware itself. And it even comes preinstalled on a lot of computers.

But other programs work without a hitch.

Flashblock (or AdBlock/Ad Muncher/NoScript) also slows down my browser, but I can't be annoyed at an infinitesimal allocation of my resources to the extension.

Invalid comparison. AdBlock is most likely using less resources than the ads it blocks. Virus scanners are overhead on all stream operations.

Because you can't really protect the user from their own stupidity.

Isn't there a windows defect (that coves all versions) that will execute a file just by viewing it in the file browser?

... the platform with one of the best security track records running.

Have you forgotten that Darwin is by and large derived from BSD? Apple is standing on the shoulders of giants with this one.

"[Bott] cited an internal document titled "About 'Mac Defender' Malware," which was last updated on May 16 and says that the trojan, which surfaced earlier this month and masquerades as legitimate security software for the OS X platform"

I find it ironic that Bott's fear mongering is leading the naive to download shady anti-virus software that is actually adware. These articles are really just contributing to the problem by misinforming people. Ed Bott is the equivalent of Glen Beck.

Ed 'Glen Beck' Bott is apparently more influential amongst non-technical Mac users than anyone might have expected!

I think that it's reasonable if Apple doesn't want to provide support for fixing malware problems on systems that they've sold regardless of how any other company chooses to handle such issues. Also, this issue is obviously independent of OS as the exploited security hole is the users' lack of understanding. That said, the reason that I thought this article was hackernews worthy is because Apple is encouraging employees to knowingly withhold information about malicious software running on users' computers. I personally find that to be an inappropriate approach in almost any situation. What are your thoughts on this aspect of the article?

Reply on news.ycombinator.com