Previously, from a former Mozilla developer [1]:

> At best, there is negligible evidence that major non-MS AV products give a net improvement in security. More likely, they hurt security significantly; for example, see bugs in AV products listed in Google's Project Zero. These bugs indicate that not only do these products open many attack vectors, but in general their developers do not follow standard security practices. (Microsoft, on the other hand, is generally competent.)

In the linked Project Zero issue tracker, all 3 of these "reputable sources" have exploits in their anti-virus software.

[1]: https://robert.ocallahan.org/2017/01/disable-your-antivirus-...

BTW, why would Microsoft even need to release an antivirus if they can patch the bugs in the OS the viriuses exploit as soon as they get discovered instead of just adding them to the virus database?

Viruses don't always exploit bugs. Most cryptolockers generally just trick people into executing them, for example.

So does the Linux/Linux-Kernel, Windows/Windows-Kernel, OSX/OSX-Kernel. Better not install those reputable OSs.

I think you're missing the cost/benefit calculation. Using any software makes you vulnerable to your software being compromised. But we take that risk because we get something out of using software. If you want to run Windows apps, you need Windows. AV software is different because they open up vulnerabilities, but don't give you any benefits. You can't run Excel without Windows; you can run it without AV software. So adding AV software requires some careful thought as to whether or not the cost/benefit is worth it. What the above comments are saying is that in a world where Windows Defender exists, installing third-party AV software is not worth it. The cost outweighs the benefit.

Defender doesn't get updated as fast as other AV that is why it is free and if you actually get a MS enterprise AV is a ton of money compared to other enterprise AVs. I have had Defender not find viruses other AV will caught as long as a week. Also defender also opens up vulnerabilities. I didn't miss the cost/benefit calculation. https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...

Vulnerability is not lack of security. You need a threat actor exploiting the weakness for it to become actual insecurity.

That's... not what vulnerability means.

vul·ner·a·bil·i·ty noun the quality or state of being exposed to the possibility of being attacked or harmed, either physically or emotionally.

I did not define vulnerability,I only explained security.

This is security101. Risk is measured by multiplying vulnerability by threat.

Maybe an analogy might help. You are vulnerable to bullets. But your security with respect to your bullet vulnerability is measured by multiplying it against active threats that might shoot you with bullets. So,your security decreases when in a warzone as opposed to lying in bed at your suburban house due to reduction of threat.

Insecurity is having a vulnerability. Whether a threat actor exploited it and what results you can detect are part of a useless variant of Schrödingers cat that everyone prefers you focus on to sell useless software.

Are you redefinig the field of information security? Please read some basic material on information risk and security.

I mean,even just reading vulnerability bulletins and CVE descriptions should familiarize you with explotability and complexity of attack,they exist to help remediators prioritize more insecure vulns.

Quick example: 'ls' has an easily exploitable code execution vuln. On a shared terminal server,this vuln translates to severe loss of security. On a firewall,this is nothing more than a house keeping item with no real loss of security as there are no threats that can run 'ls'.

You are moving the goal posts. The issue I take is with "threat actor". If a threat actor wasn't detected you have no idea if they exist. Only windows crapware tries to make the warped perception that what it doesn't know doesn't exist and priority obviously goes to where exploits provably exist. But insecurity is being attackable not being aware you are attackable (and certainly not knowing you are attackable but seeing no frequency of attacks).

Would you want your electric company to use these products knowing that another country will attack with 0 frequency until war is declared?

Look,the concept is not subjective. I didn't say a threat actor,I said threat.

I highly recommend looking these things up on your own but the goal of Information security is to reduce the risk that vulnerabilities will be exploited to where a breach of your security goals occurs(i.e.:CIA triad,confidentiality,integrity and availability mostly). It's not to make your system impregnable to all conceivable attacks.

My electric company should have well resourced nation state actors as part of their threat model. They should not only remediate known vulns,they should also employ EDR solutions that perform ML and behavioral detections/preventions. They should be part of their industry ISAC for threat intel sharing (which includes 0days) as well as have a comprehensive threat hunting and incident response program. Your average consumer,howevet has different types of data and attackers to worry about.

A banking trojan cleaning out your account,ransomware demanding payment for your family pictures, an ex installing RATs to monitor what you do are what consumers are threatened with.

Being attackable is not insecurity Right now you're attackable by an endless list of threats. Your local gang,serial killers,crazy people who shoot up schools,terrorists,etc... But your security is measured by a number of factors including where you live,what you're doing and specific attacker's cost-benefit analysis of attacking you.

Physical security and computer security don't really connect usefully by these kinds of analogies. I suggest you look higher up in the thread for where you brought up threat actors.

Ok,better analogy:There's a 0day vulnerability in a specific device driver you happen to be using,crafting a workable exploit requires a significant amount of skill and the exploit can only work under specific configurations. A well organized and talent-resourced attacker performing targeted attacks would exploit the vulnerability. Realistically,you'll have to take into account the likelihood of someone exploiting this vulnerability when prioritizing remediation(grading insecurity).

A simpler example: apache2 has a RCE but known exploits require PIE disabled for an exploit to work. You have one apache server in a segregated vlan that is facing your admin vlan with PIE enabled. In contrast you have an IIS server with DOS vuln facing the internet. The IIS server is more insecure because there is a significantly higher likelihood of a security compromise(availability) against it and the org will face reputational and revenue(?) Impact.

The whole point I want youbto get is that real (in)security is context aware.

That’s a somewhat minor issue compared to the fact that the major anti-virus products appear to be effectively adware with a dubiously secure scanning engine built in.

Whenever I help clean up someone’s Windows computer, I treat any antivirus product other than Windows Defender as malware and get rid of it.

As for resident antiviruses I would generally agree (even for purely logical reasons - that means adding another 3-rd party to the 100% trusted list, you grant their app godlike access to your computer and everything on it and let it talk freely and secretly to their vendor), nevertheless a live-cd version of something like Dr.Web can be of great use in such cases, Windows Defender a well as other antiviruses ran under an infected system can often be futile against viruses infesting it. Perhaps open-source ClamAV can do the job too but I'm not sure.

Agreed. I'm not only uninstalling third party AV software - I always actually reimage the machine if its preinstalled. Even Windows Defender does sketchy things but at least it's the same vendor as the OS - so hopefully not adding on tons of risk.

I have the feeling that security software is often the most insecure one, because of bad design choices and lack of quality engineering.

Windows itseld is a proprietary software. MS Defender does an ok job but for most malware that target consumers,those av softwares are not a negative.

As a techie you might have nation state actors employing sophisticated attacks or corpirations spying on users. But the most immediate threat to consumers are things like phishing attacks,ransomware and banking trojans.

That's been my understanding too, and I've seen security professionals say the same. But possibly, their advice was intended for likely targets, such as journalists, and not the general public.

On the other hand, I'm not sure I'd trust a typical end user to protect themself otherwise. Are they going to secure their OS profile? Avoid malware?

Yes, seems like people here take threat model of journalists and want to apply it to their 10 year old nephew who is downloading Minecraft mods.

It's pretty simple that they are looking to protect the user from the everyday threats (hint hint: Bare Minimum in the title). Also while I'm sure your superman with a "security degree" that looks down on all the mere mortals. You would stand no chance against an government agency with all the time in the world and a blank check.