You Don't Need an Antivirus (Except Microsoft's Built-in on Windows), Says Former Firefox Developer (ocallahan.org) 352
Former Firefox developer Robert O'Callahan believes that antivirus software is not necessary, AV vendors are of little help, and that you should uninstall your antivirus software immediately. From a blog post: Users have been fooled into associating AV vendors with security and you don't want AV vendors bad-mouthing your product. AV software is broadly installed and when it breaks your product, you need the cooperation of AV vendors to fix it. (You can't tell users to turn off AV software because if anything bad were to happen that the AV software might have prevented, you'll catch the blame.) When your product crashes on startup due to AV interference, users blame your product, not AV. Worse still, if they make your product incredibly slow and bloated, users just think that's how your product is.
hyper-v and don't install chrome extensions (Score:2)
i do all my porn and risky surfing on a VM on my main computer that i keep shut off unless i'm using it. and i avoid virtually all chrome extensions unless they are from someone i trust with a real corporate email in the contacts.
Re:hyper-v and don't install chrome extensions (Score:5, Informative)
Another benefit of using a virtual machine is just powering it off when you are finished and having it reset to the last snapshot. Every month or so apply patches and move your snapshot forward.
Re: (Score:2)
Just curious, does MS allow now for you to make a copy of your windows for a virtual machine as long as it's on the same machine or do you need to purchase to licensees for it?
Re: (Score:2)
It has been a while for you, hasn't it? They usually don't give you a Windows CD anymore when you buy a PC/Laptop so I couldn't tell you how to install the Windows version you paid for when buying the computer on anything...
Re: (Score:2)
Laptops generally come with a "media creator" tool to burn a set of installation discs. Some desktops, too.
Bonus - the toshiba tool creates an activated version of Win 7. That *could* be used to install many VMs, but I wouldn't know about that.
Re: (Score:2)
Burn your own install CD ... (Score:2)
They usually don't give you a Windows CD anymore when you buy a PC/Laptop so I couldn't tell you how to install the Windows version you paid for when buying the computer on anything...
Microsoft makes iso images available. The vendor probably provided a key some where.
Re: (Score:2)
Re:hyper-v and don't install chrome extensions (Score:5, Funny)
I do the same thing, except I have the song ~smooth operator by sade playing in the background when im in "secure" mode.
Re: (Score:2)
Don't some malwares infect hosts from VMs too these days? :(
IN SOVIET RUSSIA (Score:2, Funny)
...VIRUS CLEAN ANTIVIRUS
This is obvious even to AV vendors (Score:5, Informative)
The writing has been on the wall for a while now. You rarely get "just AV" when you install an AV product these days. You end up with a whole suite of value added applications like password managers, system optimizers, registry cleaners, web site scanners, IPS and content filters, etc.
The reactionary system we have been living in was never very good. Relying on signatures to detect malware is a fundamentally flawed system. As the operating systems and, more importantly, the applications that run on them become increasingly secure, the need for the signature-based AV systems declines.
Any AV software company has seen this coming for a long time. At least I would hope they have.
Re: (Score:3, Insightful)
Part of it had to do with running most users with administrative privileges, and Microsoft created this mess by making the systems hard to use if you didn't have administrative privileges.
I know people even today who turn off UAC the first chance they get because they are so annoyed by the prompts.
Re: (Score:2)
I ran a large shop when UAC first hit, and I immediately disabled it.
As you know, all it does is ask the nagging question, "Are you sure?"
My people were lawyers, paralegals, secretaries and staff.
They were never sure because the goddam thing gave them NOTHING to consider.
They would stop all work and get my permission to proceed, which was a smart move on their part. If things went sideways, ...
Re: (Score:2)
That's just not true. On their 95/98/ME line, yes. On their NT-based line, that is their more secure/multiuser/real variant of the OS, they've always enabled non-admins to have the features you would expect. Including, for example, installing apps only for their use, or installing apps that wrote to config files in the user accounts. When they released XP, merging the NT/95 lines, they released doc
Re: (Score:2)
"You can pry this OS from my cold, dead hands!"
Re: (Score:3)
Relying on signatures to detect malware is a fundamentally flawed system. As the operating systems and, more importantly, the applications that run on them become increasingly secure, the need for the signature-based AV systems declines.
