Carl Tyler's Blog

1 - Why are you leaving virus checking in place on your Notes executable directory at all? Disable virus scanning on the whole /framework/ folder structure and get your time back.

2 - @1 That's what I have done, that's what I'm saying to do. I don't like it though. Clever virus writers have a way of figuring out ways to use holes like this, it's just a matter of time.

3 - @2 - When the community first started talking about running virus scans on the JARs, I checked with the dev team as to whether they were doing MD5 signature checks on loading, since they do include all the hashes with the packages. The answer was "not yet." I don't know if they'll be starting in 8.5, but once that's in place, then there's pretty much no reason to run elaborate AV software to monitor. File signatures will prevent injection into the packages.

4 - "disable virus scanniung" counts as a hack. and a bad one at that.

5 - @3 I'm not really worried about the IBM packages. It's bad stuff from somewhere else I worry about.

6 - @4 I'd agree. A big stumbling block for approach of turning it off, is that most corporates security groups won't even consider the idea.

7 - It is a workaround and as with every workaround chances are high that a huge amount of customers will not make use of it. Anyway most of the time I am using Notes 8 classic so no extra time for me

8 - Whoa whoa whoa... by who's standard is "turning off AV" a hack? It's the AV packages that don't have sense enough to keep a file signature on a JAR to verify that it's unchanged since the last time it was unpacked and scanned. That's not IBMs fault -- unless you want to blame them for using JARs in the first place.

You guys sound like end-users blaming Notes because they have the wrong printer drivers installed.

9 - It's not so much that it's a hack. The problem is that it's a battle. It's a battle between the Notes guy and the IT security guy, who is paid for two things: his paranoia, and his ability to say "No!". Guess who is going to win that battle?

10 - We don't scan the Notes stuff on read but do scan on write. This give us the speed but if something is going to write something malicious it should get caught.

11 - It's the AV vendors that are failing to account for application models that are constructed in this way.

12 - @8/@11 Yep, and this AV behaviour is VERY well known, so IBM should have designed around it. They didn't/don't, so there's a .hack. to deal with an application design choice.

It is what it is.

13 - @12 - Wow. What an amazing conclusion.

"AV vendors suck are unresponsive to real-world needs, and IBM should have anticipated that, and reformulated their entire product strategy to focus on uncompressed executables that are automatically loaded by the operating system at boot time."

I mean, that's what you're saying, right? 'Cause there's a reason Adobe, Apple, Microsoft and Google all try to force you to load their heavyweight frameworks at OS boot time, instead of on demand.

Why not just go for the gusto and say "IBM should have known that Windows took a eternity to boot. They should have anticipated that and released Notes 8 only for OS X and Linux."

After all, both those platforms load dramatically faster than Windows.

14 - @13 You're putting words in my mouth that I didn't say.

If you know (or should know) about a certain behaviour and ignore it in your design and someone comes up with a workaround that addresses it, that's a hack.

That's all I said.

Permission to return to earth granted.

15 - @14 - Craig, what you said was "Yep, and this AV behaviour is VERY well known, so IBM should have designed around it."

So please.... enlighten me... what's the design that would have gotten around that? Make sure you come up with something other than what I put in your mouth.

(Man, there's a dirty joke in there -- and that's where it will stay. )

16 - @15...
Ah, I see the trap now.
If I don't come up with the exact code they should use, them I'm in trouble.

I'm gonna stand by my baseline belief that turning off desktop virus scanning is a bad idea, software that prefers/needs it off could be better designed, and 'workarounds' that advise it are hacks.

<crunch> my teeth snap shut on your trap (and your dirty joke). And I spit out.... well...

17 - Good to see no one has an issue with the Open menus

#15, Well I wonder if they extracted all the class files out of the jar files things would load quicker? I mean the key reason for JAR files was for moving them across the network in a compressed state, that isn't really the thing for Notes.

IBM claims to have the best and the brightest consultants in the world, they have more patents than any other company/entity each year, they don't have any big brains that can figure out new ways ? Are they tied to the limitations of eclipse, they can't enhance eclipse anymore or they can't figure out ways of working more efficiently? If 8.5 is faster, they must have figured something out, but is it faster with AV still turned on?

The thing to remember here, is Notes does not exist in a vacuum, it is compared to other applications that run on a persons machine, and right now people who use Symphony and Notes think they are hideously slow.

