<story><title>“AV is my single biggest impediment to shipping a secure browser.”</title><url>https://twitter.com/justinschuh/status/802491391121260544</url></story><parent_chain><item><author>hedgehog</author><text>In security simpler is almost always better.&lt;p&gt;Vess is asserting that AV vendors can write their own versions of the most complicated parts of the browser &amp;amp; OS (including parsing &amp;amp; rendering HTTP&amp;#x2F;HTML&amp;#x2F;CSS&amp;#x2F;JS&amp;#x2F;PNG, JS runtime, etc), then add more code on top of that to detect bad things, and do all of this while adding no significant bugs and with tolerable performance overhead. The reality is that browsers are insanely complicated, the people working on the major browsers are extraordinarily skilled, and there is a mountain of evidence that AV vendors routinely ship software that by design exposes users to huge security risks on top of all of their bugs.&lt;p&gt;Meanwhile security by isolation is proven effective at protecting users. Two good examples are the process-per-tab isolation in Chrome and the app sandboxing on iOS. Some holes into the sandboxes are necessary (for example you need to get keyboard input in and rendered images out) but every additional hole you open adds significant risk. The downside to this approach is it reduces the market for AV and other third party utilities.&lt;p&gt;(I used to work in security)</text></item><item><author>blauditore</author><text>For everyone else who was lost like me (mined from this comment section and some googling):&lt;p&gt;- AV: Anti-virus software&lt;p&gt;- Vess: Security, AV expert, loves AV&lt;p&gt;- Justin Schuh: Chrome dev (security-related), hates AV&lt;p&gt;- AV needs deep access to the OS, opening the door for attacks if managed poorly&lt;p&gt;- Deep OS access is often hacky (due to lack of APIs?), thus potentially unsafe&lt;p&gt;- Vess and Justin Schuh both have bad manners&lt;p&gt;Is this about right?&lt;p&gt;Also, how is AV a (direct) impediment to a shipping a safe browser? It seems to me that a browser should be mostly agnostic toward AV.&lt;p&gt;Edit: It seems like the problem is that AV tries to penetrate browsers in a similar hacky way as for the OS, resulting in similar issues.&lt;p&gt;TL;DR: AV tries to help by supervising browsers because they&amp;#x27;re allegedly not safe enough, but browsers think they&amp;#x27;re already safe and want AV to gtfo.&lt;p&gt;Edit 2: Are there any AVs that don&amp;#x27;t tamper with browsers at all? I&amp;#x27;ve always been using Avast and switching off all browser-related features, but maybe there are better options.</text></item></parent_chain><comment><author>masklinn</author><text>&amp;gt; Vess is asserting that AV vendors can write their own versions of the most complicated parts of the browser &amp;amp; OS (including parsing &amp;amp; rendering HTTP&amp;#x2F;HTML&amp;#x2F;CSS&amp;#x2F;JS&amp;#x2F;PNG, JS runtime, etc), then add more code on top of that to detect bad things, and do all of this while adding no significant bugs and with tolerable performance overhead.&lt;p&gt;Don&amp;#x27;t forget they usually try and run all of that right in the kernel, because if there&amp;#x27;s one thing you want more than hardly tested unsafe reimplementation of the most complex and dangerous parts of a browser, it&amp;#x27;s to run them in ring0.</text></comment>
<story><title>“AV is my single biggest impediment to shipping a secure browser.”</title><url>https://twitter.com/justinschuh/status/802491391121260544</url></story><parent_chain><item><author>hedgehog</author><text>In security simpler is almost always better.&lt;p&gt;Vess is asserting that AV vendors can write their own versions of the most complicated parts of the browser &amp;amp; OS (including parsing &amp;amp; rendering HTTP&amp;#x2F;HTML&amp;#x2F;CSS&amp;#x2F;JS&amp;#x2F;PNG, JS runtime, etc), then add more code on top of that to detect bad things, and do all of this while adding no significant bugs and with tolerable performance overhead. The reality is that browsers are insanely complicated, the people working on the major browsers are extraordinarily skilled, and there is a mountain of evidence that AV vendors routinely ship software that by design exposes users to huge security risks on top of all of their bugs.&lt;p&gt;Meanwhile security by isolation is proven effective at protecting users. Two good examples are the process-per-tab isolation in Chrome and the app sandboxing on iOS. Some holes into the sandboxes are necessary (for example you need to get keyboard input in and rendered images out) but every additional hole you open adds significant risk. The downside to this approach is it reduces the market for AV and other third party utilities.&lt;p&gt;(I used to work in security)</text></item><item><author>blauditore</author><text>For everyone else who was lost like me (mined from this comment section and some googling):&lt;p&gt;- AV: Anti-virus software&lt;p&gt;- Vess: Security, AV expert, loves AV&lt;p&gt;- Justin Schuh: Chrome dev (security-related), hates AV&lt;p&gt;- AV needs deep access to the OS, opening the door for attacks if managed poorly&lt;p&gt;- Deep OS access is often hacky (due to lack of APIs?), thus potentially unsafe&lt;p&gt;- Vess and Justin Schuh both have bad manners&lt;p&gt;Is this about right?&lt;p&gt;Also, how is AV a (direct) impediment to a shipping a safe browser? It seems to me that a browser should be mostly agnostic toward AV.&lt;p&gt;Edit: It seems like the problem is that AV tries to penetrate browsers in a similar hacky way as for the OS, resulting in similar issues.&lt;p&gt;TL;DR: AV tries to help by supervising browsers because they&amp;#x27;re allegedly not safe enough, but browsers think they&amp;#x27;re already safe and want AV to gtfo.&lt;p&gt;Edit 2: Are there any AVs that don&amp;#x27;t tamper with browsers at all? I&amp;#x27;ve always been using Avast and switching off all browser-related features, but maybe there are better options.</text></item></parent_chain><comment><author>guntars</author><text>&amp;gt; The downside to this approach is it reduces the market for AV and other third party utilities.&lt;p&gt;Doesn&amp;#x27;t sound like much of a downside to me.</text></comment>