40

When forming opinions, it is a good practice to follow scholastic tradition - think as hard as you can against the opinion you hold and try to find counter-arguments.

However, no matter how hard I try, I just cannot find reasonable arguments in favor of antivirus (and related security measures) on development machines.

Arguments against antivirus(AV) in development are plentiful:

  1. It is not uncommon for 1 minute build to take 10 times longer with AV on
  2. In a conference talk, IntelliJ developers claim AV software is #1 suspect when their IDE is sluggish
  3. Unzipping comes with roughly 100 kb/s speed with AV on
  4. AV renders Cygwin completely unusable (vim takes 1 minute to open a simple file)
  5. AV blocks me from downloading useful files (JARs, DLLs) from colleagues' e-mails
  6. I can't use multiple computers for development, since AV / security measures prevent me from unblocking ports
  7. AV kills performance of programs with high file turnover, such as Maven or Ant

Last, but not least - what does AV actually protect me from? I am not aware of my AV program ever stopping any security thread.

If the reason is fear of disclosing NDA stuff - no AV can possibly prevent me from doing it if I set my mind to it.

If the reason is fear of losing source code and/or documentation - there are distributed revision systems for this (there are at least 20 copies of our repo and we sync on daily basis).

If the reason if fear of disclosing customer data - developers rarely work connected to real production databases, instead they are playing around in toy environments.

Even if there are meaningful arguments in favor of having AV on development machines, they fall apart when faced with the ability to run a Virtual Machine in your paranoidly protected environment.

Since I want to keep an open mind of the issue, could anyone present meaningful, strong argument in favor of Anti-virus software for developers?

