<story><title>Windows Defender is enough, if you harden it</title><url>https://0ut3r.space/2022/03/06/windows-defender/</url></story><parent_chain><item><author>alibert</author><text>Hello,&lt;p&gt;Anything being worked on the IO performance side of Defender? I’m still using a paid third party AV for this sole reason. The impact is so huge with NPM packages as an example…</text></item><item><author>inglor</author><text>Hey, sorry for all the name changes of Microsoft Defender. I work at MSec (Microsoft&amp;#x27;s security org).&lt;p&gt;We ended up absorbing and acquiring a few companies to provide a better offering and a lot of re-branding happened. For example Security Center&amp;#x27;s old portal for active threat protection, automatic remediation, incident investigation etc is all now absorbed into (the better) security.microsoft.com which is (to my understanding, just an engineer) the current and last (for the foreseeable future) rebrand. The team I work at started as one person working on the frontend for MDE (Microsoft Defender for Endpoint) and now has hundreds of people working on the security portal across India, Israel and the US (as well as a few other smaller sites contributing).&lt;p&gt;Also, as an engineer I have to say the offering is good. The anti-virus and the telemetry is worked on by some really smart people. Client information is sacred, logging into production takes multiple audits and PII is scrubbed (heavily) any time logs are needed. We still have a lot of room to improve but I am confident in Microsoft both delivering a good product and acting in good faith (and there is a clear business incentive in the enterprise security space to do so rather than benevolence).</text></item></parent_chain><comment><author>bob1029</author><text>IO impact is why I disable it on all my dev machines.&lt;p&gt;Microsoft really needs to make this easier to turn off too. Right now, I have to use an undisclosed privilege escalation hack-around to force things my way.</text></comment>
<story><title>Windows Defender is enough, if you harden it</title><url>https://0ut3r.space/2022/03/06/windows-defender/</url></story><parent_chain><item><author>alibert</author><text>Hello,&lt;p&gt;Anything being worked on the IO performance side of Defender? I’m still using a paid third party AV for this sole reason. The impact is so huge with NPM packages as an example…</text></item><item><author>inglor</author><text>Hey, sorry for all the name changes of Microsoft Defender. I work at MSec (Microsoft&amp;#x27;s security org).&lt;p&gt;We ended up absorbing and acquiring a few companies to provide a better offering and a lot of re-branding happened. For example Security Center&amp;#x27;s old portal for active threat protection, automatic remediation, incident investigation etc is all now absorbed into (the better) security.microsoft.com which is (to my understanding, just an engineer) the current and last (for the foreseeable future) rebrand. The team I work at started as one person working on the frontend for MDE (Microsoft Defender for Endpoint) and now has hundreds of people working on the security portal across India, Israel and the US (as well as a few other smaller sites contributing).&lt;p&gt;Also, as an engineer I have to say the offering is good. The anti-virus and the telemetry is worked on by some really smart people. Client information is sacred, logging into production takes multiple audits and PII is scrubbed (heavily) any time logs are needed. We still have a lot of room to improve but I am confident in Microsoft both delivering a good product and acting in good faith (and there is a clear business incentive in the enterprise security space to do so rather than benevolence).</text></item></parent_chain><comment><author>cptskippy</author><text>I&amp;#x27;ve been forced to use a number of products over the years at work from Trend Micro to McAfee.  They all need curated exclusion lists and we have to ask developers to put all source controlled files under an excluded path common for all devs.&lt;p&gt;McAfee is by far the worst offender IMO when it comes to file IO.  We eventually dropped it in part to it&amp;#x27;s insistence on locking files in App Data which is a common scratch space for almost every Windows App.</text></comment>