I 100% agree with you. Unfortunately it is regulated industries that are keeping this crap afloat.
Security != Compliance
Re: (Score:2)
What decade and century do you think we're in?
Re: (Score:2)
Fully agree w/ this. In fact, for all the bellyaching over Windows 10, one thing they did right - put in the ultimate antivirus in Windows Defender, which comes w/ it. No more paying annual subscriptions to Norton, Kaspersky, ES-ET, Malwarebytes, et al
One of the rare good things to come out of this mess
AV Free for years (Score:4, Insightful)
Further, any software you install likely creates new security holes in your system. By installing an AV you are likely opening up more holes then you are closing.
There are three main sources of security holes:
1) Holes in the OS that the OS manufacturer needs to close
2) Holes in installed software that the software manufacturer needs to close
3) Holes in the user's general security intelligence.
None of those are solved by adding ANOTHER software suite.
Re:AV Free for years (Score:5, Informative)
Holes in the user's general security intelligence.
None of those are solved by adding ANOTHER software suite.
Not even whitelist-based security tools that allow only vetted applications to run? I thought that was the point behind Apple's App Store, game consoles' app stores, and the PC Matic tool for Windows.
Re:AV Free for years (Score:4, Insightful)
Problem with whitelisting is that it destroys your computer.
It's not a computer any more. It's an appliance.
Which is fine for people you can only trust to run an appliance, but it prevents anyone from programming aka becoming more productive.
It's a nice little racket - it guarantees the IT dept. a job (they were charging £2,000 to vet programs for distribution at my last place), it gives the "real" programmers more work, but it stops users reaching enlightenment and getting the computer to do what it's for - lots of repetitive tasks in an automated manner.
---
Aside from that, whitelisting software has been responsible for some of the more spectacular performance drops I've seen - like taking a process that writes around 30,000 files and increasing it's runtime from 2 minutes to 15 minutes, taking an operation that subject matter authors were doing when they felt like it and making it a tea-break thing, totally wrecking productivity.
iPad, PlayStation, and Jiffy Lube (Score:3)
an appliance [...] prevents anyone from programming aka becoming more productive [and] stops users reaching enlightenment and getting the computer to do what it's for - lots of repetitive tasks in an automated manner.
Which elicits a big "So?" from appliance fans.
The majority of the population do not read Slashdot. I imagine that most either A. use computing devices for entertainment rather than "becoming more productive" or B. prefer to outsource the programming to a specialist rather than "reaching enlightenment" themselves. For evidence of these, look at the popularity of iPod touch, iPhone, iPad, PlayStation 3, Xbox 360, PlayStation 4, and Xbox One. For evidence of preference of delegation to a specialist, look at th
Re: (Score:2)
With modern computers, I see no reason why this is an issue.
It is trivial to have a whitelist system that can be disabled for developers that want to program. Google Android does this, and I see no reason why future computers can't be setup this way either.
Re: (Score:2)
It is trivial to have a whitelist system that can be disabled for developers that want to program.
But it's not trivial to keep malware developers from social engineering naive end users into turning on developer mode.
Re: (Score:2)
I thought that was the point behind Apple's App Store
Just another trust model. You're giving up control over your system to some curator and trusting them keep you safe.
Of course nothing is perfectly safe [sophos.com]
Real Purpose of App Stores (Score:2)
First and foremost almost all app stores are about the company making money off of other people's products. Apple really showed this when they stopped applications from being able to buy things like ebooks. Apple wasn't happy because they were not getting their cut for doing nothing.
Then you have control. Again Apple shows this best with not allowing anyone to compete with their products and not allowing other app stores to function.
AV is a joke (Score:4, Insightful)
I started removing AV from clients computers years ago. All it does is slow your PC down. Every time I had to deal with an infection, the PC involved had AV, that was sometimes very hard to remove.
malware removal services should just be a tax on the easily confused.
Re:AV is a joke (Score:5, Informative)
Exactly. I do the same, if we get a new PC with commercial AV installed (usually some trial) it's the first thing I uninstall to installing improve disk performance by 50-100%. The Windows 10 built-in AV works fine and doesn't make a PC perform like it has a 5400rpm drive from 2001, instead of a modern SSD.
Re: (Score:2)
I don't mind the performance loss. It's the not losing files that I care about.
