I am a patriot, but even I don't appreciate being lied to by my government. It would be good if the next best cyber security firm and software was half as good as Kaspersky's. But I suspect not.

One could say that the same is true in the US, but I believe the degree matters. Although the US government and intelligence agencies will and do try to overreach, there is a strong legal and cultural tradition of exposing, resisting, and fighting these overreaches in the US. I don't see that in Russia.

So, I would not be surprised to see the US strong-arming US companies, but they would do this with sham/flimsy legal cover. The result of non-compliance would be at worst asset seizure and/or imprisonment. Both of these can be examined and contested. I imagine that the penalty for non-compliance in the Russian system would max out at having an unfortunate accident. Gangsters all, but the level of gangsterism and possibilities for investigation/redress matter.

All that said, I'm not a US citizen (although in a Five-Eyes country), so I do worry about using US-hosted services.

That point would be a lot stronger if the US government hadn't demonstrated shocking callousness and disregard for international law in their efforts to catch notorious whistleblowers Snowden and Assange.

I remember when Belarus downed a plane to catch a political dissident and all western countries acted shocked, even though these countries had tried to do the exact same thing to Snowden on the US's behalf, with a presidential plane no less.

My point is that the US is willing to go pretty damn far to put some high-profile dissidents in a hole and throw away the key, and there is very little pushback both internally and internationally, which kind of undercuts the whole "the US government would hesitate to do X because whistleblowers would stop them" argument.

Another I can think of is Chelsea Manning who ended up getting a presidential commutation of sentence.

IIRC they pretended there was a bomb threat or some other nonsense.

I think the key misconception behind this argument is the idea that harmful governments is a binary flag, such that if you're subjected to one adding more makes no difference. In fact, different governments have different concerns. This means if you're subject to the US and Russia you're significantly more constrained than if you were just subject to one. As such, it makes sense to reduce exposure even if you obviously can't eliminate it.

(I also believe the US govt is much better than Russian, but I'm leaving that out because I my argument doesn't need it and I'm uninterested in that argument)

I don't expect Kaspersky (the person) to play hero under these circumstances.

If you're a valuable target, it's basically choosing if you want to be spied on by the russians or the americans. (or installing linux, and hoping for the best).

Those companies often actually have people scan the hardware they receive to check for alterations. There was a whole thing about this a decade ago where a reporter (wrongly, IIRC) accused Facebook and Google of having compromised motherboards, and people from those companies were commenting here about how they are actually very careful with their supply lines and have people vet what they receive with scanning electron microscopes in some instances. (I'll try to find some of the submissions here and edit them as links on the bottom shortly).

I also have it on good authority (a good friend that worked at Google at the time) that Google found out that someone (the NSA) was tapping their inter-datacenter links and that's one of the reasons they made sure all data between datacenters was encrypted, and that was prior to the Snowden leaks.

So yes, agencies are constantly attempting to infiltrate large tech companies for their own purposes. That doesn't mean they always succeed, or that those companies just give up and accept that it happens. They all fight it quite actively.

It's true that any any software that allows auto-updating can be used to load arbitrary code onto a system, limited only by whatever additional safeguards are in place. In the case of the OS vendor, that can't really be guarded against, but it exists farther up the stack as well. Chrome and Firefox can just as easily load nefarious code onto your computer, limited only by what the OS prevents (which is generally more on a mobile platform, thankfully) and what their own reputation can sustain if they were found doing so.

It's also not a theory.

Its interesting to note that not many people remember (maybe a generational thing?) Kevin Poulsen found multiple government listening devices installed on Pac Bell networks that were listening to foreign embassy phone traffic which was highly illegal at the time.

It doesn't surprise me the extent the NSA and other three letter agencies have gone to get at information they deem valuable or important.

FTC should follow a fair and evidence based process for arriving at a decision like this.

There should be punitive measures only after it has been established that there is wrongdoing.

