Guru3D.com
  • HOME
  • NEWS
    • Channels
    • Archive
  • DOWNLOADS
    • New Downloads
    • Categories
    • Archive
  • GAME REVIEWS
  • ARTICLES
    • Rig of the Month
    • Join ROTM
    • PC Buyers Guide
    • Guru3D VGA Charts
    • Editorials
    • Dated content
  • HARDWARE REVIEWS
    • Videocards
    • Processors
    • Audio
    • Motherboards
    • Memory and Flash
    • SSD Storage
    • Chassis
    • Media Players
    • Power Supply
    • Laptop and Mobile
    • Smartphone
    • Networking
    • Keyboard Mouse
    • Cooling
    • Search articles
    • Knowledgebase
    • More Categories
  • FORUMS
  • NEWSLETTER
  • CONTACT

New Reviews
Be Quiet! Pure Power 12 M - 850W ATX 3.0 PSU review
Corsair H170i Elite Capellix XT review
Forspoken: PC performance graphics benchmarks
ASRock Z790 Taichi review
The Callisto Protocol: PC graphics benchmarks
G.Skill TridentZ 5 RGB 6800 MHz CL34 DDR5 review
Be Quiet! Dark Power 13 - 1000W PSU Review
Palit GeForce RTX 4080 GamingPRO OC review
Core i9 13900K DDR5 7200 MHz (+memory scaling) review
Seasonic Prime Titanium TX-1300 (1300W PSU) review

New Downloads
FurMark Download v1.33.0.0
Intel ARC graphics Driver Download Version: 31.0.101.4091
Corsair Utility Engine Download (iCUE) Download v4.33.138
CPU-Z download v2.04
AMD Radeon Software Adrenalin 23.1.2 (RX 7900) download
GeForce 528.24 WHQL driver download
Display Driver Uninstaller Download version 18.0.6.0
Download Intel network driver package 27.8
ReShade download v5.6.0
Media Player Classic - Home Cinema v2.0.0 Download


New Forum Topics
EnGenius releases Outdoor Point-to-Point Client Bridge with Wi-Fi 6 AMD Software: Adrenalin Edition 22.11.2 - Driver download and discussion Latest RTSS crashes Dark and Darker demo Intel Lowers ARC A750 Pricing towards $250, adds bundle and claim driver fine wine Nvidia shows signs ... MSI 300 series mainboards get AMD Ryzen 5000 BIOS Support Samsung: Firmware Update for the 990 Pro SSD Is On the Way Samsung announces its Galaxy S23 Smartphone Series AMD Confirms Strategy of Restraining Chip Supply to Maintain High CPU and GPU Prices Asus PBO Enhancement




Guru3D.com » News » Uninstall antivirus software - vendors are terrible

Uninstall antivirus software - vendors are terrible

by Hilbert Hagedoorn on: 02/01/2017 10:01 AM | source: | 82 comment(s)
Uninstall antivirus software - vendors are terrible

That is what an Ex-Mozilla developer states on his blog. He is not the first though, earlier on Google employees called on this one as well. The Mozilla engineer states that now he has left Mozilla he’s finally able to speak out about it. 

He calls for users to no longer purchase anti-virus software and to uninstall any previously purchased anti-virus applications. He does add that uninstalling antivirus software should only be done on an up-to-date OS. Ex-Mozilla engineer Robert O’Callahan argues that only Microsoft’s antivirus solution can be safely used and that the others ‘poison the software ecosystem’. He writes, “AV [antivirus] products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security.”

Here's a paste from his posting:

But you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.)

At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.)

Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security. For example, back when we first made sure ASLR was working for Firefox on Windows, many AV vendors broke it by injecting their own ASLR-disabled DLLs into our processes. Several times AV software blocked Firefox updates, making it impossible for users to receive important security fixes. Major amounts of developer time are soaked up dealing with AV-induced breakage, time that could be spent making actual improvements in security (recent-ish example).

