Do You Really Need to Pay for Antivirus Software on Windows?

Quick Answer: No. Windows Defender offers decent protection while being free, conveniently updates via Windows Update, and is not a huge resource hog.

Long Answer:

Anti-virus software has been available for a long time. For years, people paid for virus protection via a subscription service.

Over the last 10 or so years, free anti-virus software such as Avast, Avira, Windows Defender, AVG, Malwarebytes (the free, non-premium version), etc. have taken a hold of the market. Now I have used all of the above mentioned anti-viruses. They are all pretty good (AVG, for me, ran on the slow side), but my favorite of the bunch is Windows Defender.

Now I do not have fancy charts, data sheets, graphs, etc. to show the “awesomeness” of Windows Defender. What I can tell you is I am running it on several Windows boxes without any trouble or noticeable slowdown.

None of the boxes have had a successful virus intrusion – while running Windows Defender – for the past 3+ years. False positives for me are pretty much non-existent, and I do not have to think about updating Defender, since Windows Update takes care of that automatically.


Q: What advantage would a paid anti-virus software give me that a free one won’t?

A: Pretty much just support. No guarantee of getting support with free software, but with paid software they kind of have to give support, at least if they want to stay in business.

Everything else – including anti-virus definitions (updates) – are good with both paid and free software.


Q: Are there any open source anti-virus software out there for me to use?

A: The only one I would recommend is ClamAV. However this is not a proper anti-virus solution for most people.

It has no real-time scanner, has a minimal amount of definitions (from my experience, will catch almost nothing out-of-the-box), and has no graphical user interface for you to use (yes, you will be manually editing a configuration file with a text editor), and it will catch several false positives if you are not careful.

This is not a user-friendly software solution. It is geared towards servers and server administrators to set it up properly.


Q: Do any of the mentioned anti-virus software have any back-doors, spyware code, etc. in them?

A: I really do not know, but I would never discount the possibility. The only solution that should not have any “spy” code in it would be ClamAV, but as mentioned before, ClamAV is very non user-friendly and will cause headaches to people who do not know what they are doing.

Unfortunately all the good free anti-virus software is closed-source. I can understand this, because no company wants their trade-secrets exposed to the entire world. This would not be good for business!

Also – just a quick note – I personally would avoid the Kaspersky anti-virus software. They are based in Russia, and I would not trust any Russian software on my computer. I have nothing against the Russian people themselves, I just don’t trust their government not to spy on me. Just a thought.


Posted in Computers, Internet and Servers, Operating Systems, Security, Software

Should I Use Another DNS Server?

Should I switch my current DNS server?

If you are just a regular Internet user (not self-hosting anything), and you are currently using your ISP’s DNS server, I would switch to a 3rd party DNS service (e.g. Cloudflare).

However if you are self-hosting anything (e.g. email), then I would opt for running my own DNS resolver for reliability.


Here are my opinions on the three typical ways to get DNS.

ISP DNS Resolver:  usually OK performance / no privacy

  • Works out-of-the-box with your Internet service.
  • Since you are using servers they control, always assume your ISP is logging your DNS requests (no privacy).
  • Sometimes an ISP actually has worse DNS servers (slower, less secure) than a 3rd party DNS service.
  • Many years ago, I made use of my ISP’s DNS resolving services. They would occasionally go down – every few months. It made it look like the Internet was “down”, but it was just their DNS resolvers that were down.

Third-Party DNS Resolver (e.g. Cloudflare, OpenDNS):  good-to-excellent performance / potentially less private

  • 3rd party DNS server may be logging your DNS lookups, regardless of what their Privacy Policy says.
  • Can be faster than your ISP’s DNS resolvers. This is due to 3rd party DNS services having a very large network infrastructure. They can handle large amounts of traffic with ease.
  • Cloudflare does support DNS-over-TLS. However this is just encrypting your connection to Cloudflare. When Cloudflare retrieves the DNS records for you – assuming they do not have a cached copy – that connection of theirs is unencrypted. This means the DNS records Cloudflare gets for you can be manipulated by a 3rd party, outside of Cloudflare’s control.
  • Any server hosting a website using SNI (Server Name Identification) – without using the TLS 1.3 protocol – will give the domain name you are accessing in plain-text for anyone to see. This defeats the purpose of using an encrypted DNS service.
  • Can help get around DNS blacklists your ISP may have implemented.
  • Unless you are using a VPN service, your ISP will still have to route your connection to the website. This may give away where you are going on the Internet, even if your ISP cannot read your DNS queries.

Self-Hosted DNS Resolver (e.g. Unbound DNS):  OK-to-good performance / potentially more private

  • Useful if you want to have reliable lookups, since your are cutting out the middle-man handling your DNS requests.
  • If you are self-hosting web services (e.g. web and email), it is recommended to run your own DNS resolver. While not necessary, this will help prevent interruptions to your services.
  • While there is no worry about the DNS server keeping logs (you are running it, after all), there still is the possibility of your ISP and/or other entities sniffing your DNS lookups and keeping a log that way. This is because DNS is inherently insecure (not encrypted).
  • Unbound runs on FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows.
  • Unbound DNS does require some knowledge of DNS to be setup properly.