All these people whining about "they're both the same", they are not. "Bay of Pigs" argument does not apply, last time I checked Cuba was still standing where on the other hand Ukraine is burning and getting demolished.

It seems that those complaining really really do not understand the horror of living under an "official" or "unofficial" (i.e. government sanctioned vs. government tolerated) mafia rule: either you do what they tell you, or you cease to be, along with your spouse, children, parents, siblings, etc. There is absolutely no negotiation.

You should have the same concerns about software from anywhere, including the US. I believe it's a couple orders of magnitude more likely I'd be harmed by Russian government malicious code than any other nation.

Russia is in crisis, striking indiscriminately, and has no reputation left to lose. So that's where my concern lies.

With wikileaks, we've seen, that americans did all of the same things, you now try to accuse russia of potentialy doing.

I'm not saying russians won't do it, but americans already did it.

In finance I had a client that didn't trust any vendor and asked me to reverse engineer VPN appliances (they negotiate a special clause with the vendor), which makes more sense then trusting based on country of origin.

But we're talking about a government that just stole hundreds of millions of dollars in foreign planes (and other equipment) and took down satellite radio networks with cyberattacks (causing a lot of collateral damage), recently backdoor'd thousands of companies via Solarwinds, and looked the other way w/r/t ransomware groups until one of them caused a major international incident (Colonial pipeline). The threat from other nations is a lot more theoretical than it is for Russia.

Just call the "other guys" terrorists, nazis, whatever, and americans can occupy and bomb whatever country they want (and they did that to many countries) withot any backlash. Gone are the days of the hippies and anti-war-anything... sadly.

I was kinda hoping for a "revolution" in one of the european countries (eg france) during covid, where people would "remove" the current government, and make the other governments atleast worry a bit when their people get mad... but sadly, not even that.

Those are not the actions of the state worried about public perception, except in a "silence the dissidents" sense.

I'm American. My country is the US. Yes, they're spying on me. Yes, they do naughty things. But I assume that at the end of the day, the US has my interests at heart more than China does. Or the UK, or Russia, or Turkey, or anyone else. I happen to live on the land that they'll protect even while filling their pockets.

My feedback to you would be to do the same. You don't have to trust your own government but assume your government will keep you around longer than any other government will.

I'd much prefer misdeeds that don't affect me from a government that doesn't care about me, than those of a local government who wants to keep me alive for the purposes of doing more bad things to me in the future

I'm not, so from that point of view US companies cannot offer many guarantees to me

But you turned this question into comparing US to perfection. Yes, you are right. US is not perfection.

But there is a big difference between 70 to 10, even both are not 100.

What Snowden revealed does not make 70 to 10. If you think that way, you don’t understand how bad an authoritarian regime is.

Even if a company does not want to participate or is not compelled to do so, the US government has very significant capacity to break into and co-opt systems (all the way from targeted surveillance of individuals by intercepting and bugging hardware to tapping undersea cables to indiscriminately hoover up communications).

So when people say that Kaspersky might be forced to go along with Russian intelligence, the same goes for American tech companies and US intelligence. There is indeed a 4th Amendment that is supposed to protect Americans, but the last two decades have shown that the government is perfectly willing to ignore that legal restriction.

The US has the most extensive global surveillance system in the world. US intelligence services receive about as much funding as the entire Russian military. I have no doubt that Russia tries very hard to engage in extensive foreign surveillance, but its not in the same league as the US.

* The NSA secretly obtained access to every Verizon customer's entire call log. This was blatantly illegal (the 4th Amendment forbids general warrants), and it only came to light because of Snowden's leaks.[0]

* Snowden's email provider, Lavabit, was compelled to install a backdoor that allowed the US government to read the emails of all of the provider's users. The process was supposed to be secret: the company was under a gag order. The public only found out because the founder spoke out.[1]

There are many examples like this from the US (just look up "National Security Letter," or take a look at Snowden's leaks). You're citing one example in which a company successfully refused a request, but we also know from Snowden that there was mass collection on most Americans that went on for years in secret, despite the fact that it was blatantly illegal.