yannis
  • 39,547
  • 40
  • 183
  • 216
Maros Urbanec
  • 655
  • 5
  • 7
  • 1
    I think it's less about preventing the "oh sh.. my files are gone" scenario and more about protecting company secrets from outside attacks. As you said, everything is backed up 20 times over, but what's going to stop a key-logger from sending my account information somewhere? – Cuthbert May 31 '13 at 12:51
  • 4
    Again, you can have a Mac/Linux developer who occasionally uses Windows Virtual Machine to check how his site looks in Internet Explorer - without any AV there. To me, it looks like IT services are extremely paranoid on one front (Windows users) and very trusty on other fronts (Macs/Linuxes) I lean more towards the explanation that Windows makes it easy for IT services to enforce their paranoia. – Maros Urbanec May 31 '13 at 13:34
  • 1
    As far as web dev goes, we use FreeBSD and Linux but one Windows box for testing in IE that doesn't touch our dev network – Rob May 31 '13 at 14:11
  • Do you support AV on non-development machines? If yes, you can't reasonably argue this... Perhaps what you need is a separate machine for development that does not connect to untrusted networks like the Internet. – Matt May 31 '13 at 14:13
  • @d2jxp yea, but depending on the target, this would be a targeted attack for your company, using custom malware most likely. In my experience AV can't usually detect anything "custom". The best thing to do is download things with care, keep your software up to date (and disable dangerous unneeded things like Flash and Java in browser), and to pay attention to what needs administrator privileges to run. – Earlz May 31 '13 at 14:14
  • 2
    The few times I actually ran and used an antivirus program, I always turn continuous scanning off and just let it scan on a schedule. Once Windows Defender was available, I stopped using them at all. Now I don't even use Windows unless I have to (i.e. at work... ugh) – Drake Clarris May 31 '13 at 15:04
  • 1
    We all have anti-virus software installed on developer machines but we really only notice problems like the ones you mention if we explicitly run a full-system scan (although we don't use Cygwin or ItelliJ, so I can't speak about those). Maybe someone in your organization needs to look into getting anti-virus software with a smaller footprint - or get better machines for developers! – FrustratedWithFormsDesigner May 31 '13 at 15:37
  • 22
    I dont think your problem is AV software, its running *overly-intrusive* AV software. Disable the email attachment scanning, the firewall (Windows has its own), zip file scanning, etc. Just leave it to do some basic real-time monitoring and frequent off-hour scans. – GrandmasterB May 31 '13 at 15:48
  • 2
    A reasonable alternative to AV is to use disposable virtual machines (every session is started with a fresh clone). This way no unintended changes can ever be made, including any possible kinds of malware. – SK-logic May 31 '13 at 16:34
  • 1
    I think your problem is you've been using crappy AV software. – Reactgular May 31 '13 at 17:25
  • 4
    If your AV is slow, you're using the wrong AV. – zzzzBov May 31 '13 at 17:26
  • 6
    It doesn't matter how clever you are about not clicking suspicious links, disabling plugins, etc when a site you trust is hacked and uses a browser bug to do a driveby malware install. BTDT My backup system passed the unscheduled system restore test with flying colors. – Dan Is Fiddling By Firelight May 31 '13 at 17:41
  • @SK-logic because there's no possibility of a virus exploiting a hypervisor bug to escape the disposable VM and infect your VM host... – Dan Is Fiddling By Firelight May 31 '13 at 17:42
  • 2
    @DanNeely, good luck infecting a disposable network-bootable Linux host. A virus so clever is unlikely to be stopped by one of those pathetic antiviruses anyway. – SK-logic May 31 '13 at 18:24
  • @SK-logic if you're that confident in your OSes invulnerability, why are you mucking around with VMs instead of declaring yourself invulnerable in the first place? – Dan Is Fiddling By Firelight May 31 '13 at 18:54
  • 1
    @DanNeely, a guest OS running in VM is definitely vulnerable (Windows). But each instance of it never lives long enough for anything to be able to exploit its vulnerability. Also the fact that both host and guest OS instances are disposable makes it impossible for any security threat to be persistent enough to do any damage. E.g., build nodes never live more than 5-10 minutes. – SK-logic May 31 '13 at 19:59
  • I turned of real-time protection of AV in windows years ago. Never had problems, never went back:) – Ajasja May 31 '13 at 20:12
  • 1
    I find many of the answers really Windows centred. I guess not so many people run Linux with an antivirus. – Étienne May 31 '13 at 20:29
  • 2
    Sounds like you need to switch AV brands. All of you complaints but blocked attachments boil down to performance, and while all AV software has a performance penalty of some kind, what you describe is way outside the norm – Joel Coehoorn Jun 01 '13 at 02:29
  • I don't find MS Security Essentials to be intrusive at all. – user16764 Jun 01 '13 at 03:23
  • Industrial espionage. – hippietrail Jun 02 '13 at 05:52
  • You might make the AV less intrusive if you define some directories where only source / compiled code is stored, and have the AV those only scan on writes but not on reads. Thus, you get full protection on normally installed programs but less impact on the development. – Dr. Hans-Peter Störr Jun 04 '13 at 08:57

9 Answers9

42

Really, there is absolutely no reason to exempt developers from having anti-virus software on their machines. And overwhelmingly many reasons to require it.

Most of the disadvantages you mention can be addressed by telling the anti-virus software that your development folder (the one tied to your code repository) is a trusted location. After we had done that (and made IT postpone the daily scan for us to some time point in the evening as most developers leave their machines on anyway), we no longer had any issues with anti-virus software on our machines.

As for the download of files from e-mails: just tell your friends to use a different extension. Not a known one - anti-virus software is clever enough to check that it is or isn't what it purports to be, a made-up one. Update: Please note that this is a way to get around most e-mail clients' rather dumb rules regarding attachments. Most anti-virus software isn't fooled by the extension change and even if it is, the anti-virus will kick when you come to re-rename the extension to actually use it.

And for the port issue: that is about the only thing in which the policies of the anti-virus software may need to be different for developers, but honestly, we have to and can unblock our server instances all we like, we can still not accept connections from outside our local network. And security wise, that is how it should be. And we are working with a remote team. They use a VPN (Virtual Private Network) so are "within" the local network as far as the anti-virus software is concerned.