What's really insidious is that it's hard for software vendors to speak out about these problems because they need cooperation from the AV vendors (except for Google, lately, maybe). Users have been fooled into associating AV vendors with security and you don't want AV vendors bad-mouthing your product. AV software is broadly installed and when it breaks your product, you need the cooperation of AV vendors to fix it. (You can't tell users to turn off AV software because if anything bad were to happen that the AV software might have prevented, you'll catch the blame.) When your product crashes on startup due to AV interference, users blame your product, not AV. Worse still, if they make your product incredibly slow and bloated, users just think that's how your product is.

If a rogue developer is tempted to speak out, the PR hammer comes down (and they were probably right to do so!). But now I'm free!







« The Elder Scrolls Online Morrowind Announced · Uninstall antivirus software - vendors are terrible · ASUS AM4 Prime X370 and Crosshair VI Hero Motherboards slides »

Related Stories

Download Display Driver Uninstaller DDU version 15.7.0.1 - 11/25/2015 12:05 AM
Download Display Driver Uninstaller DDU version 15.7.0.0 - Display Driver Uninstaller is a driver removal utility for AMD/NVIDIA graphics card drivers and packages. This release includes support for ...

Download Display Driver Uninstaller DDU version 15.6.0.2 - 11/16/2015 10:16 AM
Download Display Driver Uninstaller DDU version 15.6.0.2 - Display Driver Uninstaller is a driver removal utility that can help you completely uninstall AMD/NVIDIA graphics card drivers and packages...

Download Display Driver Uninstaller (DDU) 1.4.0.0.0 - 02/26/2015 10:12 AM
The handy DDU / Display Driver Uninstaller is now at update 1.4.0.0.0 - Display Driver Uninstaller is a driver removal utility that can help you completely uninstall AMD/NVIDIA graphics card drivers...

Download DDU Display Driver Uninstaller v13.5.4.1 - 12/15/2014 01:24 PM
You can now download DDU as Ghislain has updated the popular DDU towards revision 13.5.4.1 isplay Driver Uninstaller is a driver removal utility that can help you completely uninstall AMD/NVIDIA g...

Download Display Driver Uninstaller DDU 13.2.0.0 - 09/25/2014 06:14 PM
Download Display Driver Uninstaller 13.2.0.0 - Display Driver Uninstaller is a driver removal utility that can help you completely uninstall AMD/NVIDIA graphics card drivers and packages from your s...


17 pages « < 12 13 14 15 > »


KissSh0t
Senior Member



Posts: 12062
Joined: 2011-10-22

#5387604 Posted on: 02/01/2017 11:51 PM
You can stop a lot of the crap getting on your pc with a custom hostfile and a adblocker for your browser and common sense.

PrMinisterGR
Senior Member



Posts: 8093
Joined: 2014-09-27

#5387693 Posted on: 02/02/2017 04:51 AM
by the way, linux nowadays has just as many vulnerabilities as windows 7 (number wise)

but still, windows 7 has way less vulnerabilities than windows 10.
4 times less in whole 2016 incl. january 2017, 135 (win7) vs 397 (win10)
1 : 13 in january 2017 (for people who say this ratio would actually be equalized lately... it is NOT...)

source: https://web.nvd.nist.gov
It's a bit more complicated than that with Linux. Do they mean the kernel? Do they mean another piece of software? Do holes in distros like Ubuntu count as separate to holes in the packages these distros are made of? Was the kernel hardened? Did the exploit work with SELinux on? A rolling release like Arch will protect you from 99% of the stuff out there, and the way things run under Linux (you have to explicitly enable the execution of something and then run it), makes any kind of "normal" virus almost impossible to run. Unlike versions of Windows prior to 10, a virus can't install a kernel level driver either in Linux. It's an explicitly contained by design environment. That just makes it harder, though, not impossible.

It's nice that so many people here are experts and have never had a virus. Many people are not experts, and have terrible security practices. I still see other peoples' machines with viruses regularly. To suggest that these users are safer without AV is dangerous advice in my opinion.

Who is the source of this? A guy that started a flame thread to "shame" Avast into modifying their software, and admitted it was wrong to do so? Now that he is "free" he posts another rant, and I'm supposed to take this seriously?.

