40

When forming opinions, it is a good practice to follow scholastic tradition - think as hard as you can against the opinion you hold and try to find counter-arguments.

However, no matter how hard I try, I just cannot find reasonable arguments in favor of antivirus (and related security measures) on development machines.

Arguments against antivirus(AV) in development are plentiful:

  1. It is not uncommon for 1 minute build to take 10 times longer with AV on
  2. In a conference talk, IntelliJ developers claim AV software is #1 suspect when their IDE is sluggish
  3. Unzipping comes with roughly 100 kb/s speed with AV on
  4. AV renders Cygwin completely unusable (vim takes 1 minute to open a simple file)
  5. AV blocks me from downloading useful files (JARs, DLLs) from colleagues' e-mails
  6. I can't use multiple computers for development, since AV / security measures prevent me from unblocking ports
  7. AV kills performance of programs with high file turnover, such as Maven or Ant

Last, but not least - what does AV actually protect me from? I am not aware of my AV program ever stopping any security thread.

If the reason is fear of disclosing NDA stuff - no AV can possibly prevent me from doing it if I set my mind to it.

If the reason is fear of losing source code and/or documentation - there are distributed revision systems for this (there are at least 20 copies of our repo and we sync on daily basis).

If the reason if fear of disclosing customer data - developers rarely work connected to real production databases, instead they are playing around in toy environments.

Even if there are meaningful arguments in favor of having AV on development machines, they fall apart when faced with the ability to run a Virtual Machine in your paranoidly protected environment.

Since I want to keep an open mind of the issue, could anyone present meaningful, strong argument in favor of Anti-virus software for developers?

22
  • 4
    Again, you can have a Mac/Linux developer who occasionally uses Windows Virtual Machine to check how his site looks in Internet Explorer - without any AV there. To me, it looks like IT services are extremely paranoid on one front (Windows users) and very trusty on other fronts (Macs/Linuxes) I lean more towards the explanation that Windows makes it easy for IT services to enforce their paranoia. May 31, 2013 at 13:34
  • 2
    The few times I actually ran and used an antivirus program, I always turn continuous scanning off and just let it scan on a schedule. Once Windows Defender was available, I stopped using them at all. Now I don't even use Windows unless I have to (i.e. at work... ugh) May 31, 2013 at 15:04
  • 22
    I dont think your problem is AV software, its running overly-intrusive AV software. Disable the email attachment scanning, the firewall (Windows has its own), zip file scanning, etc. Just leave it to do some basic real-time monitoring and frequent off-hour scans. May 31, 2013 at 15:48
  • 4
    If your AV is slow, you're using the wrong AV.
    – zzzzBov
    May 31, 2013 at 17:26
  • 6
    It doesn't matter how clever you are about not clicking suspicious links, disabling plugins, etc when a site you trust is hacked and uses a browser bug to do a driveby malware install. BTDT My backup system passed the unscheduled system restore test with flying colors. May 31, 2013 at 17:41

9 Answers 9

41

The one reason to use anti-virus software on development machines that trumps all your arguments is:

To comply with security audits.

Banks, government agencies, large regulated firms with sensitive data don't have a choice on this matter.

5
  • 2
    Do you know how those corporations handle Linux and/or Mac? As an employee, are you obliged to use Windows there? May 31, 2013 at 17:44
  • 2
    @MarosUrbanec In my experience, and this is very much a YMMV kind of a comment, you get a standard imaged Windows developer machine. From there you can connect to a UNIX/Linux box via your favourite terminal and work. I have never seen developers using Macs in banking.
    – MrFox
    May 31, 2013 at 17:49
  • 1
    Having worked for both banks and government agencies, the flaw in this argument is that developers rarely (if ever) have actual sensitive data on their machines--or even access to sensitive data on the network. Said data is usually controlled via its own security policies and roles and developers typically just have code on their machines. (That said, yes, I realize IT security policies often don't have much correlation with reality).
    – DA01
    May 31, 2013 at 23:52
  • 1
    (also, when I was in banking, we had Macs. Which was great since IT left us alone and we could actually do productive things with our machines)
    – DA01
    May 31, 2013 at 23:53
  • 1
    @DA01 Companies are looking to mitigate legal risks and the risks of provoking regulators. These can be much more expensive than a slightly lower dev productivity. The technical arguments are moot. The status quo is over-protective and not completely rational - and yes I can probably extend that conjecture to our governments and legal systems at large.
    – MrFox
    Jun 3, 2013 at 13:23
42

Really, there is absolutely no reason to exempt developers from having anti-virus software on their machines. And overwhelmingly many reasons to require it.

