[tekklloneer]

Signature based anti-virus is a must have on any widely deployed platform that doesn't have default code-sign requirements. So, basically, Windows and FOSS Desktop.

But, it's become so drastically commoditized that there's no reason for the average user to have anything but the built-in MSE (on windows, at least).

It doesn't stop new attacks, but it does help raise the bar against malware.

[astrobe_]

I believe "Widely deployed platform" is the issue here.

A yummy target for virus and ransomware authors is a widely used piece of software: OS, browser, crypto library, Word processor, spreadsheet, PDF reader,...

Part of the problem is that in each of these categories, a single vendor often holds over 50% market share. As soon as a bug in one of those allow a RCE, that means millions of users at risk.

It's also true even if you don't run the software directly but use a service: memes that infect social media (see: Facebook and fake news) are basically viruses too.

Species avoid extinction from viruses thanks to diversity. Software users that want to stay safe should consider using the less popular alternatives.

[jwfxpr]

> Part of the problem is that in each of these categories, a single vendor often holds over 50% market share. As soon as a bug in one of those allow a RCE, that means millions of users at risk. ... > Species avoid extinction from viruses thanks to diversity. Software users that want to stay safe should consider using the less popular alternatives.

This point is badly under-discussed whenever this AV debate comes up.

Yeah, the variety of vendors, products, and methods in the third-party AV arena make production less predictable for software developers. That's the point. It makes it exactly as unpredictable for attackers.

Should AV vendors work harder to make their software easier to develop around? Arguably, yes. Security through obscurity is no security at all. But that should be the target of the argument, not the homogenization of security systems. I don't care how big or small the Defender attack surface is if every single desktop computer in the world has the exact same attack surface.

[Aaargh20318]

> It doesn't stop new attacks, but it does help raise the bar against malware.

It also provides a giant new attack surface.