The scale of surveillance conducted globally by US intelligence agencies is unparalleled. I'm sure Russia wishes it could collect information on the same scale, but it simply does not have the ability to do so.

0. https://www.theguardian.com/world/2013/jun/06/nsa-phone-reco...

1. https://www.theguardian.com/commentisfree/2014/may/20/why-di...

Illegal NSA dragnets and perjury in front of Congress notwithstanding.

Could the Russian press behave toward Putin as the US press toward Trump? If so, then you can have your 10s.

Of course lawyers working for these agencies will try to justify them. That's what they're paid to do. During the Bush Jr. years, lawyers for the administration also argued that torture was legal, despite the fact that it's blatantly illegal.

Nevertheless, these programs are incredibly difficult to challenge in court, because the secrecy surrounding them makes even proving standing nearly impossible.

As for the (un)constitutionality of mass collection of Americans' call records, here's what Reuters[0] says:

> In a ruling handed down on Wednesday, the U.S. Court of Appeals for the Ninth Circuit said the warrantless telephone dragnet that secretly collected millions of Americans' telephone records violated the Foreign Intelligence Surveillance Act and may well have been unconstitutional.

The court did not make any ruling on the Constitutionality of the NSA's mass surveillance program, but they wrote in their decision that it very likely was Unconstitutional.[1]

Historically speaking, this NSA program is exactly the type of search that the 4th Amendment was intended to prevent. Americans were upset about "writs of assistance" that gave colonial officials wide powers to conduct searches against classes of people. That's why the 4th Amendment requires warrants to be specific and limited in scope. Handing out warrants that allow authorities to collect call logs of millions of Americans is blatantly Unconstitutional, and is exactly the sort of thing the 4th Amendment was intended to put a stop to.

0. https://www.reuters.com/article/us-usa-nsa-spying-idUSKBN25T...

1. https://cdn.ca9.uscourts.gov/datastore/opinions/2020/09/02/1...

XKeystore is simply the database that stores data collected outside the US, and Tempora is not even a US program, so clearly neither can violate the 4th Amendment, which is why no lawsuits were brought against either program.

> Handing out warrants that allow authorities to collect call logs of millions of Americans is blatantly Unconstitutional.

Obviously not. The program was limited to collecting millions of call logs instead of all call logs after the leaks, and that was considered so obviously constitutional that nobody sued. [5]

[1] https://cdn.vox-cdn.com/thumbor/DqqNh3fnfGCY1Zmk41LsSnjgUBg=...

[2] https://www.nytimes.com/2013/06/08/technology/tech-companies...

[3] http://www.nytimes.com/interactive/2013/06/07/us/comparing-t...

[4] https://www.cnet.com/news/no-evidence-of-nsas-direct-access-...

[5] https://www.reuters.com/article/us-usa-cyber-surveillance/sp...

> Tempora is not even a US program, so clearly neither can violate the 4th Amendment

The NSA is a partner in the program (led by the British, with whom the US has a very close intelligence partnership). The program does bulk collection on undersea cables which do carry Americans' data. This is prima facie a violation of the 4th Amendment.

> which is why no lawsuits were brought against either program

The reason why lawsuits so rarely get anywhere against any of these mass surveillance programs is that in the US legal system, you have to be able to prove standing in order to challenge them. The US isn't like other systems with dedicated constitutional courts that can review laws on their own initiative. Someone has to be able to show that they themselves have been specifically harmed. Unless you can prove that the NSA specifically looked at your data and used it against you in some way, you can't challenge the NSA's surveillance. By the very nature of these programs, it's nearly impossible for anyone to prove that.

> The New York Times [2][3] and CNET [4] subsequently correctly described the program

The NY Times article you cite describes it as a program that collects information from the largest US tech companies on the basis of FISA requests. Just so you recall, FISA is a court that operates in secret, that grants virtually all requests, and that has demonstrably signed off on Unconstitutional bulk surveillance (e.g., mass collection of call logs).