Most of the disadvantages you mention can be addressed by telling the anti-virus software that your development folder (the one tied to your code repository) is a trusted location. After we had done that (and made IT postpone the daily scan for us to some time point in the evening as most developers leave their machines on anyway), we no longer had any issues with anti-virus software on our machines.

As for the download of files from e-mails: just tell your friends to use a different extension. Not a known one - anti-virus software is clever enough to check that it is or isn't what it purports to be, a made-up one. Update: Please note that this is a way to get around most e-mail clients' rather dumb rules regarding attachments. Most anti-virus software isn't fooled by the extension change and even if it is, the anti-virus will kick when you come to re-rename the extension to actually use it.

And for the port issue: that is about the only thing in which the policies of the anti-virus software may need to be different for developers, but honestly, we have to and can unblock our server instances all we like, we can still not accept connections from outside our local network. And security wise, that is how it should be. And we are working with a remote team. They use a VPN (Virtual Private Network) so are "within" the local network as far as the anti-virus software is concerned.

9
  • 25
    "As for the download of files from e-mails: just tell your friends to use a different extension." This is stupid, and means the AV you use is plain crap and can't check headers of downloaded files. Furthermore, if you need to change your workflow just to make your AV happy, then good luck May 31, 2013 at 17:43
  • @grasGendarme I don't find it stupid, it's just the AV is protecting stupid users. The average user isn't going to be legitimately receiving e-mail with executable attachments and thus any such attachment is likely malicious. If you jump through the hoops of changing the extension to get it to run you've shown you perfectly well know it's executable content and you probably know what you're doing. May 31, 2013 at 18:38
  • 11
    @LorenPechtel Yeah but the idea of telling your friends to change the extensions of their attachement, instead of configuring your AV is, at best, questionnable May 31, 2013 at 18:54
  • 1
    @grasGendarme not only is it stupid; but the only filters I've ran into that arbitrarily killed attachments lived on someones mail server, not locally. Most of them were also smart enough to realize that "TestApp.NotAnExe" or "SampleData.Piz" were exe/zip files no matter what the extension was. May 31, 2013 at 18:58
  • 2
    @grasGendarme: It usually isn't the AV that disallows it, but the e-mail client. And the recommendation is questionable either. When you have gotten around the e-mail client, the AV kicks in as soon as you re-rename the file and try to do anything with it. May 31, 2013 at 20:57
27

On developer machines? Yes because developers tend to download all sorts of things (both related and unrelated to work).

On build machines, it's also important simply to protect yourself. It would really stink to deploy/ship your code only to find that it has a virus once it makes it to its destination.

8
  • 7
    Why would a company hire developers that aren't smart enough to know what and where they download software from? The biggest beef I have with AV software on developer machines is that it's insulting. I'm in IT. I know how to safely use the internet FFS. ;) (That said, while most AV software is absurd, I do see the need for regular scans and such--for no other reason that the developer machine is typically connected to the network, and if other machines are compromised...)
    – DA01
    May 31, 2013 at 23:55
  • 7
    @DA91 It is not insulting - every one makes mistakes and accidently hits the wrong button + what happens when other people log into the company's machine that you use?
    – mmmmmm
    Jun 1, 2013 at 10:54
  • @DA01: Any company that might have installed exploitable (such as web browsers) and the programmer is tricked with link to great solution to some problem on s1ackexchange.com? And depending on company you are working for you might be targeted by very specific attacks or usage of 0-day exploits. Jun 2, 2013 at 0:29
  • 1
    @Mark maybe I'm woefully out of date on how easy it is to infect Windows, but unless I'm using an unpatched copy of IE6 or something, I thought it takes more than 'accidentally hitting the wrong button'
    – DA01
    Jun 2, 2013 at 3:39
  • 1
    That's pushing 20 years ago, but OK, I'll give you that one. :)
    – DA01
    Jun 2, 2013 at 21:29
11

There are many reasons to use an anti-virus. However, personally, I don't feel the trade offs are worth it. You can protect yourself by just being smart about using computers:

  1. When something asks for administrative permissions, why is it doing that. What does it need those for?
  2. Ensure your machine receives automatic updates
  3. Disable dangerous and unneeded things from automatically running in your browser (Flash, Java, Silverlight)
  4. Checked msconfig every once in a while. Is a strange program running at start up? Time to do a (one-time) scan and ensure it's not anything bad
  5. Use a VM for development. This has a speed penalty, but last time Windows 8 died on my VM, all I had to do was revert to a snapshot from a week back and do a git pull. Much easier to do this than to keep snapshots of physical machines, especially with changing hardware

I've never seen an antivirus that didn't significantly impact system performance. I've switched to Linux and/or OpenBSD in 2008, where I still watch what programs I run, but it's much easier there than Windows to know what a program will do (primarily due to most things being open source).

