Should Comodo users stop using Comodo?

Status
Not open for further replies.
What makes Comodo bad herein? I've never seen Comodo doing any better than this.

Comodo would be bad if you could prove for the new CIS what you suspect about it.
For example, it would be bad if:
  • many bugs announced as fixed by the Comodo staff, were currently reported as still present,
  • known vulnerabilities were exploited in the wild for weeks/months without a reaction from Comodo,
  • bugs related to critical security settings (signature scan, autocontainment, etc.) were not patched,
  • many users who currently like Comodo started to hate it due to its flaws.
etc.
 
Comodo would be bad if you could prove for the new CIS what you suspect about it.
For example, it would be bad if:
  • many bugs announced as fixed by the Comodo staff, were currently reported as still present,
  • known vulnerabilities were exploited in the wild for weeks/months without a reaction from Comodo,
  • bugs related to critical security settings (signature scan, autocontainment, etc.) were not patched,
  • many users who currently like Comodo started to hate it due to its flaws.
etc.
Using vulnerable software and hoping for the best is like playing with a live wire, you might get lucky, but one wrong move and it’s over.
 
many bugs announced as fixed by the Comodo staff, were currently reported as still present,
You keep repeating that many bugs have been fixed, yet again this isn't true, where is the prove?
 
Using vulnerable software and hoping for the best is like playing with a live wire, you might get lucky, but one wrong move and it’s over.

If you would skip CIS for that, then using the AVs that are easily bypassed by FUDs in the wild is not any better.
In both cases, you are playing with a live wire.

Edit.
Some of us proposed a stronger solution (CF + popular AV).
 
Last edited:
If I were the CIS developer, I would reduce the number of settings and skip the most troublesome ones.
CIS is used at home, in hybrid work, or in very small businesses. It should be adjusted for those users. Advanced HIPS causes probably more trouble than benefit. The GUI seems to be overcomplicated, too.
 
Problem is that there are bugs which are not related to HIPS or settings. For instance, one can create Firewall rules based on HostName but in practice this doesn't work as it should because CIS doesn't do DNS-lookup on that HostName to get a list of valid IP's belonging to that HostName.
 
If I were the CIS developer, I would reduce the number of settings and skip the most troublesome ones.
CIS is used at home, in hybrid work, or in very small businesses. It should be adjusted for those users. Advanced HIPS causes probably more trouble than benefit. The GUI seems to be overcomplicated, too.
I would remove all settings completely, apart from a few on/off toggles.

There are no settings needed. I would also remove HIPS.

I don’t like products with a multitude of settings. When a vendor is offering high number of settings, they are trying to throw the ball in the user’s court.
 
Thread summary after reading: Comodo is still okay to use (esp. the FW).

@Andy Ful is the chessmaster.

@bazang Is the guy who thinks he knows more than he does.

@Divergent Is trying to play the victim after they didn't like what was said.

@Trident is one of the few who can debate without letting their emotions get involved.

Sometimes, we must accept the loss and move on.

Sorry if harsh; this is what I'm seeing.
 
Thread summary after reading: Comodo is still okay to use (esp. the FW).

@Andy Ful is the chessmaster.

@bazang Is the guy who thinks he knows more than he does.

@Divergent Is trying to play the victim after they didn't like what was said.

@Trident is one of the few who can debate without letting their emotions get involved.

Sometimes, we must accept the loss and move on.

Sorry if harsh; this is what I'm seeing.
I’m trying to understand, what is your actual contribution to this thread, aside from offering critiques while not fully engaged in the discussion?
 
Thank you to everyone who contributed to this discussion. The goal of the thread was to evaluate Comodo’s current products using verifiable evidence, starting from the assumption that “Comodo is not bad,” and to share experiences and research. Many of you adhered to these rules and provided useful data – including bug‑fix lists, configuration guides and personal experiences. This is exactly the kind of evidence‑based discussion we want.


However, in later pages the conversation strayed into repetitive complaints, speculation, personal critiques and calls to ban the topic. Please remember that our forum rules require respect and courtesy at all times and forbid posting purely to inflame or derail a topic. Under the thread’s rules, claims that Comodo is “lazy” or “abandonware” must be backed by solid evidence; simply repeating past points without new research is not constructive. Likewise, calls to censor discussion or invoke legal threats violate our guidelines.


There are a few ongoing problems I’d like to address:

  • Repetition and speculation: Several posts simply repeat the same criticisms without offering new research or personal testing. Constructive debate requires fresh data; if you don’t have something new to add, please refrain from reposting old points.
  • Calls to ban the topic and accusations of censorship: @bazang, I understand you feel strongly about this product, but suggesting that Comodo discussions should be banned or accusing moderators of “1984‑style” censorship is neither accurate nor helpful. Our moderation policy is about keeping debates civil and evidence‑based, not silencing opinions. We encourage criticism when it is backed by verifiable facts; we ask that all members – regardless of viewpoint – respect that standard.