Kind of like how AV tools lock new files for scanning after creation, except that MS Office apps write to temporary files before renaming at the end, and a lovely little timing based issue then results in the locked files being synchronised causing you to end up with a corrupted set of .TMP files where your documents should be.
AV can go to hell.
Mind you so can Offline Files in Windows, it's equally buggy.
Re: (Score:2)
Re: (Score:2)
Windows builtin AV will NOT perform SSL/HTTPS inspection
That is one of the jobs of my firewall. Along with running a NIPS, doing regular firewall activities, DNS black holing for ads and trackers and being a VPN server. So why run it on my main machine when instead I can run it on a much more secure platform with a much smaller attack surface that then protects all devices I own.
The average user still needs AV (Score:4, Interesting)
Re:The average user still needs AV (Score:5, Insightful)
The average person does need A/V but the built in stuff that come with Windows is more than adequate. Signatures are really only good if they are nearly to the moment up to date and with the present rate of churn on the internet that model just does not really work. To the degree it does still work Microsoft does as good a job as anyone. Its the heuristic side where there is still some effectiveness but even the high dollar stuff like Cylance falls down more than it succeeds. They claim 99% and maybe that is true if you just grab random malware off the internet and throw it at their stuff. We did some internal testing with more recent exploit code from metasploit and what have become downright common powershell and rundll payloads; if all we did is make the most trivial modifications to them we saw more like a %2 detection rate, other endpoint packages did about the same as well.
Long story short A/V won't protect you from even a broadly targeted (hey I know these guys are using windows 8 because I Trojaned my "stat button" replacement app for windows 8/8.1, now I'll just wait and here and see how my hosts join my botnet) attack using updated tools. It certainly won't help you against an actual targeted attack.
Should everyone leave Windows Defender on, yes its free and MS has done a pretty good job making sure their own AV package does not foul up their own OS. I would NOT recommend any third party A/V solution at this point for individuals or SMBs. There might be some residual value in endpoint packages for larger businesses but there is an equal strong cases for going without and focusing on a systems management solution instead where you simply make sure everything is patched and you have tight control over what gets run. Unfortunately Applocker bypasses are fairly trival now so you do need a third party solution800,000 to take a true white list approach.
Ad Block (Score:5, Insightful)
*Yes, trusted sites can be comprised and it's happened in the past where downloads were infected but the odds that I'll download that software during that window where the infected files are being handed out are about the same as me getting stuck by lightning.
Re:Ad Block (Score:5, Insightful)
"YOU'RE KILLING THE INTERNET!"
Yeah, well the internet infected and killed one of my computers, so I'm going to be wearing an internet condom from now on. Besides, you can't tell me no one is viewing ads anymore when my aunt still is using windows XP.
"What websites were you LOOKING at that killed your comptuer?"
Oh the usual ones, porn, porn, yahoo, [washingtonpost.com] and more porn.
"You pervert! Use google instead!"
Re: (Score:3)
Re: (Score:3)
I'm sure they have more information than I do, but I suspect they're spending more money and losing more readers doing it than they would theoretically be gaining in the first place.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
"YOU'RE KILLING THE INTERNET!"
The internet was built to withstand a nuclear attack. I'm sure it can survive the loss of ad revenue.
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
There are firewall firmware available that can use the same blocklists APK uses, but they cover your entire network. Stop shilling for APK.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
You can block hosts at the firewall, you are not limited to just IP's. I think it's you that needs to take a refresher in compsci and networking. Your understanding seems to be a few decades out of date.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I always trust people this uninformed about the basics of networking when deciding on how to protect my network.
I agree with the summary (Score:5, Interesting)
Let's be real with ourselves. Nowadays the vectors for attack are easily protected so long as you use a modern browser that sandboxes itself and use an ad blocker you really don't need anything more than the built in AV and firewall tools for windows. I don't even think OSX provides an AV tool.
I haven't paid for antivirus software since 2005 which was coincidentally when I discovered Firefox and Adblocking extension.
I'll stick with the free tools.
Re: (Score:2)
There's one more requirement: Don't download MyFavouritePokemonDesktopPal from many-pokemon.software-site.no-really.latest-software.trust-us.com
Re: (Score:2)
It's amusing that the article has an update:
Perhaps it should go without saying --- but you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.
