Ex-Mozilla developer: Disable Your Antivirus Software (Except Microsoft's)

[Bleipriester]

Robert O'Callahan warns of AV-software and recommends only Microsoft´s solution.

On his blog he writes:

Disable Your Antivirus Software (Except Microsoft's)

"I was just reading some Tweets and an associated Hackernews thread and it reminded me that, now that I've left Mozilla for a while, it's safe for me to say: antivirus software vendors are terrible; don't buy antivirus software, and uininstall it if you already have it (except, on Windows, for Microsoft's).

Update (Perhaps it should go without saying --- but you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.)

At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.)

Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security. For example, back when we first made sure ASLR was working for Firefox on Windows, many AV vendors broke it by injecting their own ASLR-disabled DLLs into our processes. Several times AV software blocked Firefox updates, making it impossible for users to receive important security fixes. Major amounts of developer time are soaked up dealing with AV-induced breakage, time that could be spent making actual improvements in security (recent-ish example).

What's really insidious is that it's hard for software vendors to speak out about these problems because they need cooperation from the AV vendors (except for Google, lately, maybe). Users have been fooled into associating AV vendors with security and you don't want AV vendors bad-mouthing your product. AV software is broadly installed and when it breaks your product, you need the cooperation of AV vendors to fix it. (You can't tell users to turn off AV software because if anything bad were to happen that the AV software might have prevented, you'll catch the blame.) When your product crashes on startup due to AV interference, users blame your product, not AV. Worse still, if they make your product incredibly slow and bloated, users just think that's how your product is.

If a rogue developer is tempted to speak out, the PR hammer comes down (and they were probably right to do so!). But now I'm free! Bwahahaha!"

Eyes Above The Waves: Disable Your Antivirus Software (Except Microsoft's)

 

[Billy_Kinetta]

Been using mine for years. Works great. Never an issue.

 

[Ringel05]

Robert O'Callahan warns of AV-software and recommends only Microsoft´s solution.

On his blog he writes:

Disable Your Antivirus Software (Except Microsoft's)

"I was just reading some Tweets and an associated Hackernews thread and it reminded me that, now that I've left Mozilla for a while, it's safe for me to say: antivirus software vendors are terrible; don't buy antivirus software, and uininstall it if you already have it (except, on Windows, for Microsoft's).

Update (Perhaps it should go without saying --- but you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.)

At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.)

Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security. For example, back when we first made sure ASLR was working for Firefox on Windows, many AV vendors broke it by injecting their own ASLR-disabled DLLs into our processes. Several times AV software blocked Firefox updates, making it impossible for users to receive important security fixes. Major amounts of developer time are soaked up dealing with AV-induced breakage, time that could be spent making actual improvements in security (recent-ish example).

What's really insidious is that it's hard for software vendors to speak out about these problems because they need cooperation from the AV vendors (except for Google, lately, maybe). Users have been fooled into associating AV vendors with security and you don't want AV vendors bad-mouthing your product. AV software is broadly installed and when it breaks your product, you need the cooperation of AV vendors to fix it. (You can't tell users to turn off AV software because if anything bad were to happen that the AV software might have prevented, you'll catch the blame.) When your product crashes on startup due to AV interference, users blame your product, not AV. Worse still, if they make your product incredibly slow and bloated, users just think that's how your product is.

If a rogue developer is tempted to speak out, the PR hammer comes down (and they were probably right to do so!). But now I'm free! Bwahahaha!"

Eyes Above The Waves: Disable Your Antivirus Software (Except Microsoft's)

Opinions are like assholes, everyone has one. My question is what's his motivation, altruistic, nefarious or money related?

 

[Bleipriester]

Robert O'Callahan warns of AV-software and recommends only Microsoft´s solution.

On his blog he writes:

Disable Your Antivirus Software (Except Microsoft's)

"I was just reading some Tweets and an associated Hackernews thread and it reminded me that, now that I've left Mozilla for a while, it's safe for me to say: antivirus software vendors are terrible; don't buy antivirus software, and uininstall it if you already have it (except, on Windows, for Microsoft's).