And by the way, the type of behavior we're discussing here, which we know for a fact the US government has engaged in, is exactly what people in this thread are alleging the Russian government might theoretically do to Kaspersky.

> High school dropout Snowden

Yes, a "high school dropout" who was paid 200 grand a year and given access to the NSA's classified networks. What a dummy!

> The program was limited to collecting millions of call logs instead of all call logs after the leaks, and that was considered so obviously constitutional that nobody sued.

This is not how the process of challenging an Unconstitutional law works. You can't just say, "That's Unconstitutional" and then sue. You have to show that you have personally been targeted. That's why Rosa Parks had to physically sit down on the bus and wait to get thrown off. That's what gave her standing to challenge Montgomery's segregated bus system. Just knowing that a surveillance program exists and has probably illegally collected your information does not automatically give you the ability to challenge said program in court.

Bulk collection of records of millions of Americans (this is just the warrant that we know of, and there were almost certainly similar warrants covering most Americans, because by design, the program was meant to do bulk analysis of all call records) is obviously unconstitutional, but also very difficult to legally challenge.

The NSA is aware of the program but has no say in implementing it and doesn't have access to its data. Only the UK has the data and gets to choose who to share what they've learned from it to. This is clearly not a violation of the 4th Amendment, which is why nobody has sued the US government for it. If you believe it is a violation, go ahead and try to find a lawyer to take your case.

> The reason why lawsuits so rarely get anywhere...

No lawsuit was brought at all against XKeyscore or Tempora. That is the reason they didn't get anywhere. Lawsuits were brought against the phone metadata program, which succeeded, and against PRISM, which was thrown out because it didn't collect the data of the person who brought the lawsuit, unlike what Snowden and Greenwald erroneously claimed.

> Just so you recall, FISA is a court that operates in secret, that grants virtually all requests, and that has demonstrably signed off on Unconstitutional bulk surveillance

Once again, no program the court has signed off on has been ruled unconstitutional. Just so you recall, FISA is not a court but a law. FISC is the court that rules on FISA requests.

> And by the way, the type of behavior we're discussing here, which we know for a fact the US government has engaged in, is exactly what people in this thread are alleging the Russian government might theoretically do to Kaspersky.

The behavior we're alleging the Russian government could do with Kaspersky is putting malware in its software. We know the US government has done this for hardware exported overseas, which is why we are right to expect Russia to do this. We also know that Russia engages in dragnet domestic surveillance, which is something you're alleging that the US does, but there is no evidence of.

> Yes, a "high school dropout" who was paid 200 grand a year and given access to the NSA's classified networks. What a dummy!

He was a Sharepoint admin earning $122k. https://www.washingtonpost.com/blogs/erik-wemple/wp/2013/06/.... His hilarious misinterpretation of PRISM and other programs proves what a dummy he is. The fact that he dropped out of high school just explains how he came to be so stupid, and it should have been a signal for you to read the documents he leaked instead of expecting him to interpret them correctly for you.

> Bulk collection of records of millions of Americans (this is just the warrant that we know of, and there were almost certainly similar warrants covering most Americans, because by design, the program was meant to do bulk analysis of all call records) is obviously unconstitutional, but also very difficult to legally challenge.

They just have to have reason to believe their data is being collected to challenge it, as they did in Klayman v. Obama I. The conclusion was that the bulk collection of everybody's call records wasn't justified by the law, with no ruling on the constitutionality, possibly because there was precedent in Smith v. Maryland that it is constitutional (the very opposite of "obviously unconstitutional"). After that, Congress passed a law that allowed collection of millions of call records, and that was not even challenged.

I think Russia is using similar tactics, does it?

You have to say "Ukrainian Special Security Operation".

>Moscow attacked neighboring Ukraine last month, following a seven-year standoff over Kiev’s failure to implement the terms of the Minsk agreements, and Russia’s eventual recognition of the Donbass republics of Donetsk and Lugansk. The German- and French-brokered protocols had been designed to regularize the status of those regions within the Ukrainian state.