And how much is the check you're getting from Microsoft to shill for them encouraging "upgrades" to Windows 10? Or are you suggesting that Microsoft is deliberately failing to fully update Windows 7 in order to make it look less secure?
Re: (Score:2)
Windows 10 has some systematic security improvements that weren't backported to Windows 7. That sort of thing is often hard to retrofit without breaking stuff.
I spent fifteen years of my life working on Firefox, fighting Microsoft tooth and nail to stop them from taking over the Internet. Nowadays I' work on debugging software that only works on Linux. So no, I've never been Microsoft's shill or anyone else's. But people running up-to-date OSes is in everyone's interests.
Duh (Score:4, Informative)
AV products actually make you less secure. They act as a MITM, replacing certificates with their own and totally defeating the purpose of TLS/HTTPS.
Re: (Score:2)
Without using a MITM proxy, how else is the operator of a home or organizational network supposed to cache public images, scripts, style sheets, and other resources, so that multiple devices on the network don't have to redundantly download the same resources over a slow and/or capped connection to the Internet?
I have had no issues (Score:2)
With Malwarebytes and BitDefender. I don't go for the big all-in-one "security quites", so the simpler approach works great for me.
Re: (Score:2)
I only use my Windows installation for games, nothing that actually matters.
APK (Score:3)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Not used an AV in the past decade (Score:3)
I find that SPI firewalls, execution prevention, careful permissions for limited users, NoScript and other tools are far superior to an AV.
Liberal OS policies and platforms are not ideal for anything you;d hate to lose. Often you would not know that something malicious is running.
With multiple layers of security on a system that does not change often you can have fine grain control of anything. An odd internet connection attempt, a never heard of before program attempting to run etc -that reasonable easy to catch.
AV vendors have been packaging (shoving) everything included as soon as they realised AVs are done. Unfortunately the desktop class products are often more trouble than they are worth.
That being said, I still advocate the complete security packages from AV vendors for users that know little being logging into facebook. They are clueless and could not manage a complex system a "security suite" type program is their best bet.
Re: (Score:2)
I find that SPI firewalls, execution prevention, careful permissions for limited users, NoScript and other tools are far superior to an AV.
You're confusing AV with other types of security software. They all have a purpose for computer security but they all do different things to help with that. They are dealing with different attack vectors.
My solution: Linux+AdBlock+hosts (Score:2)
I run Linux, a browser with ad blocking, and a hosts file with 94.5k entries (for shady sites) that redirect to a dummy IP.
Well (Score:2)
You're credible why? (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
> a browser whose development team ... took an ivory tower position of something along the lines of "you shouldn't have your browser open that long."
That never happened. You just made it up.
Depends who "You" is (Score:2)
Of course, I know what to click and what not to click. I know to examine dialogue boxes and have critical thinking skills to evaluate the website I am d
What's an antivirus? (Score:2)
I've never needed one.
Then again, I run Linux.
Summary omits crucial exception: Microsoft's (Score:2)
Original poster here.
My post says "Except Microsoft's", right in the title. I think that's important. I believe that Microsoft's Defender stuff is probably less bad than the other major players and worth having enabled for average users. Unfortunately that's been left out of the Slashdot summary.
Re: (Score:2)
Oh, and I also mentioned in the post that you'd be better be using a fully up-to-date OS and browser.
Endpoint protection is more than AV... (Score:2)
AV is just part of the reason that we use SEP. It also allows us to do things like control access to USB devices, lock down which processes can be ran, etc.
I agree that the traditional AV portions of the product have questionable utility.
COMPUTAH (Score:2)
Why do I need antivirus on the thing I use to start Steam? We mandate antivirus on our work computers, still hasn't stopped cryptolocker from encrypting stuff on network shares.
MSE is licensed only for up to ten PCs (Score:2)
That and organizations with more than ten PCs running Windows 7. The last time I checked, the built-in AV on Windows 7 (Microsoft Security Essentials) was licensed for use only on up to ten PCs in an organization, after which the organization is expected to either A. buy the appropriate Windows Server license and the appropriate Microsoft System Center 2012 Endpoint Protection license, or B. upgrade to Windows 8 or later where MSE was integrated into Windows Defender.