Update (Perhaps it should go without saying --- but you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.)

At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.)

Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security. For example, back when we first made sure ASLR was working for Firefox on Windows, many AV vendors broke it by injecting their own ASLR-disabled DLLs into our processes. Several times AV software blocked Firefox updates, making it impossible for users to receive important security fixes. Major amounts of developer time are soaked up dealing with AV-induced breakage, time that could be spent making actual improvements in security (recent-ish example).

What's really insidious is that it's hard for software vendors to speak out about these problems because they need cooperation from the AV vendors (except for Google, lately, maybe). Users have been fooled into associating AV vendors with security and you don't want AV vendors bad-mouthing your product. AV software is broadly installed and when it breaks your product, you need the cooperation of AV vendors to fix it. (You can't tell users to turn off AV software because if anything bad were to happen that the AV software might have prevented, you'll catch the blame.) When your product crashes on startup due to AV interference, users blame your product, not AV. Worse still, if they make your product incredibly slow and bloated, users just think that's how your product is.

If a rogue developer is tempted to speak out, the PR hammer comes down (and they were probably right to do so!). But now I'm free! Bwahahaha!"

Eyes Above The Waves: Disable Your Antivirus Software (Except Microsoft's)

Opinions are like assholes, everyone has one. My question is what's his motivation, altruistic, nefarious or money related?

Mabye he wants MS to hire him. Who knows in the end. However, I agree with him in the AV programs´ effects on the computer. Everything slows down and the tools provide little protection from new malware, while their performance in detecting old and known malware is identical.

 

[waltky]

Does this also pertain to firewall...

... and anti-spyware products...

... or is it just limited to AV software?

 

[Bleipriester]

Does this also pertain to firewall...

... and anti-spyware products...

... or is it just limited to AV software?

I don´t think so. I have a complete solution but only have installed the network protection including the firewall. The firewall only determines if and when a program may access the internet or be accessed via the internet. Files are not being analyzed and of course not in real time like AV tools do. A firewall also does not interfere with the installed programs as described in the blog entry.
I don´t know much about anti-spyware but they aren´t universal and can easily be outdated and thus useless.

 

[Ringel05]

Robert O'Callahan warns of AV-software and recommends only Microsoft´s solution.

On his blog he writes:

Disable Your Antivirus Software (Except Microsoft's)

"I was just reading some Tweets and an associated Hackernews thread and it reminded me that, now that I've left Mozilla for a while, it's safe for me to say: antivirus software vendors are terrible; don't buy antivirus software, and uininstall it if you already have it (except, on Windows, for Microsoft's).

Update (Perhaps it should go without saying --- but you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.)

At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.)

Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security. For example, back when we first made sure ASLR was working for Firefox on Windows, many AV vendors broke it by injecting their own ASLR-disabled DLLs into our processes. Several times AV software blocked Firefox updates, making it impossible for users to receive important security fixes. Major amounts of developer time are soaked up dealing with AV-induced breakage, time that could be spent making actual improvements in security (recent-ish example).

What's really insidious is that it's hard for software vendors to speak out about these problems because they need cooperation from the AV vendors (except for Google, lately, maybe). Users have been fooled into associating AV vendors with security and you don't want AV vendors bad-mouthing your product. AV software is broadly installed and when it breaks your product, you need the cooperation of AV vendors to fix it. (You can't tell users to turn off AV software because if anything bad were to happen that the AV software might have prevented, you'll catch the blame.) When your product crashes on startup due to AV interference, users blame your product, not AV. Worse still, if they make your product incredibly slow and bloated, users just think that's how your product is.

If a rogue developer is tempted to speak out, the PR hammer comes down (and they were probably right to do so!). But now I'm free! Bwahahaha!"

Eyes Above The Waves: Disable Your Antivirus Software (Except Microsoft's)

Opinions are like assholes, everyone has one. My question is what's his motivation, altruistic, nefarious or money related?