We will continue to monitor the thread. Persistent repetition without evidence, personal attacks or attempts to derail the discussion may result in warnings. If you have new information or research to share – whether positive or negative – please do so. Otherwise, let’s focus on helping fellow members make informed decisions rather than on debating motives or moderation.


Thank you all for your cooperation.


----

@bazang, I want to clarify our stance in response to your concerns. This thread was set up to encourage evidence‑based discussion about Comodo. It is not an attempt to silence criticism. You are welcome to critique the product – many users have raised valid issues – but simply repeating that Comodo is “toxic” or suggesting that all Comodo discussions should be banned is not productive. Likewise, suggesting that moderation here is “1984‑style censorship” or invoking external legal claims does not reflect how our forum operates.

We’re asking that you stay within the thread’s guidelines by focusing on verifiable facts rather than speculation and by respecting other members. If you believe Comodo is fundamentally flawed, please provide concrete evidence or documented cases rather than broad statements. Continuing to post the same negative assertions without new information isn’t helpful and risks derailing the conversation.

The topic here is whether Comodo’s products are still worth using. To stay on topic, contributions should focus on verifiable facts—such as bug lists, CVEs, performance comparisons, or personal experiences with recent versions. If you believe Comodo has systemic problems, please back that up with evidence. If you don’t wish to discuss Comodo, it’s fine to abstain from the thread; asking to ban the topic is not acceptable.
 
Thank you to everyone who contributed to this discussion. The goal of the thread was to evaluate Comodo’s current products using verifiable evidence, starting from the assumption that “Comodo is not bad,” and to share experiences and research. Many of you adhered to these rules and provided useful data – including bug‑fix lists, configuration guides and personal experiences. This is exactly the kind of evidence‑based discussion we want.


However, in later pages the conversation strayed into repetitive complaints, speculation, personal critiques and calls to ban the topic. Please remember that our forum rules require respect and courtesy at all times and forbid posting purely to inflame or derail a topic. Under the thread’s rules, claims that Comodo is “lazy” or “abandonware” must be backed by solid evidence; simply repeating past points without new research is not constructive. Likewise, calls to censor discussion or invoke legal threats violate our guidelines.


There are a few ongoing problems I’d like to address:

  • Repetition and speculation: Several posts simply repeat the same criticisms without offering new research or personal testing. Constructive debate requires fresh data; if you don’t have something new to add, please refrain from reposting old points.
  • Calls to ban the topic and accusations of censorship: @bazang, I understand you feel strongly about this product, but suggesting that Comodo discussions should be banned or accusing moderators of “1984‑style” censorship is neither accurate nor helpful. Our moderation policy is about keeping debates civil and evidence‑based, not silencing opinions. We encourage criticism when it is backed by verifiable facts; we ask that all members – regardless of viewpoint – respect that standard.

We will continue to monitor the thread. Persistent repetition without evidence, personal attacks or attempts to derail the discussion may result in warnings. If you have new information or research to share – whether positive or negative – please do so. Otherwise, let’s focus on helping fellow members make informed decisions rather than on debating motives or moderation.


Thank you all for your cooperation.


----

@bazang, I want to clarify our stance in response to your concerns. This thread was set up to encourage evidence‑based discussion about Comodo. It is not an attempt to silence criticism. You are welcome to critique the product – many users have raised valid issues – but simply repeating that Comodo is “toxic” or suggesting that all Comodo discussions should be banned is not productive. Likewise, suggesting that moderation here is “1984‑style censorship” or invoking external legal claims does not reflect how our forum operates.

We’re asking that you stay within the thread’s guidelines by focusing on verifiable facts rather than speculation and by respecting other members. If you believe Comodo is fundamentally flawed, please provide concrete evidence or documented cases rather than broad statements. Continuing to post the same negative assertions without new information isn’t helpful and risks derailing the conversation.

The topic here is whether Comodo’s products are still worth using. To stay on topic, contributions should focus on verifiable facts—such as bug lists, CVEs, performance comparisons, or personal experiences with recent versions. If you believe Comodo has systemic problems, please back that up with evidence. If you don’t wish to discuss Comodo, it’s fine to abstain from the thread; asking to ban the topic is not acceptable.

A lot of comments were just purely bias instead of facts. It's like when somebody used the fact and so on, somebody interpretered the problem to other subjects anyway. In the end of the day, fixing bugs / vulnerabilities is the job of company. The bug/vulnerability report page doesn't work mean company's system is wrecked, or simply company doesn't care (anymore). That's the simple fact that some users refuse to see.
It's my 2nd or 3rd week here and the level of toxicity regarding just 2 topics about Comodo is insane.
 
I just wonder who’s asking for administrative support constantly, already twice now the forum admin is getting involved…?
The OP. Nobody else.

I bet if I create my own thread with my own rules, MT staff will quickly close it and take the content down.

My definition of "abandonware" is that if a software is not updated monthly, then it is abandoned. To me, I don't care what anyone else's definition is.


