Hacker News new | ask | show | jobs
by boston_clone 979 days ago
what part of EDR software seems malicious to you?
2 comments

The company I work for recently had the beautiful experience of having Windows Defender delete our program from many of our customers computers during the weekend, with the consequent support calls the next day about "your program does not run and I'm losing money!" and the headache of having to find out why the exe is magically gone, since the antivirus going crazy is the last thing you think of.

"Thankfully" it seems they did a progressive rollout of whatever version of Defender that detects our software so we didn't get every customer angry at once, which would come pretty close to a business ending event.

So yeah malware seems an adequate word to me. Especially since there's no way to find out what heuristic we're tripping and no one to ask for help so there's no guarantee that this won't happen again in a few weeks.

The malicious mindset is right in the name. It redefines my computer to exist only in context of another thing. My hardware is now an """endpoint""" and not a standalone system.
I'm trying to see your point, but it doesn't really track; a re-definition based on modern context isn't malicious.

Threats are not simply viruses, and network detection / response is objectively different.

You also probably connect your "standalone system" to a network.

It's not something that you're going to install on personal machines. It's something that the CISO wants installed on company machines for compliance reasons. And before you claim that you don't want your activity monitored on the company laptop, the laptop belongs to the company. There's no expectation of privacy.
In a corporate setting (where this kind of software is often used), „your“ computer is not really yours and does in fact only exist in context of another thing (the corporation).