Thanks Roderick, Lepa.
Yes, Zelda connects to Github to check latest version.
(sorry for the long slightly-offtopic post, but I think this needs clearing up as there are misconceptions floating around)
Note that Defender SmartScreen is not an antivirus, it's just another security module in the Defender family. It can also be disabled in Defender settings, under "App & Browser control" (in fact, ALL defender modules can be permanently disabled one way or another, but only do so if you know what you're doing). Norton also has a module that does the exact same thing as SmartScreen so there's no need to have both active (Norton Lifelock? WTF... perfect name for the pandemic!). Note that Norton also has multiple modules than can be independently disabled - it's not called Norton AV, it's Norton Security.
Here's a rundown of the differences between modules:
Smartscreen: when a new/downloaded app is starting for the first time, Smartscreen sends the app name, hash and digital signatures to Microsoft to check if this is a known file. So any new executable file can trigger it unless it's from a well known publisher. Smartscreen also does the same for every webpage you visit (with IE/Edge), making your browsing a bit slower - Chrome does the same for URLs and downloads. As an added bonus they get to keep an entire history of everything you execute and every site you visit. I wonder why I turn it off...
Antivirus: This is purely local. It searches the file to check if it contains any signature (byte-sequence) of known malware, using a signature database which contains millions of signatures and is updated frequently. While Smartscreen only checks the initial EXE (and only by filename/hash), this one checks the entire contents of the EXE, and also checks all files that the EXE opens while it's running (hence the general system slowdown). This is where it can easily trigger problems for MC and other apps, because Video and Audio data are so large and random that they can easily contain one of the byte sequences recognized as known malware (some are very short), and then the file access is blocked. If the app is not expecting the access to be blocked, it can crash when this happens.
Antivirus goes yet a bit further to try to detect new/unknown threats: it tries to detect unusual activity from new EXEs (like network/web access, system folder/file accesses, registry writes, keyboard capture, etc), and if it considers the activity suspicious it will upload the EXE to their servers so that it can be analyzed. This behavioral, non-signature-based analysis is what is called "Heuristics". While this is a good method to find new threats, I find it extremely lacking and finicky - it often fails to flag known malware like ransomware, while at the same time uploading innocuous files over and over just because they lack a digital signature or contain the sequence "BTC" inside. YMMV with different antivirus. All of them can be disabled, including Defender, but it's good to have one. Some allow disabling heuristics, at least in the old days.
Firewall: This is just a control of all network connections made to/from an app, blocking unexpected connection requests or asking for authorization when needed (and configured to do so). Never disable it for internet access, of course. It's also useful to find out what a given app is up to, as you've highlighted above. A badly configured firewall also analyzes connections within the PC itself (applications/modules talking to each other via "localhost"); this should not be blocked and can easily cause applications to stop working, so usually the firewalls are automatically configured to ignore localhost<>localhost traffic.
I find Defender AV to be one of the most balanced out there in terms of speed, unobtrusiveness and having good detection capabilities. Norton and Karspersky have become a slow bloated mess (as McAfee did). In the old days I used ESET and Trend a lot (more enterprisey products), but as an individual user I find Defender more than adequate - but you do need to exclude many filetypes from scanning if you want a fast PC; I usually exclude all media types (*.mp3, flac, avi, mkv, mp4, etc), compressed archives (7z, zip, rar), and a few more. I've had zero problems with MC, I don't even exclude it from scan. Defender Firewall is also good and enough, so nowadays I don't install any other security product.
Author
Topic: ZELDA v1.0 released (Expression Language editor) (Read 33515 times)