It's common sense really. He doesn't say that you're not supposed to use an antivirus. He says that all antivirus with the exception of the Microsoft one, have so bad platform implementations that they themselves are an attack vector. And he's completely right. For them to work, they need kernel-level system access, and injecting DLL into browser executables means breaking the sandbox, which is dangerous and retarded.

The guy starts by complaining about the way Avast interacts with Firefox(dll injection). Then he seems to ignore the simple solution to his complaint, and continues to point fingers after being informed that his complaint was already being addressed by Avast.

"The correct alternative would be for us to expose an API that an extension can hook into to examine scripts before we run them." - Brian Zbarsky

"We are really sensitive to public shaming of partners, especially the ones we work closely with and in this case, they were already working on a fix. This really impacts our relationship w/partners" - Erica Josted

"I accept this thread was a bad idea and I apologize for my error of
judgement."
- Robert O'Callahan
This is just PR damage control. Injections of libraries into the browser sandbox and "resolving it with partners" is the exact reason why these products are utter sh*t. Security is time sensitive and users trust with kernel level access, people who seriously thought that messing with a browser's sandbox is somehow ok.

I think you missed his point. Did you have a valid counterpoint, or just reflexive insults? Octopuss may not have expressed himself very clearly, but I didn't see him throwing insults at other members. Normally I find your posts insightful. I've found that if someone can't express him/her self without using insults to try to reinforce his/her "logic" then said "logic" is probably flawed.
He didn't express any rational thought. His post was the definition of sh*tposting and he did it not only once, but twice. His style of reply is what leads places of actual conversation between people into sh*ty ecochambers where everyone repeats what they want to hear, with no regard to fact, research, or experience. You can tell that by the fact of his ignore list, perfectly tailored to keep him in his happy place, with his happy thoughts.

MaxBlade
Senior Member



Posts: 899
Joined: 2003-10-02

#5388070 Posted on: 02/03/2017 12:43 AM
lol.. gonna pass on all the EXPERTS here Excuse me just passing through..

No one is stocking you, targeting you. The hits on that FIREWALL..OMG the IP is from CHINA! Who are you? Yeah. Are some giants company's trying to get MASS info sure. Where you go what you look at .. blah blah blah.

Viruses are out there duh. WHERE are you going WHAT are you download. And PLEASE FOR THE LOVE OF GOD STOP clicking on EMAIL LINKS.

This is just like people talking about "proxy/vpn (starts where your at)". 95+% don't have the money it takes nor a clue where to even BUY this stuff. Lost so many right there. You know the "don't keep records" and look.. TRACK ME says I am somewhere else.. NO ONE can find me! Run with that.

So this BLOG.. if you asked me and you didnt..has some great advice yet.. you will always need an antivirus. Some of the cheapest and free ones that have no real name.. are the best. Sad but so true.

This really should say it all.. "an Ex-Mozilla developer states in his blog"

schmidtbag
Senior Member



Posts: 7165
Joined: 2012-11-10

#5388073 Posted on: 02/03/2017 12:50 AM
@MaxBlade
lol are you Christopher Walken?

Neo Cyrus
Senior Member



Posts: 10407
Joined: 2006-02-14

#5388078 Posted on: 02/03/2017 01:07 AM
I've been switching between Avira, AVG, and Avast for years because all 3 of them at any given point become far too useless and invasive. They usually back down for a second, then the cycle repeats.

But recently AVG and Avast have been off the scale detecting something like 50 files I want to keep as "threats" and won't STFU no matter what along with MULTIPLE daily pop-up advertisements. I've switched to Avira for now but right after installation I got 3 popups within 10 minutes to buy their garbage, luckily they seem to have a "never show again" option unlike AVG and Avast.

That and I looked through this site: https://www.av-comparatives.org/

Seems of the 3 crapfest AVs I've been switching between Avira is currently the least offensive as far as false positives go. And it was right, none of my files are detected as threats with Avira.

I've always considered using Kaspersky, but no matter what version of it I use in what decade, it always crashes when deep scanning my archive of files. Literally across different decades across multiple different computers, always the same result.

17 pages « < 12 13 14 15 > »


Post New Comment
Click here to post a comment for this news story on the message forum.


Guru3D.com © 2023