>Russia has now demanded that Ukraine officially declare itself a neutral country that will never join the US-led NATO military alliance. Kiev insists the Russian offensive was completely unprovoked and has denied claims it was planning to retake the two republics by force.

It doesn't seem like they are afraid of getting disappeared for saying russia attacked ukraine.

Internal newspapers, such as Novaya Gazeta, have been shut down for saying "war" in print. Just the latest in many papers, radio channels and more that have been silenced in Russia.

> It doesn't seem like they are afraid of getting disappeared for saying russia attacked ukraine.

They didn't use the word "war".

Bullshit. The US is an imperialist, sometimes oppressive pseudo-democracy, but nothing like that mafia-run kleptocracy.

Most of the world consideres americans the "bad guys", and a lot worse than the russians. You can start with southern america and middle east. Then the balkans (where putin is doing the same as you guys did with kosovo). Even parts of africa would have a say.

Here in the balkans, people were actively rooting for trump in the last two elections, because they were afraid Hillary would start a new war here...

> Most of the world consideres americans the "bad guys", and a lot worse than the russians. You can start with southern america and middle east.

Their absurd support for tin pot dictators in South America was and is reprehensible, and the whole Iraq war was morally bankrupt and threw fuel on a fire that we’ll be trying to put out for decades. And yet, nothing the American did in the Middle East came anywhere near Aleppo or Mariupol. Or the Holodomor. Or the Prague spring.

> Then the balkans (where putin is doing the same as you guys did with kosovo).

Come on, now. You cannot possibly compare Sarajevo (with an actual genocide being carried out, surprisingly, by the side with Russian support) with the charade Putin used as a fig leaf to invade Ukraine. This is pure propaganda. The region would not be any better today had the ethnically cleansing gone all the way to the end, quite the contrary. Europe should have had grown a spine and actually done something.

> Here in the balkans, people were actively rooting for trump in the last two elections, because they were afraid Hillary would start a new war here...

Well, maybe you did, but that’s not what I heard from my greek friends. The Americans are not complicated to understand, they are going where their interests are. What the hell would they do in the Balkans? That is just stupid.

Yeah sure... and iraq had weapons of mass destruction, and iraqi soldiers killed babies, and afghanistan had to be occupied for 20 years, because a few saudis flew a few planes into a few buildings. Plus syria, libya, lebanon etc... and considering how far back you go in history, there's also blood from vietnam on americans hand. And it's funny how it's a "beloved ruler" when it's a friend of america and "nasty dictator" when it's not... so america has to replace the ones they don't like (eg iran.)

Sarajevo is not in kosovo, quite a few years were between sarajevo and the bombing of yugoslavia/serbia. Kosovo albanians wanted to separate from the main country, and the main country (yugoslavia then) wouldn't let them... then they formed armed groups that attacked the serbs, and serbs attacked the albanians... basically the same thing that was happening with the russian minority in eg. donbas and lugansk in ukraine. Then someone (USA) had some geopolicital interests in the balkans, bombed the country for 78 days, bombed hospitals, passenger trains, busses, schools, tv stations, cluster bombed a few cities, bridges, roads, highways etc, and built a nato base in kosovo.

So, why have a base in the balkans, if they don't need it?

Yeah if the US ever goes rogue we're all doomed but then your antivirus software will be the least of your worries.

So it is not a situation were we have actual evidence of dirtbaggery against the company, but that we are rationally paranoid that Kaspersky Lab could somehow steal our Pokemons.

After I read that profile I decided I'd never use the software. I remember before news spread of the Russian troll farms being real, people talked about it like "who would do that?" Russia would.

I don't think it's their quote - but I remember Penn of Penn & Teller saying about magic something to the effect that the magician does the things that people think "It could be... but who would do all of that work?" This is how I feel about Russia. They will or already are doing the things you think they won't and nothing is beyond being a tool for the state.