Mabye he wants MS to hire him. Who knows in the end. However, I agree with him in the AV programs´ effects on the computer. Everything slows down and the tools provide little protection from new malware, while their performance in detecting old and known malware is identical.

Uummmm, that's pretty much always been the case, the attack occurs, is discovered, signature identified and AV updated. Besides the old and known don't just go away overnight.
As for slowing down, Norton, McAfee and AVG were notorious for that, I run Avast and slowdown is negligible.
When someone starts telling me to lower my defenses or use only one specifically I start thinking ulterior motives. I'll continue to run mine, it's not bothering me, besides I don't pay anything for it.

 

[Bleipriester]

Robert O'Callahan warns of AV-software and recommends only Microsoft´s solution.

On his blog he writes:

Disable Your Antivirus Software (Except Microsoft's)

"I was just reading some Tweets and an associated Hackernews thread and it reminded me that, now that I've left Mozilla for a while, it's safe for me to say: antivirus software vendors are terrible; don't buy antivirus software, and uininstall it if you already have it (except, on Windows, for Microsoft's).

Update (Perhaps it should go without saying --- but you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.)

At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.)

Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security. For example, back when we first made sure ASLR was working for Firefox on Windows, many AV vendors broke it by injecting their own ASLR-disabled DLLs into our processes. Several times AV software blocked Firefox updates, making it impossible for users to receive important security fixes. Major amounts of developer time are soaked up dealing with AV-induced breakage, time that could be spent making actual improvements in security (recent-ish example).

What's really insidious is that it's hard for software vendors to speak out about these problems because they need cooperation from the AV vendors (except for Google, lately, maybe). Users have been fooled into associating AV vendors with security and you don't want AV vendors bad-mouthing your product. AV software is broadly installed and when it breaks your product, you need the cooperation of AV vendors to fix it. (You can't tell users to turn off AV software because if anything bad were to happen that the AV software might have prevented, you'll catch the blame.) When your product crashes on startup due to AV interference, users blame your product, not AV. Worse still, if they make your product incredibly slow and bloated, users just think that's how your product is.

If a rogue developer is tempted to speak out, the PR hammer comes down (and they were probably right to do so!). But now I'm free! Bwahahaha!"

Eyes Above The Waves: Disable Your Antivirus Software (Except Microsoft's)

Opinions are like assholes, everyone has one. My question is what's his motivation, altruistic, nefarious or money related?

Mabye he wants MS to hire him. Who knows in the end. However, I agree with him in the AV programs´ effects on the computer. Everything slows down and the tools provide little protection from new malware, while their performance in detecting old and known malware is identical.

Uummmm, that's pretty much always been the case, the attack occurs, is discovered, signature identified and AV updated. Besides the old and known don't just go away overnight.
As for slowing down, Norton, McAfee and AVG were notorious for that, I run Avast and slowdown is negligible.
When someone starts telling me to lower my defenses or use only one specifically I start thinking ulterior motives. I'll continue to run mine, it's not bothering me, besides I don't pay anything for it.

Your decision though the illusion of protection is far worse than the awareness of threats.

 

[Ringel05]

Robert O'Callahan warns of AV-software and recommends only Microsoft´s solution.

On his blog he writes:

Disable Your Antivirus Software (Except Microsoft's)

"I was just reading some Tweets and an associated Hackernews thread and it reminded me that, now that I've left Mozilla for a while, it's safe for me to say: antivirus software vendors are terrible; don't buy antivirus software, and uininstall it if you already have it (except, on Windows, for Microsoft's).

Update (Perhaps it should go without saying --- but you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.)

At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.)

Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security. For example, back when we first made sure ASLR was working for Firefox on Windows, many AV vendors broke it by injecting their own ASLR-disabled DLLs into our processes. Several times AV software blocked Firefox updates, making it impossible for users to receive important security fixes. Major amounts of developer time are soaked up dealing with AV-induced breakage, time that could be spent making actual improvements in security (recent-ish example).

