Hacker News Reader

Hacker News

Comment by buildbuildbuild | Hacker News Reader

Parent Full thread

buildbuildbuild

Cautionary note: many entities do not allow running Kaspersky software including this tool.

https://en.wikipedia.org/wiki/Kaspersky_bans_and_allegations...

View on HN

Or just read the 300 lines of python it entails

...and any transitive dependencies.

Or you can save yourself the time and say that Kaspersky have proved themselves untrustworthy over an extended period of time and just avoid it and take everything they say as probably either propaganda or marketing or both.

Even if you trust them, their product causes such extreme degredation of usability that one place I worked decided the cure is worse than the disease and removed Kaspersky from all its machines to the general celebration of all users. I was unaffected because I was the sole linux user so had been spared the Kaspersky virus on my machine.

That's a lot of accusations with few (no) sources.

According to the link you shared, it seems Kaspersky has been prohibited solely on governmental computer systems in certain nations which Kaspersky previously revealed as deploying malware against their adversaries, correct? I doubt many on HN work for those entities and besides I am not sure Python script fit the definition of Kaspersky software.

The US Federal government is the largest employer in the world, with well over two million civilian employees. Lots of people on HN are unable to use Kaspersky at work based on that prohibition.

A carve out for python scripts is a dubious claim.

It's a Kaspersky repository, it's 100% Kaspersky software. Not sure how the fact that it's a Python script changes that at all.

Good point but it's also a pretty small open source python script. Looks like everything is handled on-device in this case (at least at the time of writing this comment).

That doesn't necessarily matter to your enterprise device usage agreement.

Literal FUD. It's a 300 line python script.

I've committed to the US Government, in my own name, that I will not use or provide certain products. If you service a government contract that includes FAR 52.204 then you are agreeing not use Kaspersky products[0]. If you claim to be compliant and then have an incident where you've used prohibited products, the government can come after you with the False Claims Act[1].

There is no way I'm going to just download and run that script because I'm honest and I like not being in prison.

[0] https://www.acquisition.gov/far/52.204-23

[1] https://www.justice.gov/opa/pr/deputy-attorney-general-lisa-...

Written by some people whose code you are getting paid to not run!

On the plus side, since it's a 300 line Python script, you can read it (which does not involve running it), figure out what it's doing, explain it to somebody else in broad terms, and get them to write some equivalent code.

Someone is furiously converting this to Rust as we type.

300 lines is probably short enough to do it with a single 8k gpt-4 API call

A new variant of the "reimplement everything in the language du jour" game.

....with some not-so-standard dependencies like plistlib that you would need to check ....containing magic numbers, their own timestamp conversion for some reason, classic obscure cryptographer variable names (A = R[0] etc), use of pack and unpack, which reads and decrypts various random files, writes tempfiles[1] and does other things that are not completely straightforward for even someone who knows what they're doing to fully assess.

I mean it looks probably fine to me. But saying it's a 300 line python script is kind of begging the question.

[1] using mkstemp but you need to check that stuff to make sure. You also need to check what it does with the things it AES decrypts (they're just pathnames so again, probably fine etc).

FUD by other AV makers.

it's impossible to build any type of business in Russia without being tied to the state.

Same goes with other countries? Hint: prism and big tech.

And that means we should use and trust Russian businesses?

FUD stands for Fear, Uncertainty, and Doubt. But the comment you're replying to is a factual article that lists what entities have restricted use of Kaspersky software and under what circumstances. You may think that the arguments against Kaspersky are FUD, but this post is not.

I know very well what FUD stands for.. and there’s nothing factual in whatever links up there, it’s all allegations with no proof that resulted in a government ban

>There's no evidence that they have any back-doors in their software or any ties to the Russian mafia or state...

It’s just to happen that an NSA spy contractor was detected by an anti virus software that’s basically doing its job.

All AV software are technically malware to prevent other malwares, and old AV -including kaspresky, used to operate in an offline manner unless you update the local db, then things evolved to the need to have a cloud service to upload and analyze new suspicious files, in fact, the new ones -EDR- do more intensive tasks than AV by real time monitoring what the user does, analyzing the traffic, programs opened, forensics, and data collection for further analysis and immediately uploaded to the cloud (or the MDR), that’s part of its design, banning something because it did its job detecting a spy software IS a complete FUD only to happen that the business is in X country or an allegation that its CEO or founder worked in X.

If you are serious about security, using windows to start with shouldn’t be your first choice, but if you have no options in here and you have to use an AV, would you choose an AV made in the same country you are in (or in the same intelligence alliance like the 5 eyes/14 eyes), or would you choose an external one how you usually do with a VPN for example? At the end of the day, AV or even EDR it’s just another software that can be bypassed, exploited, and even targeted with zero day attacks, so base your personal policy about these facts and not outsourcing yours to NSA or some spy agency.

Its an open source python script that doesn't really fit that description

Do you think you would enjoy the process of trying to convince a court that their laws don't apply to python scripts? (they do, btw)

The fact you need to ask whether an open source python script needs a court to prove its a product and the lack of certainty is how FUD works.

- What if you fork it, edit it, re-publish it as yours? - And what if other anti virus vendors do this?

The fact that you think you can just handwave away legal obligations like this with common sense is certainly telling. It says you don't know what you're talking about. You could reasonably assert that the government's ban of Kaspersky's software is motivated by FUD. However the ban itself is very real, violating the ban can get you into a world of trouble, so warning people to stay out of trouble for violating that ban is not FUD.

Explained by analogy: Them: "Smoking marijuana can get you into trouble with the government." You: "That's just FUD, it's a harmless plant from my garden, it's not going to hurt me."

I just don't think you understand the laws deeply. You seem to indicate you know what you're talking about and I think you do, but your understanding is surface level, i.e it is someone else in your organisation who told you how these work.

So we pretty much love the closed nature of "Open" AI, and don't hesitate to send a lot of data to it, but we're suspicious about a small open source python file? In this context IT IS FUD.

Who's "we"? There are posts and comments here every day whining about "Closed AI".

the post was edited

Reply on news.ycombinator.com