Summary Chart

Easiest out-of-the-box solution | best for people who just want things to workISP DNS servers
Best performance | good for people who want more performance than what their ISP provides3rd-party DNS (e.g. Cloudflare, 1.1.1.1)
Best reliability & maybe a little more privateself-hosted solution (e.g. Unbound DNS software)

Posted in Computers, Internet and Servers, Operating Systems, Security

The Windows Command Prompt is not DOS

A while back, I read on a website that the Command Prompt on the NT-based versions of Windows are somehow from MS-DOS. This is a myth.

While the Command Prompt (cmd.exe) does copy the commands from the MS-DOS (command.com) command line, this does not make the Command Prompt in Windows NT in any way, shape, or form, related to MS-DOS.

For example, I could write a C#.Net console application that mimics Linux bash commands, but that would not make my application “bash”.  I am just mimicking the commands from bash. The same applies for the Command Prompt on the versions of Windows NT. The Command Prompt may use the same commands as the MS-DOS one, but that does not make it DOS.


Here is a bit of information some people may find interesting.

32-bit Windows NT operating systems (e.g. WinXP, WinVista) can run DOS programs due to having a built-in 16-bit “NT Virtual Dos Machine” otherwise known as NTVDM. This allows people to run DOS programs (even full-screen ones) without much problems.

However the 64-bit versions of Windows do not have NTVDM. For the 64-bit Windows operating systems, an emulator (e.g. DOSBox) is required to run DOS programs.


Posted in Computers, Operating Systems, Software

How Secure are JavaScript Password Generators?

Many people use online services to generate secure passwords.

There is this idea that since your web browser is the one generating your passwords locally on your computer (via JavaScript) instead of someone else’s computer (e.g. web server), this is supposed to keep someone from getting a hold of your password.

Is this really the case? Are passwords generated locally with JavaScript really secure from being stolen?

Technically, no. Why? Well there are a few reasons why generated passwords (via JavaScript) can be compromised.


the [Math.Random] JavaScript function  –  Any JavaScript password generator that uses this function should be considered insecure. This is because the Math.Random function does not provide cryptographically-secure results. It is even possible to predict the output of Math.Random.

This means that someone could potentially generate the same password that you just generated a week before. Not the best for people who want to have secure passwords.

A good, secure alternative JavaScript function to use is window.crypto.getRandomValues(array).

Summary: Using any JavaScript password generator that makes use of the Math.Random function is not wise.


web browser add-ons  –  Many people use web browser add-ons (such as Ad-blockers) for their everyday browsing. What most people are unaware of is that many of these add-ons have permissions that allow the add-on to view the content of the web pages the user is viewing.

The problem? If someone has installed a malicious add-on, their “secure” JavaScript generated password would have been sent to the add-on’s creator. Now I am not implying that every single web browser add-on does this, but there is a very high potential that this can happen.

Would only using open-source browser add-ons be a safe option? Well open-source add-ons would definitely lower the chance that someone would get away with spying on you. However open-source projects do not have a spotless security track record either. There is still some risk.

Even Mozilla themselves warn about this problem with web browser add-ons (also called extensions).

Update 12/05/2019:  Here is another example of what I am talking about (https://www.zdnet.com/article/mozilla-removes-avast-and-avg-extensions-from-add-on-portal-over-snooping-claims/).

Summary: Several add-ons have the potential to spy on their users (including locally generated JavaScript passwords).


computer malware  –  This reason is arguably the most common cause of compromised passwords…malware. Malware has the potential to do anything it can to your computer (including reading your computer’s clipboard – what you copy & paste). This will instantly compromise your JavaScript generated password (and any other sensitive information on your computer, e.g. credit card numbers).

While Windows-based systems have more malware available for them, Mac and Linux are not completely in the clear either. As more people start using these other OSes, more and more malware will be created for them.

Android (the very popular Linux OS used on smartphones all over the world) has a good number of malware created for it.

Summary: Computer malware has the potential to instantly compromise your JavaScript passwords.


surveillance software  –  Some people have to use computers provided by their employer. Some employers put surveillance software onto their computers to track and monitor their employees’ usage of those systems.

The tracking software will monitor your computer screen, keystrokes, what you browse, install, etc. In other words, any generated password (JavaScript or no) on these computers will be compromised. It is advised to use non-work computers for generating passwords, or anything else that is not work related.

Summary: Assume any work computer is being tracked. Always use your own personal computer for anything non-work related.


So does this mean that I should never use any online password generators at all?

No, but just keep in mind that a JavaScript password generator, while technically a little more safe than having your password generated on a server and sent across the Internet (using TLS encryption), does not really provide a lot of extra security.

Summary: Using JavaScript (or anything else) to locally generate passwords on your computer, cannot keep your passwords completely safe from being compromised.


Posted in Android, Computers, Internet and Servers, Operating Systems, Programming, Security, Software