Marjan Venema
  • 8,151
  • 3
  • 32
  • 35
  • 25
    "As for the download of files from e-mails: just tell your friends to use a different extension." This is stupid, and means the AV you use is plain crap and can't check headers of downloaded files. Furthermore, if you need to change your workflow just to make your AV happy, then good luck – toasted_flakes May 31 '13 at 17:43
  • @grasGendarme I don't find it stupid, it's just the AV is protecting stupid users. The average user isn't going to be legitimately receiving e-mail with executable attachments and thus any such attachment is likely malicious. If you jump through the hoops of changing the extension to get it to run you've shown you perfectly well know it's executable content and you probably know what you're doing. – Loren Pechtel May 31 '13 at 18:38
  • 11
    @LorenPechtel Yeah but the idea of telling your friends to change the extensions of their attachement, instead of configuring your AV is, at best, questionnable – toasted_flakes May 31 '13 at 18:54
  • 1
    @grasGendarme not only is it stupid; but the only filters I've ran into that arbitrarily killed attachments lived on someones mail server, not locally. Most of them were also smart enough to realize that "TestApp.NotAnExe" or "SampleData.Piz" were exe/zip files no matter what the extension was. – Dan Is Fiddling By Firelight May 31 '13 at 18:58
  • 2
    @grasGendarme: It usually isn't the AV that disallows it, but the e-mail client. And the recommendation is questionable either. When you have gotten around the e-mail client, the AV kicks in as soon as you re-rename the file and try to do anything with it. – Marjan Venema May 31 '13 at 20:57
  • @LorenPechtel: exactly – Marjan Venema May 31 '13 at 20:59
  • @DanNeely: Yep, the AV isn't the one that is fooled by changing the extension, the e-mail client is. – Marjan Venema May 31 '13 at 21:00
  • Came here to say this "Most of the disadvantages you mention can be addressed by telling the anti-virus software that your development folder (the one tied to your code repository) is a trusted location" <-- indeed. Also your %temp% folder, though preferably you set your dev environment to use a different folder for building altogether and exclude that instead. – Mark Allen May 31 '13 at 21:03
  • @MarkAllen: Good idea. – Marjan Venema May 31 '13 at 21:05
41

The one reason to use anti-virus software on development machines that trumps all your arguments is:

To comply with security audits.

Banks, government agencies, large regulated firms with sensitive data don't have a choice on this matter.

MrFox
  • 3,398
  • 2
  • 19
  • 23
  • 2
    Do you know how those corporations handle Linux and/or Mac? As an employee, are you obliged to use Windows there? – Maros Urbanec May 31 '13 at 17:44
  • 2
    @MarosUrbanec In my experience, and this is very much a YMMV kind of a comment, you get a standard imaged Windows developer machine. From there you can connect to a UNIX/Linux box via your favourite terminal and work. I have never seen developers using Macs in banking. – MrFox May 31 '13 at 17:49
  • 1
    Having worked for both banks and government agencies, the flaw in this argument is that developers rarely (if ever) have actual sensitive data on their machines--or even access to sensitive data on the network. Said data is usually controlled via its own security policies and roles and developers typically just have code on their machines. (That said, yes, I realize IT security policies often don't have much correlation with reality). – DA01 May 31 '13 at 23:52
  • 1
    (also, when I was in banking, we had Macs. Which was great since IT left us alone and we could actually do productive things with our machines) – DA01 May 31 '13 at 23:53
  • 1
    @DA01 Companies are looking to mitigate legal risks and the risks of provoking regulators. These can be much more expensive than a slightly lower dev productivity. The technical arguments are moot. The status quo is over-protective and not completely rational - and yes I can probably extend that conjecture to our governments and legal systems at large. – MrFox Jun 03 '13 at 13:23
27

On developer machines? Yes because developers tend to download all sorts of things (both related and unrelated to work).