I was at a birthday dinner Thursday night and the person sitting next to me goes "Urgh, we use Notes 8, I start it up and go make coffee, I come back and print out my calendar, then I shut it down as it takes up so much memory and is so slow". She had no idea she could use -sa option to basically make it run how it used to, but then why would she, she's an end user, do you think end users know about disabling folders for virus scanners, do you think most end users are comfortable with the idea of turning off something in their virus scanner? They don't see themselves having to do this with other apps, so they wonder what makes Notes so special.

18 - @17 - Ah, a real suggestion... keep the .class files in the native OS. I like that idea, Carl. I might try it out manually.

As far as the party anecdote goes, where is this woman's help desk and administration team? She's not the one that should be disabling AV monitoring on her /framework/ folder. They are.

But, of course, it's the product's fault that there's yet another crappy implementation.

Blaming Notes for being slowed down by AV scanning is like blaming a Ferrari for being slow because you're driving in a 35MPH zone. You've accepted the artificial constraint, but you want the product to automatically overcome it for you somehow. You could just as well be saying "Ferrari knows most of us live in neighborhoods with a speed limit of 35, so they should make it so the car can fly so I don't have to be on the road."

Frankly, I suspect the only reason anyone's blaming IBM is because there's a shot IBM will actually listen. None of us are going to convince Symantec, McAfee, Kaspersky or Microsoft themselves to make their products not suck.

But if it's really such a catastrophe to turn off AV to getter performance out of your applications, how about moving to an OS where desktop AV isn't a necessity? In a Microsoft-free environment, no one would regard this as a risk.

19 - @18 Anecdotes are great Nathan, but they're made up. My party story is the real world not a hypothetical. It's hard to argue with hypothetical that's why fox uses them so much. Where as real world stories are fact.

We can argue all day that they AV companies are at fault, but again, if a user sees the likes of the companies you list up against one IBM, you don't think they'll be thinking how can they all be wrong and IBM is right?

You're also missing something else, even without AV scanning, Notes, Sametime and Symphony load time is hideous compared to equivalent applications. Another Fox tactic, change the issue to something else.

20 - @19 *ahem*

anecdote
French, from Greek anekdota
: a usually short narrative of an interesting, amusing, or biographical incident

{ Link }

And I'm not the one who brought up virus scanning...

By the way, although I don't like doing it, as it leaves a window of exposure on my machine, but turning off virus checking on the Notes program directory makes a huge difference in load time. The Eclipse based Notes consists of hundreds of tiny plug-ins which are jar files, each of those jar files is treated as a zip file by most virus scanners, so when you load notes, the virus scanner has to do the equivalent of unzipping each jar file and then scanning the contents for viruses, that's an expensive operation.
emphasis added

And you know what's a truly weak rhetorical technique? Associative fallacy. { Link } Apparently Rupert Murdoch is the new Hitler. Accuse someone of behaving like Fox News and you've invoked the post-9/11 version of Godwin's law.

Which means any meaningful conversation is over. Good day to you, sir.

21 - Yes, I think the menus are horrible and confusing.

@Nathan - The issue is that this became a recommendation in the first place. Notes 8 load times were horrible and IBM suggested turning off antivirus scanning as a way to speed it up. That is not an acceptable solution, so IBM needs to find another one. It's not the AV software vendor's fault, they're doing what they're supposed to. It's IBM's fault for using the wrong deployment scenario that conflicts with established and well-known security safeguards.

In your example it would be like living in a town full of 35 MPH speed limits and buying a Ferrari then bitching about the speed limit. You knew that when you got the car. IBM knew the playing field when they created Notes 8 so it's up to them to play by the rules. It's absurd to expect everyone else to change to accommodate them.

22 - @17 Ah, that topic.

Yes, the menus are confusing, and the confusion gets worse when you add in the "Advanced Menus" toggle.

I understand why you'd logically want "Lotus Notes Application" under File > Open, but it should also be under File > Application. It doesn't hurt to have it in two places. Makes you wonder why 1 of the '800 people working on Notes' didn't notice it.

And I won't even start counting the times the framework somehow forgets that I'm in Notes and starts showing me RCP menus (although that has gotten better in 8.0.1).

Notes 8.0.1 Standard is the coolest, most full-featured client yet.

Notes 8.0.1 Basic is the most stable, fastest client yet.

Maybe they'll meet one day?