I don't really like feeding the image of the Russian super villain, but I don't consider it overly paranoid to avoid installing software from hostile nations. Yes I used this same logic to convince my wife to uninstall tiktok.

https://www.wired.com/2012/07/ff-kaspersky/

https://www.wired.com/2012/07/kaspersky-indy/

I have a lot of respect for Kaspersky and hope they are still independent. But "ties to intelligence" can come in many forms: deliberate, coerced, or via infiltration. We've seen similar issues here in the US. Sometimes companies work voluntarily with the FBI and NSA, sometimes they are infiltrated or tricked by them.

I suppose that entirely depends on one's threat-model. As an American, I have greater concerns of USG oppression than I do Russian. As the Russians have their ham-fisted means of exterting influence on a company, the US has their very own nasty ways of infiltration.

If you're interested in personal freedoms free of malicious government intrusion, they both suck.

All this with Russian government/president approval rating of 70%.

The "living in germany" part doesn't contradict the same concerns that those living in russia have, as like those living in russia, the emigrated russians likely have:

- family still in russia - ties to russia (financial, business, family, etc) - desire to visit russia without having to deal with legal harassment for actions done abroad - desire to be able to assist people (family/friends) living in russia without compromising them

This does not mean that they are for or against a current government, but rather, that the proposed logic is specious as it tries to create a separation where it is not probable there is one while simultaneously extrapolating the results of a small sample size across a population that supposedly is without the influence of Russia.

You can still find the opposing views, quite easily.

The whataboutism is out in full force here.

AFAIK it's a (relatively) honest business, though sadly the target of American russophobia

When you are entering a cold war with Russia, it's not Russophobia, it's common sense to not allow a potential state actor to have root access to millions of devices in your country.

Also, Kaspersky was literally a former KGB

> At the age of 16, Kaspersky entered a five-year program with The Technical Faculty of the KGB Higher School,[15] which prepared intelligence officers for the Russian military and KGB.[7][8] He graduated in 1987[15] with a degree in mathematical engineering and computer technology.[4][8] After graduating college, Kaspersky served the Soviet military intelligence service [6] as a software engineer.[2][10] He met his first wife Natalya Kaspersky at Severskoye, a KGB vacation resort, in 1987.[2]

https://en.wikipedia.org/wiki/Eugene_Kaspersky#Early_life

And anecdotally there were a lot of MSPs in /r/sysadmin claiming that every single one of their Kasperky customers would be hit by ransomware while few if any of their other customers were.

Except for this part, which leaves a huge question of "do they share knowledge with the russian govt."

> But the bigger unknown is whether and how Kaspersky’s acknowledged discovery and acquisition of NSA hacking tools resulted in Russian intelligence agencies discovering the NSA contractor, and targeting him for further, apparently successful, attacks.

In fact, there's a similar concern that the EU has with the US. The US's CLOUD Act forces American tech companies to comply with US legal subpoenas in foreign jurisdictions, which means that said tech companies cannot also comply with GDPR data export rules. Hence, it's illegal to include US services on EU websites[0] until and unless the US either agrees to pass GDPR into US law (so that exported EU data is still protected) or repeals the CLOUD Act (so that localized EU data is legally untouchable by the FBI or CIA).

The idea that we can treat a company as wholly separate from it's host nation is more of a legal fiction than anything else. It's not, in and of itself, russophobia. If the person running Kaspersky was trying to, say, flee Russia; and people said he couldnt't be trusted, then that would be russophobia.

[0] Note: It is still legal for EU citizens to use those US services directly. This only covers data export by EU companies to third-parties.

Putin and friends are moronic for bullying and harassing and mugging Ukraine. But if I were him, I would definitely declare apple pie a security threat in response.

This decision was certainly made by a bureaucrat who may not even know about Stuxnet. It’s simple risk mitigation. Why even take the chance Kaspersky is a malicious entity? It’s not important software.

