Edit: typo
There are plenty of reasons to criticize Microsoft but I don’t think this is one of them. First, Windows Defender is quite good as far as antivirus software goes. If you ever had to do desktop support in the days when Norton, McAfee, and AVG reigned supreme, then you know what I’m talking about.
Second, one of the biggest challenges for an OS vendor is backwards compatibility. Especially since Windows dominates the enterprise space and has for the last 25+ years. Big corporations can get really cranky about their legacy applications from 1998 that are still basically holding the entire org together. While it’s short sighted to not be proactive about keeping your technology current, it’s also a reality that many businesses simply aren’t proactive.
Windows definitely has its flaws but it has come a long way in terms of both security and reliability over the years.
If Linux was the world’s most popular operating system, it too would have tons of vulnerabilities.
There’s two sides to that statement; one being that increased attention leads to more findings. The second being that in order to become popular, it would need a large set of simplified convenience features aimed for mass consumers; and those are often what lead to vulnerabilities. (Same story pretty much happened with Android)
most windows programs haven’t run as root in over a decade.
a program only runs as “root” in one of three situations:
- The app manifest says it is a requirement.
- The executable does not have an app manifest and has the “Run as Administrator” compatibility flag (only applies to apps built for XP or older).
- The user manually invokes the program with super user permissions (right click and “Run as Administrator", or manually set the above compatibility flag).
There are still far too many system components which run with spooky elevated privileges. Don’t believe me? Try nuking permissions on Windows update or activation nagware, disconnect from the internet and see how long those changes persist. Sometimes it is a few reboots.
This is a fundamentally insecure security framework, which no amount of glue or sandboxing can fix.
how would you expect something like windows update to function without elevated privileges?
activation nagware
what?
Meanwhile, giving myself root access to my own computer is a bitch. I need to just switch to Linux
What do you mean by “most Windows programs running as root?” I don’t think that’s accurate, unless you’ve disabled UAC.
OP still uses Windows XP.
You know what, if it keeps me from getting weird phone calls from my gramps once a month it’s good enough.
Precisely because Windows has been the main target for hackers and malware, for being by far the most used OS, it has caused Windows today to be the best protected OS, with a Defender that is currently one of the best AVs on the market and a effective Sandbox system that prevents any changes without user intervention in the root system. Hopefully in terms of privacy it will be just as good, at least by default it is not like that.
Pretty most of the people i know who work in IT are all just using Defender now, i have even stopped paying for AV and just use defender out of the box. Unless you are doing something that exposes you to risk there really is no use to use anything other than defender. In saying that enterprise or businesses environment i would still say 100% have something other than defender in place.
i’m one of those people. haven’t used anything other than Windows Defender for over a decade at this point.
If you want to criticize windows for being shitty, you should have went with their certification system. You know that popup that shows up whenever you run an exe from an “unknown publisher”? Well viruses can (and do) get certification since all you have to do is send Macroshaft money, leaving you completely unprotected from actual threats. It’s security theatre only there for fundraising purposes. Completely useless.
And no this isn’t a case of “no oversight” there are cases where Windows Defender will let you run a program its own database knows is a virus. Even if they know your program is flat out malware, as long as you buy that certificate your program will forever be treated as legitimate.
I understand that antivirus software is necessary on Windows, but I’ll never understand the existence of Windows Defender. If Microsoft knows enough to prevent a virus that exploits something in windows, why are they putting their effort into an antivirus program, and not fixing ththe problem in Windows? If someone has a good explanation for this, I’d love to hear it.
Tell me you know nothing about software without telling me.
I know nothing about software. That’s… Why I asked.
wow, you should become a teacher or something
ok so let’s start with the exploits. Exploit is a bug (problem) in a piece of software that when… umm… “abused” (well the word is just exploited) it allows you to do stuff that you shouldn’t. An exploit could be live from your browser to the program you use to zip files. The top 2 reasons to use an exploit is to either get initial foothold on a machine (e.g. an exploit in a browser that would allow an attacker to execute arbitrary code when you visit their page or an exploit in winrar that when you open a zip file executes code)
From the attackers perspective, you got in, nice. Mind you you got in through means that have nothing to do with windows (and that’s true most times, especially on desktops). but now? what?
You hacked into the machine for a reason! You might wanna grab the browser cookies (giving you direct access to the accounts that the victim is logged into), grab some files, screenshots, passwords
That’s where the AV kicks in. After the initial exploit the malware behaves like a normal program. But not completely. Assuming that the AV hasn’t seen the same exact malware before (which would an insta kick ban) it’s going to see a random process accessing files in chrome’s directory. HUH. ISNT THAT SOMETHING. quarantined.
Wanna start listening to each and every keystroke? quarantined
Meanwhile the way that the exe ended up in your system was not through an installer, you don’t provide an uninstaller and it was downloaded from www.xXxveryNicEsiteyou.got. HUUUUUUUH
the whole process is a bit simplified of course, but it captures the general idea
So why does linux not have an AV? FUCK IF I KNOW! It would be very, VERY useful. Writing malware that bypasses AV is an art of its own. Can be done for sure, but it’s an extra step and it’s not fun
background: used to get paid to do shit like that (legally, pentest) and it’s a fun hobby (writing code around it, not hacking people)
Makes sense! I guess without an antivirus there’s no way of distinguishing legitimate activity from illegitimate activity at the system level when dealing with downloaded programs. Also, my Voyager app decided that your “link” was actually a link and tried to make an embed lol
exactly!
sorry if I overexplained/oversimplified a bit but I didn’t want to make assumptions ☺️
because that isn’t really how these things work. It doesn’t matter how secure your operating system is, it can still get infected with malware if you let the user download and install arbitrary software. every modern desktop operating system that allows this has this hole.
features that pop up warnings when running code not signed by the OS vendor (like Windows SmartScreen or macOS Gatekeeper) help to an extent, but are not magic bullets since users can still override them.
at the end of the day, the best defense is to make sure you actually trust any software you download before running it.
I‘m sorry you got downvoted for asking a question because you don‘t know. Good old reddit behavior…