What's really insidious is that it's hard for software vendors to speak out about these problems because they need cooperation from the AV vendors (except for Google, lately, maybe). Users have been fooled into associating AV vendors with security and you don't want AV vendors bad-mouthing your product. AV software is broadly installed and when it breaks your product, you need the cooperation of AV vendors to fix it. (You can't tell users to turn off AV software because if anything bad were to happen that the AV software might have prevented, you'll catch the blame.) When your product crashes on startup due to AV interference, users blame your product, not AV. Worse still, if they make your product incredibly slow and bloated, users just think that's how your product is.

If a rogue developer is tempted to speak out, the PR hammer comes down (and they were probably right to do so!). But now I'm free! Bwahahaha!"

Eyes Above The Waves: Disable Your Antivirus Software (Except Microsoft's)

Opinions are like assholes, everyone has one. My question is what's his motivation, altruistic, nefarious or money related?

Mabye he wants MS to hire him. Who knows in the end. However, I agree with him in the AV programs´ effects on the computer. Everything slows down and the tools provide little protection from new malware, while their performance in detecting old and known malware is identical.

Uummmm, that's pretty much always been the case, the attack occurs, is discovered, signature identified and AV updated. Besides the old and known don't just go away overnight.
As for slowing down, Norton, McAfee and AVG were notorious for that, I run Avast and slowdown is negligible.
When someone starts telling me to lower my defenses or use only one specifically I start thinking ulterior motives. I'll continue to run mine, it's not bothering me, besides I don't pay anything for it.

Your decision though the illusion of protection is far worse than the awareness of threats.

Honestly Blei, I don't give a shit how you see it or how you think I see it, never really did. Besides I have more important real life things to deal with right now.

 

[Bleipriester]

Robert O'Callahan warns of AV-software and recommends only Microsoft´s solution.

On his blog he writes:

Disable Your Antivirus Software (Except Microsoft's)

"I was just reading some Tweets and an associated Hackernews thread and it reminded me that, now that I've left Mozilla for a while, it's safe for me to say: antivirus software vendors are terrible; don't buy antivirus software, and uininstall it if you already have it (except, on Windows, for Microsoft's).

Update (Perhaps it should go without saying --- but you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.)

At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.)

Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security. For example, back when we first made sure ASLR was working for Firefox on Windows, many AV vendors broke it by injecting their own ASLR-disabled DLLs into our processes. Several times AV software blocked Firefox updates, making it impossible for users to receive important security fixes. Major amounts of developer time are soaked up dealing with AV-induced breakage, time that could be spent making actual improvements in security (recent-ish example).

What's really insidious is that it's hard for software vendors to speak out about these problems because they need cooperation from the AV vendors (except for Google, lately, maybe). Users have been fooled into associating AV vendors with security and you don't want AV vendors bad-mouthing your product. AV software is broadly installed and when it breaks your product, you need the cooperation of AV vendors to fix it. (You can't tell users to turn off AV software because if anything bad were to happen that the AV software might have prevented, you'll catch the blame.) When your product crashes on startup due to AV interference, users blame your product, not AV. Worse still, if they make your product incredibly slow and bloated, users just think that's how your product is.

If a rogue developer is tempted to speak out, the PR hammer comes down (and they were probably right to do so!). But now I'm free! Bwahahaha!"

Eyes Above The Waves: Disable Your Antivirus Software (Except Microsoft's)

Opinions are like assholes, everyone has one. My question is what's his motivation, altruistic, nefarious or money related?

Mabye he wants MS to hire him. Who knows in the end. However, I agree with him in the AV programs´ effects on the computer. Everything slows down and the tools provide little protection from new malware, while their performance in detecting old and known malware is identical.

