Hacker News Reader

Comment by chad1n | Hacker News Reader

The real thing I've learned from this is that most malware doesn't get ring 0 access, but these "antiviruses" solutions can shutdown the whole critical infrastructure everywhere. I've never seen malware that infected millions of devices in seconds and made them unusable for days and maybe weeks to come.

View on HN

Giving someone else [edit: remote] root access to your computer is a bad idea. For Windows users it is bad enough with Microsoft. Adding another one is just adding to the risk.

Centralizing power is asking for abuse.

So this is an argument for only using first-party (Microsoft) security software?

Ye I guess so. I'd argue to use some Linux distro though to remove the root remote code execution CVE.

You can buy RCE malware for Linux too - including crowdstrike. If you want a third party to manage your systems then it doesn’t matter what third party you choose

Personally I’d go for diversity over any specific solution. That’s a rare thing in “enterprise” world. I suspect companies with strong shadow IT which provides business value for far better than those top down enterprise led ones.

I'd rather[1] give "Microsoft and only Microsoft" the ability to remotely update my system, than "Microsoft and whatever fly-by-night 3rd party 'security' companies manages to sell their malware to my boss."

A big problem here is that Microsoft has normalized the idea of rando third-party software having access to ring 0 and things running at the kernel level. This is one of the reasons many Linux people argue against opaque third-party blobs running in the kernel. This should not be as routine as it is in the Windows world. Apple wisely ditched kernel extensions.

1: EDIT: Ideally, I'd rather Microsoft not have access to remotely update my system, either, but that ship seems to have sailed long ago.

That's every kernel driver. Microsoft is slowly moving drivers to user space (most USB drivers, audio drivers, printer drivers, ...) but it's a long walk.

And you are still left with the GPU drivers.

Ye I meant remote. Sorry for the unclarity.

> And you are still left with the GPU drivers.

It'll be interesting to watch how nVidia responds to this move. Their drivers are black magic at the moment.

How much of GPU drivers are left in kernel for Windows? Updating GPU driver or having desktop crash on Windows and it recovering reasonably seems common enough experience.

>Centralizing power is asking for abuse.

Not particularly. Whatever you do, it can be (will be?) abused. Centralizing power means that a centralized power abuse will happen, like in the case above. In a distributed power system, an attack could occur that targets most entities successfully, but they won't respond efficiently because of lack of centralization. Like computer viruses in the old days.

'Being ignorant is not so much a shame, as being unwilling to learn.'

Back in the day, you could install windows XP and be infested in minutes https://en.wikipedia.org/wiki/Blaster_%28computer_worm%29

Sasser, too.

not millions but lookup shamoon. Wannacry was at 300k+ machines, it wasn't millions because one guy registered the kill switch domain within a couple of hours.

Ring 0 is bad but malware do get SYSTEM all the time, they can inhibit booting at that point just the same.

Blaster infected millions, among Sasser.

I saw it a couple of days ago…

Most people do not (deliberately) give malware root access to their PC

Depends what you consider malware, apparently.

Most enterprises do

> I've never seen malware that infected millions of devices in seconds and made them unusable for days and maybe weeks to come.

Yes, well, that's because we have built much more resilient systems, of which anti-virus is a substantial part of. You could start with the Morris worm, but a more recent example would be the Stuxnet cleanup efforts (largely done with AV).

AV is (thankfully) becoming less and less relevant, but it's still a valid layer of defense for many platforms.

Yeah, this logic is absolutely deranged and 100% stems from a hate of forced AV on work machines or something.

Pretty much every common modern-day security defensive is reactive, in that you can point to a point in time where we didn’t have it, and can pretty easily see the consequences of that.

Reply on news.ycombinator.com