Some of the conspiracy theories people throw out around here…

"We welcome the start of negotiations to resolve the current situation in Ukraine and hope that they will lead to a cessation of hostilities and a compromise. We believe that peaceful dialogue is the only possible instrument for resolving conflicts. War isn’t good for anyone."

If that something is owned by your enemy in a hot war it's game over.

The minute a vendor can be leaned on by a hostile government (even they are not in the country like the founder of Telegram) and the interest is strong enough to lean on them (hot war) the trust assumption becomes problematic. How problematic? I think it doesn't get more urgent then in a hot war.

Kaspersky needs to pack up in all NATO countries. Not just because they pay taxes in RU (also this is a good enough reason for me). But also because if you share data with a non-NATO country it immediately becomes problematic too if your business partner is using their products.

The options under which they should be allowed to continue to operate is purely academic because it involves not only shifting all operations out of RU but also getting rid of any executive who moves to the new location that can be leaned on back home (e.g. family and friends etc).

There is no middle ground because the minute these steps are initiated Kaspersky has good reason to feel mistreated by the West. So even they kept their hands clean until now they might start doing what they've been accused of anyway.

Also if Positive Tech and others have been sanctions already some months ago there is no reason to give this much bigger potential threat a pass.

Clearly you were joking?

The crap is your assertion that this has anything to something other than what's happening in Ukraine.

Kaspersky is collateral damage and fallout from Russia s actions and nothing more.

Please let's cut the crap.

Kaspersky is by definition a Russian company that provides antivirus software to many influential western companies and institutions.

The risk of Kaspersky bowing to the pressure from Putin is just too great to ignore. For Kaspersky this can seem unfair, but that is one of the many consequences of Putins actions.

Don't forget who started the invasion and who is still hurting innocent Ukrainians.

also dont forget that the Global Research & Analysis Team @ Kaspersky is not Russian

1. Kaspersky could have long ago left Russia

2. We can't trust Kaspersky

3. The fight is real, even if the US gov lied, incentives matter

Even if he is not a dirtbag, being in Russia means Putin has power to use Kaspersky technology in war.

I spent about 30 minutes this weekend helping my sister-in-law debug a slow internet. My observations were that attempting to do anything resulted in about a 5-10 second pause, and general sluggish response when trying to anything online. I disabled anti-virus, etc. and it was still slow. I tried Edge and everything was super-fast.

Digging further, the issue was McAfee Safe Search (powered by Yahoo). It was singlehandedly adding 5-10 second lag on every mouse click and character typed in the browser. Disabling and blocking that resolved everything.

I think my favorite part of it is that the issue itself of blocking everything for network calls is like one of the first things I learned about Windows programming in the early 2000's.

It's not just rogue AV software. Buggy, insecure AVs are a big problem too. They're attack surface! Especially when running parsers and interpreters for untrusted inputs in kernel space.

(Granted, I'm a complete layperson in computer security, so there's likely something I'm missing.)

You repeat yourself sir

Personally I think that it’s ridiculous that these huge orgs fail to address the actual underlying issue, excel macros. But hey, it’s easier to fight the Symptome than to deal with the root cause, especially if the latter would impact established work flows god knows how far down the line.

There's a reason companies use excel.

I think one's need for a security product should match one's exposure to issues - it depends on your org. For a very long time I was not a fan of anti-virus, in 2022 I'm back to liking anti-virus (more like EDR these days).

Notably, autolaunching USB drives is also no longer the default option for USB devices. The user has to specifically choose what action happens when the device is first plugged in (and by default, that choice only applies to the current instance; the user must manually choose to have the choice apply the next time the device is plugged in).

Back when “I love you” virus started, we had pointed out something simple as “open for read” vs “open as in run/execute” should not have had the same interface.

All the new security enhancements we have today - don’t run as admin, alerts to request privileged access, sandboxing - all of them existed for a decade, but the software vendors never had the guts to weigh security higher than UX

Even the script kiddies fall into that trap, my old school got infected by a .pdf.js.js ...

