~nJul 19, 2024

Thoughts and prayers go out to all those experts who have to explain the background of today's clownstrike oopsie to the befuddled press.

It takes some non-trivial mental contortion to explain the whole "people installing a backdoor on their computers for some company to execute privileged code, written in an unsafe language, in order to make their computers more secure" thing.

Show threadsebastian ⚡
@nblr In the end it boils down to this: There is a compliance dance that you have to do, if you want to work for/with certain customers. One of the boxes to check is: An AV-solution is deployed, active and up to date on all systems. So you pick one (they are all a pita one way or the other) and deploy it. Then you check the box.
It's not about making things more secure. It's about checking that box.
Jul 19, 2024 at 11:32amWeb
Show thread~nJul 19, 2024
@sebastian ...for which all involved parties should be adequately and mercilessly ridiculed. Mitleid bringt uns nicht weiter.
Show threadsebastian ⚡Jul 19, 2024

@nblr Ist halt im Zweifel leider der Unterschied zwischen: Du hast Kunden und kannst denen was verkaufen oder du kannst zu machen.
Ich seh das ja bei meinem Brötchengeber gerade.

Gibt sehr viele Leute, die das eigentlich besser wissen, aber das Spiel halt mitspielen müssen.

Show threadsebastian ⚡Jul 19, 2024
@nblr Was uns weiter bringen würde wäre, wenn die Hersteller von dem Bums für solche Ausfälle vollumfänglich haften. Und wenn man die auch jedes Mal zur Kasse bitten kann, wenn ihr Mist irgendeine Ransomware durchlässt.
Dann gäbe es auf einmal einen Markt und ein Incentive für Lösungen mit denen Kram wirklich messbar sicherer wird.
Show threadQuincy ⁂Jul 19, 2024

@sebastian @nblr

I've noticed this too, to my great dismay.

And would like to propose the term "#enshittipliance" for this.

(for the capturing of compliance mechanisms by snake-oil sellers etc.)

Show threadDavid Chisnall (*Now with 50% more sarcasm!*)Jul 19, 2024

@sebastian @nblr I see a business opportunity here:

A Windows AntiVirus program that installs a kernel driver whose entire implementation is a no-op. The guarantee, which I am 100% willing to stand behind, is that, in the absolute worst case, it does not lower the overall security of your system. As such, it is best in class and you can install it and meet your compliance obligations.

Show threadsebastian ⚡Jul 19, 2024

@david_chisnall
Do you mean our best in class security solution that integrates perfectly with existing OS mechanisms such as windows defender to provide state of the art protection without any performance overhead?

@nblr