this post was submitted on 22 Mar 2024
640 points (96.0% liked)

linuxmemes

21180 readers
1299 users here now

Hint: :q!

Sister communities:

Community rules (click to expand)

1. Follow the site-wide rules

2. Be civil
  • Understand the difference between a joke and an insult.
  • Do not harrass or attack members of the community for any reason.
  • Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
  • Bigotry will not be tolerated.
  • These rules are somewhat loosened when the subject is a public figure. Still, do not attack their person or incite harrassment.
    • 3. Post Linux-related content
  • Including Unix and BSD.
  • Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of sudo in Windows.
  • No porn. Even if you watch it on a Linux machine.
    • 4. No recent reposts
  • Everybody uses Arch btw, can't quit Vim, and wants to interject for a moment. You can stop now.

    • Please report posts and comments that break these rules!

    founded 1 year ago
    MODERATORS
    poopsmith@lemmy.world
    zephyr@lemmy.world
    rtxn@lemmy.world
    640
    And that is why snapshots exist (sh.itjust.works)
    submitted 7 months ago* (last edited 7 months ago) by 0x4E4F@sh.itjust.works to c/linuxmemes@lemmy.world
    90 comments fedilink hide all child comments
     

    Though the Windows thing was really funny ๐Ÿ˜‚.

    you are viewing a single comment's thread
    view the rest of the comments
    [โ€“] 0x4E4F@sh.itjust.works 17 points 7 months ago* (last edited 7 months ago) (3 children)

    Not just every file deleted, every file written to disk as well (downloaded, extracted from an archive, whatever).

    It's also how most AV software works, except Defender is slow AF.

    [โ€“] vox@sopuli.xyz 8 points 7 months ago (1 children)

    also, defender is synchronous by default (e.g. nothing gets written until it gets scanned, and scanning parallelization is limited), and can only act asynchronously (aka write first, then queue check) on "trusted dev drives" (aka ReFS-based virtual vhdx partitions aimed at developers as a solution to horrible ntfs throughput, especially if defender is enabled)

    [โ€“] 0x4E4F@sh.itjust.works 1 points 7 months ago* (last edited 7 months ago)

    Not true, it does get written before it gets scanned. In fact, it doesn't even always scan before the file is read by explorer (yes, it's the worst AV ever). It's easy to prove this, just extract FFF's WinRAR keygen and you'll see what I mean.

    [โ€“] HStone32@lemmy.world 7 points 7 months ago (1 children)

    Huh. All that security, and yet there are still so many viruses capable of infecting windows.

    [โ€“] deur@feddit.nl 7 points 7 months ago (1 children)

    Huh.... all that immune system yet there are still so many viruses capable of infecting humans.

    [โ€“] 0x4E4F@sh.itjust.works 1 points 7 months ago

    Humans are easy targets ๐Ÿ˜... we've lived semi-isolated from nature at least the last few hundred years.

    [โ€“] uis@lemm.ee 1 points 7 months ago (1 children)

    I thought it checks every file closed

    [โ€“] 0x4E4F@sh.itjust.works 1 points 7 months ago (1 children)

    No, it scans file headers when you do read/write operations on disk. Every AV works this way, except, as I said, Defender is slow AF.

    [โ€“] uis@lemm.ee 1 points 7 months ago (1 children)

    I can't find talk I watched, but I found github issue it was based on.

    Short version: Defender is triggered not on open, not on read or write, but on CloseHandle.

    [โ€“] 0x4E4F@sh.itjust.works 1 points 7 months ago* (last edited 7 months ago) (1 children)

    CloseHandle of what? Read/write operations?

    [โ€“] uis@lemm.ee 2 points 7 months ago

    Found! Even metadata chamge.