Hacker News Reader

"AI powered heuristics" are so frustrating in AV. "This program runs on the CPU. Malware often runs on the CPU! It must be malware!"

They advertise high detection rates, but the secret is just flagging everything as malware - and thus also catching the sample malware in a stopped-clock-is-sometimes-right kind of way

View on HN

What does "runs on the CPU" mean in this context? Don't all programs "run on the CPU"?

That is in fact the joke

I thought jokes on HN were forbidden by law?

No just by convention and a relatively high bar. Clever jokes get by, unclever ones are doubly downvoted.

That was their point, yes. These tools treat anything they see malware do as a potential signal of malware, without any consideration of what the activity is. Obviously they're not actually going to flag "running on a CPU" as a sign of malware, but it's a pretty reasonable parody of their methodology.

Reply on news.ycombinator.com