Uummmm, that's pretty much always been the case, the attack occurs, is discovered, signature identified and AV updated. Besides the old and known don't just go away overnight.
As for slowing down, Norton, McAfee and AVG were notorious for that, I run Avast and slowdown is negligible.
When someone starts telling me to lower my defenses or use only one specifically I start thinking ulterior motives. I'll continue to run mine, it's not bothering me, besides I don't pay anything for it.

Your decision though the illusion of protection is far worse than the awareness of threats.

Honestly Blei, I don't give a shit how you see it or how you think I see it, never really did. Besides I have more important real life things to deal with right now.

Really? What are you doing here, then? It is not even about real life in here...

 

[peabody]

Been using mine for years. Works great. Never an issue.

Some of these backdoor Trojans will sit silently on your computer for years while quietly transmitting your personal data overseas to terrorist organizations. You may want to re-install your OS.

 

[Billy_Kinetta]

Been using mine for years. Works great. Never an issue.

Some of these backdoor Trojans will sit silently on your computer for years while quietly transmitting your personal data overseas to terrorist organizations. You may want to re-install your OS.

I have every protection available. Also, I do not place or store personal data on the online comp. Would that the DOD would do the same.

 

[iamwhatiseem]

"Omit all protection except one source...just keep this one, and BTW...you need a new computer and the most updated same source OS also"....... wow this is dumb

 

[Lewdog]

Robert O'Callahan warns of AV-software and recommends only Microsoft´s solution.

On his blog he writes:

Disable Your Antivirus Software (Except Microsoft's)

"I was just reading some Tweets and an associated Hackernews thread and it reminded me that, now that I've left Mozilla for a while, it's safe for me to say: antivirus software vendors are terrible; don't buy antivirus software, and uininstall it if you already have it (except, on Windows, for Microsoft's).

Update (Perhaps it should go without saying --- but you also need to your OS to be up-to-date. If you're on Windows 7 or, God forbid, Windows XP, third party AV software might make you slightly less doomed.)

At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.)

Furthermore, as Justin Schuh pointed out in that Twitter thread, AV products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security. For example, back when we first made sure ASLR was working for Firefox on Windows, many AV vendors broke it by injecting their own ASLR-disabled DLLs into our processes. Several times AV software blocked Firefox updates, making it impossible for users to receive important security fixes. Major amounts of developer time are soaked up dealing with AV-induced breakage, time that could be spent making actual improvements in security (recent-ish example).

What's really insidious is that it's hard for software vendors to speak out about these problems because they need cooperation from the AV vendors (except for Google, lately, maybe). Users have been fooled into associating AV vendors with security and you don't want AV vendors bad-mouthing your product. AV software is broadly installed and when it breaks your product, you need the cooperation of AV vendors to fix it. (You can't tell users to turn off AV software because if anything bad were to happen that the AV software might have prevented, you'll catch the blame.) When your product crashes on startup due to AV interference, users blame your product, not AV. Worse still, if they make your product incredibly slow and bloated, users just think that's how your product is.

If a rogue developer is tempted to speak out, the PR hammer comes down (and they were probably right to do so!). But now I'm free! Bwahahaha!"

Eyes Above The Waves: Disable Your Antivirus Software (Except Microsoft's)

Opinions are like assholes, everyone has one. My question is what's his motivation, altruistic, nefarious or money related?

Mabye he wants MS to hire him. Who knows in the end. However, I agree with him in the AV programs´ effects on the computer. Everything slows down and the tools provide little protection from new malware, while their performance in detecting old and known malware is identical.

Uummmm, that's pretty much always been the case, the attack occurs, is discovered, signature identified and AV updated. Besides the old and known don't just go away overnight.
As for slowing down, Norton, McAfee and AVG were notorious for that, I run Avast and slowdown is negligible.
When someone starts telling me to lower my defenses or use only one specifically I start thinking ulterior motives. I'll continue to run mine, it's not bothering me, besides I don't pay anything for it.

Yep I use free Avast and I use an IP monitor and blocker... just because there are a few people on this forum that like to make threats about hacking IPs.