On build machines, it's also important simply to protect yourself. It would really stink to deploy/ship your code only to find that it has a virus once it makes it to its destination.

Richard
  • 1,739
  • 15
  • 18
  • 7
    Why would a company hire developers that aren't smart enough to know what and where they download software from? The biggest beef I have with AV software on developer machines is that it's insulting. I'm in IT. I know how to safely use the internet FFS. ;) (That said, while most AV software is absurd, I do see the need for regular scans and such--for no other reason that the developer machine is typically connected to the network, and if other machines are compromised...) – DA01 May 31 '13 at 23:55
  • 7
    @DA91 It is not insulting - every one makes mistakes and accidently hits the wrong button + what happens when other people log into the company's machine that you use? – mmmmmm Jun 01 '13 at 10:54
  • @DA01: Any company that might have installed exploitable (such as web browsers) and the programmer is tricked with link to great solution to some problem on s1ackexchange.com? And depending on company you are working for you might be targeted by very specific attacks or usage of 0-day exploits. – Maciej Piechotka Jun 02 '13 at 00:29
  • 1
    @Mark maybe I'm woefully out of date on how easy it is to infect Windows, but unless I'm using an unpatched copy of IE6 or something, I thought it takes more than 'accidentally hitting the wrong button' – DA01 Jun 02 '13 at 03:39
  • @DA01 when downloding your development software what happens if the website has benn infected? or you mistype a URL? or you get sent an email from a friend? or the install CD is infected? or a machine onyour network is infected? All of which have happened – mmmmmm Jun 02 '13 at 08:15
  • @mark as I stated, other machines on the network are a concern. That said, infected install CDs? Developers accidentally going to Mycrosoft? Does that really happen? Maybe it does. – DA01 Jun 02 '13 at 15:06
  • @DA01 yes including at least one case of Microsoft doing this – mmmmmm Jun 02 '13 at 20:02
  • 1
    That's pushing 20 years ago, but OK, I'll give you that one. :) – DA01 Jun 02 '13 at 21:29
11

There are many reasons to use an anti-virus. However, personally, I don't feel the trade offs are worth it. You can protect yourself by just being smart about using computers:

  1. When something asks for administrative permissions, why is it doing that. What does it need those for?
  2. Ensure your machine receives automatic updates
  3. Disable dangerous and unneeded things from automatically running in your browser (Flash, Java, Silverlight)
  4. Checked msconfig every once in a while. Is a strange program running at start up? Time to do a (one-time) scan and ensure it's not anything bad
  5. Use a VM for development. This has a speed penalty, but last time Windows 8 died on my VM, all I had to do was revert to a snapshot from a week back and do a git pull. Much easier to do this than to keep snapshots of physical machines, especially with changing hardware

I've never seen an antivirus that didn't significantly impact system performance. I've switched to Linux and/or OpenBSD in 2008, where I still watch what programs I run, but it's much easier there than Windows to know what a program will do (primarily due to most things being open source).

Anyway, since I've switched, I now run Windows in a VM and Linux on the physical machine almost exclusively, including at my (Microsoft shop) workplace. I've never installed an antivirus on a VM. I don't really browse the web or anything on the VM for obvious reasons, so I don't worry much about my bank account info going anywhere. The worst thing they could get is some proprietary info or my password. I use random passwords, so that's pretty pointless. And if the virus is to get proprietary info (say proprietary source code), then it's probably so targeted and custom that no antivirus will detect it anyway.

Edit:

Actually, I do run one AV program on my VM. I use Windows Defender, but that's basically because it's on by default, and so lightly intrusive that I've never noticed it running

Earlz
  • 22,658
  • 7
  • 46
  • 60
7

Since I want to keep an open mind of the issue, could anyone present meaningful, strong argument in favor of Anti-virus software for developers, please?

I suspect most people who visit this forum are smart enough not not to download or visit dangerous internet sites, so they view AV as an annoyance or not needed.