Re: (Score:2)
Re: (Score:3)
I think most of us have been bit too many times by the bloat that products like Norton AV and McAfee represent. Norton in particular is just a resource hungry monster, and as a good many of the machines in our organization are about seven or eight years old, the idea of putting that kind of CPU cycle ravisher on them fills me with horror. In the end, we upgraded to Windows 10 (a rather mixed experience), and just used the built-in Windows Defender plus a pretty locked down network and good backups so if, so
Re: (Score:2)
Re: (Score:2)
always use an ad blocker
How will this remain practical once more sites follow the lead of WIRED and The Atlantic and start showing paywalls to ad blocker users? If you view one document on each of 20 different sites in a month, would you find it affordable to buy a $4 per month subscription to each of these 20 sites?
Re: (Score:2)
Sites that require an exception in ad-blocker or a subscription are also sites that are unable to afford to be reckless with the advertisers they allow on their site. It's really about placing the responsibility on the site to make sure they are not serving up malware in ads.
Re: (Score:2)
Well, either you stop reading those sites, or you wait for adblocking to catch up. This is an arms race, and I am not about to give total control over my computer and my internet connection to an industry that has such a bad track record. A few articles are just not worth the annoyance and risk.
Re: (Score:2)
if you put up a paywall or block adblockers, you lose my trust and my readership.
If the majority of an online publication's readers run an ad blocker, how would you recommend that it keep its servers on and connected to the Internet and a roof over its writers' heads? After ads and subscriptions, what is the third funding model?
Begging? (Score:2)
Unobtrusive ads
I'm told that ads wouldn't be obtrusive if unobtrusive ads brought in enough revenue to continue operations. Advertisers are willing to pay far more for obtrusive ads, and switching from obtrusive ads to unobtrusive ads might cause your favorite site to bring in so little revenue that it has to stop responding to HTTP requests.
and asking nicely for people to turn off the blocker
This sort of "begging" is reported to have anemic results [blockadblock.com].
The ads shouldn't [...] track me.
The only ads that can be proven not to track viewers are ads hosted by a site itself. And those have a far lower revenue per
No JS, no article (Score:2)
Use a script blocker instead of an ad blocker, and only whitelist the main news page.
Their answer to NoScript is to make everything past the abstract JavaScript-dependent [blockadblock.com].
Re: (Score:2)
If you're commenting on a Slashdot story whose featured article is from one of those sites, other Slashdot users are likely to berate you for being uninformed on grounds of not having read the article.
Re: (Score:2)
Also, don't go to any sites with ads as they're a significant virus vector.
But wait, you're here so use an ad blocker.
But wait, some have been paid by ad co's to allow their ads. Including infected ads.
Now keep a list of which ad blockers, AVs, websites, official emails, are good. This week.
Re: (Score:2)
Instead of using an "ad blocker" that tries to be smart, I use uMatrix to block everything except what I specifically choose to whitelist.
Re: (Score:2)
Don't visit porn sites either. Its not hard...
Well there's your problem.
Re: (Score:2)
All you have to do is limit your browsing (stay away from porn/downloads)
Is there a reason that erotic videos can't be made safe? And if you have a gaming PC, how do you obtain games other than through downloads?
For the last 10 years I've had a laptop that I've used solely for web browsing/anything we based... and a gaming PC that only connects to the internet for games
Or just abandon the PC platform entirely: do non-gaming on a tablet running a smartphone-derived operating system, possibly with a Bluetooth keyboard, and use a PlayStation 4 for gaming.
Re: (Score:2)
By 'downloads' I was referring mostly to friends that still torrent a LOT of music/movies, and are always having problems with malware, etc.
Has there ever been a noticeable attack using corrupted music/movie files? I mean ".mp3," ".avi," etc. - Not ".mp3.exe," or ".avi.zip."
Re: (Score:2)
Off hand I can remember an attack on GStreamer's support for Super NES audio [arstechnica.com]. The interpreter for the Sony SPC700 had some serious bounds checking defects, allowing a program running on the emulated SPC700 to manipulate host memory.
Re: (Score:2)
What's better: a bunch of applications that you can run inside your web browser, or a bunch of applications that you can't run at all because their developer's computer uses a different operating system from your computer?
Re: (Score:2)
Re: (Score:2)