Anyway, since I've switched, I now run Windows in a VM and Linux on the physical machine almost exclusively, including at my (Microsoft shop) workplace. I've never installed an antivirus on a VM. I don't really browse the web or anything on the VM for obvious reasons, so I don't worry much about my bank account info going anywhere. The worst thing they could get is some proprietary info or my password. I use random passwords, so that's pretty pointless. And if the virus is to get proprietary info (say proprietary source code), then it's probably so targeted and custom that no antivirus will detect it anyway.

Edit:

Actually, I do run one AV program on my VM. I use Windows Defender, but that's basically because it's on by default, and so lightly intrusive that I've never noticed it running

7

Since I want to keep an open mind of the issue, could anyone present meaningful, strong argument in favor of Anti-virus software for developers, please?

I suspect most people who visit this forum are smart enough not not to download or visit dangerous internet sites, so they view AV as an annoyance or not needed.

But, really you need AV software. Not for you, but for the poor sap (computer neophyte) who clicks on "Click here to see cute kittens" link in an email and the last thing they see are hundreds of pop ups with cute little kittens saying "all your bases belong to us" as there machine is infected by malware.

Then the malware spreads across your network and then next thing you see is your processor running at 100% and nothing is working.

Unless you developing in a bubble, I want protection. I can cite that once I worked for company who decided they didn't need AV and for a time it was OK, until everyone's machine got infected. Well machines got reformatted and a lot of time was lost. Then everyone got AV and a company notice to not disable or un-install AV.

As others have suggested, you can tweak the AV so it will have less impact on your daily efforts.

You can walk the tightrope without a net, but really I prefer having a the net, even if I never need it.

4
  • 5
    -1 As I noted on the main question; a trusted site can be hacked to infect you with a drive by attack even if you're smart enough not to click random kitten links. May 31, 2013 at 20:35
  • 1
    Also, your company gets to decide whether or not you (and by extension it) can walk the tightrope, not you. At home you get to decide.
    – Mark Allen
    May 31, 2013 at 21:05
  • 3
    +1 as this is really the one valid argument. It's not you as the developer, it's the other 100 machines you share the network with. As for drive-by attacks, that's still predominantly upatched IEs, JRMs and Flash plugins and the like...usually stuff a developer doesn't want on their machine either. ;)
    – DA01
    May 31, 2013 at 23:58
  • @Dan - Sorry, my post wasn't meant to imply that opening emails is the only way to get a virus, it was merely an example to illustrate my argument for AV software.
    – Jon Raynor
    Jun 3, 2013 at 15:03
4

I agree that antivirus software is so intrusive that it makes one wonder whether the medicine is worse than the cure. I, too, am tempted to turn it do without and see what happens.

However, I have never done this, because there are serious risks to doing without antivirus software. Information can be stolen, data can be lost, or your computer can be bogged down by spyware. Your software has likely blocked many attacks that you weren't even aware of. And anyway, "it hasn't happened yet" is never a good argument against precautionary measures.

One thing I would suggest is tweaking the settings of your anti-virus software. You can probably disable some of the features to arrive at an acceptable compromise between performance and security. Most of the major problems that you describe come from real-time file scanning. I do not think you really need this (as long as you're not doing anything stupid), and if you turn it off, you will probably find that 90% of the annoyance goes away.

1

I've never experienced slow downs with build times. I'm a Windows developer & Windows 8 has robust AV built in (Win XP-7 you could use the free Microsoft Security Essentials - which is an excellent product that have very little impact on performance).

If your build times are taking 10x longer I would suggest finding better AV software on your platform - and ensure you're using MSE on your Windows machine.

0

If your company writes Antivirus Software you might need to test or dogfood your software.

Sounds far fetched, but it was exactly my case 3 or 4 years ago, and I can assure you it was not zero impact at all.

Furthermore, in 2010,

The malware industry has published nearly four new viruses per minute in the first half of the year.

--https://www.gdatasoftware.co.uk/press-center/news/article/article/1760-number-of-new-computer-viruses.html

Given those numbers, the only way AV software can keep up is through heuristics -- in practice monitor particular win32 calls and making them trigger the AV. Of course, this is a bit of a problem if you need to make those calls as a developer. Again, a problem I did see happen.

0

As soon as there exists AV software for power users, I'd say there would be no reason against it. The problem is that all* AV software is made for your parents. They have more money than you, and are willing to pay for the feeling of security (and clicking more buttons to download kitten toolbars).

* For suitable values of "all." I've found every AV program so far (about half a dozen major brands) extremely obnoxious and invasive.

Not the answer you're looking for? Browse other questions tagged or ask your own question.