Chris Palmer on Nostr: The government needs to adopt modern risk management and abandon checkbox compliance. ...

The government needs to adopt modern risk management and abandon checkbox compliance. AV hugely increases the amount of soft, privileged attack surface on a system, and is rarely — if ever — engineered to modern standards. In addition, it complicates rather than eases platform security engineering (insert beer, receive war stories).

There are damn good reasons modern platforms simply don't allow, or need, AV.

https://arstechnica.com/security/2024/08/oh-your-cybersecurity-researchers-wont-use-antivirus-tools-heres-a-federal-lawsuit/