this post was submitted on 23 Jul 2024
60 points (100.0% liked)
TechTakes
1489 readers
56 users here now
Big brain tech dude got yet another clueless take over at HackerNews etc? Here's the place to vent. Orange site, VC foolishness, all welcome.
This is not debate club. Unless it’s amusing debate.
For actually-good tech, you want our NotAwfulTech community
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I’ve always insisted that Defender is the best AntiVirus and Intrusion prevention solution for any Windows Machine.
MS has a vested interest in making sure nothing bad gets publicised about their OS. As long as the threat exists, (and barring regulatory restrictions) MS will maintain the best intrusion prevention and detection features.
The AntiVirus industry has a vested interest in scaring people into continuing to pay their subscriptions. There are even some conspiracy theories going around that some AV vendors actually pushed viruses into the wild that they could intercept but their competitors couldn’t.
Apple Computers have a reputation of not having viruses (even through they do) partially due to the Security/Obscurity myth and partially because they lock down macOS and have tightly integrated in-house virus detection. The other reason is that their user base is almost exclusively End-User Retail, which is not currently a profitable target.
i find the level of ms apologia unsettling. remember, we're only a few news cycles away from the time ms almost shipped windows with spyware and keylogger built-in
This is a unique situation because absolutely everyone involved deserves to go bankrupt and disappear into the darkness.
You have a closed-source OS that causes a vast swath of our infrastructure vulnerable to MSFT's whims and incompetence, and built on top a closed-source AV market that allows the infra to be extremely vulnerable in a second, unrelated way, plus the cross-product of them both since AV gets so tightly integrated to the kernel.
Until we can force MSFT to open-source Windows with a small military invasion of Redmond or some shit, maybe at least this will make people think twice before they install "anti"malware from an equally untransparent corpo straight into mission-critical infrastructure like a horny teenager putting his raw dog into a coconut.
yup.
also: it was microsoft's business decision to make the api required for av (or, more general security subsystems) to function so low-level that it has to be delivered as a kernel driver and operate in ring0. i guess it's primarily for the performance reasons, but still, there are other technical options. someone made the executive decision there.
on the other hand, it was crowdstrike's business decision to make the bloody update parser run in ring0, and without verification that the update data is correct, nobody forced them to do it that way.
let them both burn.