But, really you need AV software. Not for you, but for the poor sap (computer neophyte) who clicks on "Click here to see cute kittens" link in an email and the last thing they see are hundreds of pop ups with cute little kittens saying "all your bases belong to us" as there machine is infected by malware.

Then the malware spreads across your network and then next thing you see is your processor running at 100% and nothing is working.

Unless you developing in a bubble, I want protection. I can cite that once I worked for company who decided they didn't need AV and for a time it was OK, until everyone's machine got infected. Well machines got reformatted and a lot of time was lost. Then everyone got AV and a company notice to not disable or un-install AV.

As others have suggested, you can tweak the AV so it will have less impact on your daily efforts.

You can walk the tightrope without a net, but really I prefer having a the net, even if I never need it.

Jon Raynor
  • 10,905
  • 29
  • 47
  • 5
    -1 As I noted on the main question; a trusted site can be hacked to infect you with a drive by attack even if you're smart enough not to click random kitten links. – Dan Is Fiddling By Firelight May 31 '13 at 20:35
  • 1
    Also, your company gets to decide whether or not you (and by extension it) can walk the tightrope, not you. At home you get to decide. – Mark Allen May 31 '13 at 21:05
  • 3
    +1 as this is really the one valid argument. It's not you as the developer, it's the other 100 machines you share the network with. As for drive-by attacks, that's still predominantly upatched IEs, JRMs and Flash plugins and the like...usually stuff a developer doesn't want on their machine either. ;) – DA01 May 31 '13 at 23:58
  • @Dan - Sorry, my post wasn't meant to imply that opening emails is the only way to get a virus, it was merely an example to illustrate my argument for AV software. – Jon Raynor Jun 03 '13 at 15:03
4

I agree that antivirus software is so intrusive that it makes one wonder whether the medicine is worse than the cure. I, too, am tempted to turn it do without and see what happens.

However, I have never done this, because there are serious risks to doing without antivirus software. Information can be stolen, data can be lost, or your computer can be bogged down by spyware. Your software has likely blocked many attacks that you weren't even aware of. And anyway, "it hasn't happened yet" is never a good argument against precautionary measures.

One thing I would suggest is tweaking the settings of your anti-virus software. You can probably disable some of the features to arrive at an acceptable compromise between performance and security. Most of the major problems that you describe come from real-time file scanning. I do not think you really need this (as long as you're not doing anything stupid), and if you turn it off, you will probably find that 90% of the annoyance goes away.

1

I've never experienced slow downs with build times. I'm a Windows developer & Windows 8 has robust AV built in (Win XP-7 you could use the free Microsoft Security Essentials - which is an excellent product that have very little impact on performance).

If your build times are taking 10x longer I would suggest finding better AV software on your platform - and ensure you're using MSE on your Windows machine.

niico
  • 241
  • 3
  • 11
0

If your company writes Antivirus Software you might need to test or dogfood your software.

Sounds far fetched, but it was exactly my case 3 or 4 years ago, and I can assure you it was not zero impact at all.

Furthermore, in 2010,

The malware industry has published nearly four new viruses per minute in the first half of the year.

--https://www.gdatasoftware.co.uk/press-center/news/article/article/1760-number-of-new-computer-viruses.html

Given those numbers, the only way AV software can keep up is through heuristics -- in practice monitor particular win32 calls and making them trigger the AV. Of course, this is a bit of a problem if you need to make those calls as a developer. Again, a problem I did see happen.

Sklivvz
  • 5,242
  • 19
  • 34
0

As soon as there exists AV software for power users, I'd say there would be no reason against it. The problem is that all* AV software is made for your parents. They have more money than you, and are willing to pay for the feeling of security (and clicking more buttons to download kitten toolbars).

* For suitable values of "all." I've found every AV program so far (about half a dozen major brands) extremely obnoxious and invasive.

l0b0
  • 11,014
  • 2
  • 43
  • 47