For me makes a lot of sense being able to sell a software subscription instead of a one time product sell, and for the other hand making available to use in any device in the world with internet connection.

This also can be done like Chrome apps (like Docs) or some Electron apps (like Spotify), where you can use content without Internet for some time without any problem.

For a mechanic who is looking for the amount of torque needed on a bolt this could be perfectly viable, for example.

We're going to start talking past each other pretty quickly if you think this is worthy of a (software) service subscription. Torque specs belong in a manual (ideally on corporate intra-net or paper); I'm talking about when the engine is deeply unhappy, and you need more to go on than a driver reporting a yellow check light.

In the case of the latter, I'd say it absolutely deserves to be a 20 year old program (which tend to be lighter) that runs entirely offline. The last thing any garage wants to do is chase hardware requirements or search for a wifi signal either out in the yard, or in between hoists, lifts, and miscelleaneous heavy equipment / tooling - all of which tend to trash a wifi signal.

AWS even offers "Workspaces" as service for this.

Though it doesn't solve the "without the internet" problem.

All that other crap does the exact same stuff to other programs that malware does, except they do so in the name of "security."

I’ve been using Linux/Mac exclusively for the past 10 years and never even considered it.

Insecurity policies is correct, what you mean is protecting managers a* aka the antivirus failed on us ;)

I'm CERTAIN there are massive hidden costs in fan replacement and Laptop repairs and nothing useful discovered as a result.

What happened to defense in depth with all of the layers you can introduce?

Surely if you run a Linux server, you might want a secure password for it, or better yet, key based authentication. Port knocking? Why not, throw it in there as another layer. Maybe deny authentication on an IP range basis? Why not. What about fail2ban or some other solution like that to disallow brute forcing? Sure. Or maybe require using a VPN to connect to it at all? Even better! Actually, even running your SSH server on a non-standard port will be enough to get rid of some attempts to brute force the password.

Sure, key based auth makes many of those moot points so i probably have the order of some of those steps wrong, but surely there's a lot of merit in combining whatever solutions you can to make the end result more secure, right? Hell, if you're running a web service of some sort or an application for yourself, adding basicauth in front of it at a web server level is enough to act as a safety net should the auth functionality of the actual application be broken, until you patch it.

So why should Windows be any different? If i'm stuck using that OS, i'd surely want to use whatever software is available to me to make the uphill battle towards something vaguely secure more doable, no?

What happened was antivirus itself became your biggest attack vector, so you were more secure without it. Plus Microsoft actually cares about security now, which wasn't the case 10+ years ago.

Enabling protected folder access and process isolation in Windows 10 is also a good idea.

UAC still pops up whether you use an admin account or not - it just requires the admin password when you use a standard account (which is, of course, still more secure). But the real advantage is that the account you are using does not have those admin privileges in the first place.

The other big advantage is that if this account is compromised in anyway (say if you used the same password to login to Chrome and Windows on your standard account) the hackers only get the password to your non privileged account. Of course this can be mitigated as well by really good password policy but I find for the average user they often re-use passwords and separating the two accounts forces them to often re-use the one that matters least.

Sure, any program can delete the Documents folder, but how can you prevent that from happening?

The tradeoff for having AV is having a giant application in admin land which increases the surface area available for an attack. Combine this with the that fact you don't get much protection because a virus can just be modified until the AV doesn't detect it and AV's just aren't worth it. This trade off made sense 20 years ago because OS's were less secure so you were increasing your surface area by relatively less than you are now.

AV software, including Defender, is not useless, it is actively harmful because it prevents people from running legitimate software without any recourse for non-experts or the original developer.

Never again.

MSE is really all I've used since binning AVG which turned into bloatware.

I feel your pain. We have a load of other crap loaded such as Umbrella that is supposed to protect us from harmful websites. It does stuff like intercept DNS lookups etc. It's such a pile of shite and doesn't work properly when I need VPN into our cloud infrastructure. When it's configured so badly it feels really anti-work. But hey ho, "security reasons".