We’re asking that you stay within the thread’s guidelines by focusing on verifiable facts rather than speculation and by respecting other members. If you believe Comodo is fundamentally flawed, please provide concrete evidence or documented cases rather than broad statements. Continuing to post the same negative assertions without new information isn’t helpful and risks derailing the conversation.

The topic here is whether Comodo’s products are still worth using. To stay on topic, contributions should focus on verifiable facts—such as bug lists, CVEs, performance comparisons, or personal experiences with recent versions. If you believe Comodo has systemic problems, please back that up with evidence. If you don’t wish to discuss Comodo, it’s fine to abstain from the thread; asking to ban the topic is not acceptable.
You mean Andy Ful's rules. Well I'm not going to follow those rules because I am against any particular MT member being allowed to create a thread, say "These are rules for anybody to participate - and any rules violation will result in censure or content takedown" and they decide who violates those rules, and they get MT staff to be their police and content removal force.

@Jack I'm not being disrespectful or argumentative, but Any Ful has a history of doing this sort of thing, and it's wrong.

Also, I never said that MT moderation was "1984 Orwellian." I said that if every MT member can create a thread with their own participation/posting rules, then they dictate the thread rules and what is acceptable and what is not, and that is "Orwellian."

I do know Comodo is fundamentally flawed, but the evidence I have is from in-person meetings and conversations with Comodo executives. I did not record those conversations. I didn't get pics. Those executives did not provide me documents that I can make public. That does not mean that those meetings did not happen. But Andy Ful will argue "No pic. Then it didn't happen." And that is ridiculous.

Taking a literal interpretation of what is posted on the Comodo forum and elsewhere is the equivalent of taking the PR campaigns on the Exxon Mobil and British Petroleum Dutch Shell websites that say they are not contributing to global warming. C'mon. Any literal read of anything and then using "Spock" logic to support an argument is entirely ridiculous. The real world - reality - is far more nuanced and subtle than that. Getting at the truth takes finesse and not literal reading of anything. If we're gonna accept that literal reads are justified and make perfect sense - then here it is - NOBODY SHOULD USE ANY SOFTWARE BECAUSE THE EULAs SAY "OFFERED 'AS IS" and "USE AT YOUR OWN RISK!'". End of the question "Should people stop using Comodo?"

Andy's literal interpretations of what is publicly available is not correct. It is just a small piece of the complex puzzle.

Anyways, I leave him and others to it. I promise you, @Jack, that I will not post anymore in this thread. It is just a matter of time before it gets locked.

It's my 2nd or 3rd week here and the level of toxicity regarding just 2 topics about Comodo is insane.

Listen, I appreciate that you are a researcher, but Comodo and Melih just don't care. Arguing your points here is a waste of your time and effort. You're smart. You'll figure out that your time is more effectively spent on other products.
 
Last edited:
Some more facts:

-Comodo has no bug bounty programme.

-Comodo has been in the “anti-malware” industry for more than 20 years. Comodo hasn’t got a single malware sample discovered or reverse engineered by them and hasn’t got a single malware writeup. Whilst these do not add value to the overall protection, threat intelligence is a paramount in this industry.
Being an anti-malware vendor with no threat intelligence is like being a chef and not having your own set of knives.

-It’s hard to attribute the mere lack of negative experience (users weren’t hacked, attacked and so on) to Comodo or any product. Lack of negative doesn’t equal positive.

-The Comodo update process (regardless whether the product is abandonware or not) is anything but timely and transparent. There are no change-logs, only the most critical issues are fixed. From version 4.8 which I used (around the time of Norton 2009) to now, the only thing added to Comodo is VirusScope and Script Analysis.

-Statements that “all other products are compromised by FUDs” are very generic and broad. Whilst it’s a know fact that malware authors use staged and fragmented attacks tailored to the existing security product (which can very easily be discovered), things are more nuanced.
—To get to to the stage where attackers discover the security product, already stage1 loader needs to be running.
—It doesn’t take long before nosy vendors like Avast that extract sheer volumes of telemetry from the users (in their words 250MB average daily per user) detect the FUDs.
—In a real-world scenario, executing malware is not as easy and straightforward as downloading from a repository and executing knowingly.
—Not all attackers properly test the bypasses they deliver against all popular AVs, a lot of them just upload on Jotti (because VT is patrolled) and believe that lack of detection there is equal to lack of detection from the real product.
—Many products include additional tools to further strengthen the user protection, some of them being very close to the Comodo reputation-based protections.

Should Comodo users stop using Comodo?
That’s a personal question everyone should answer for themselves. It’s not for us to tell people what to use, they can install Protegent if they wish. The cards are on the table for everyone to take a decision.
 
Last edited:
Many people know what I think of Comodo: I don't like it because I had several problems with Windows years ago and Comodo Hips blocked its updates without warning, and its anti-malware database is poor. I have no desire to try it again; the antivirus I use is enough for me.
However, I don't rule out testing it when I can on video.

You know, I test all antivirus programs, and Comodo is one of them. I'm not going to censor myself for a product or distort a result ;) That would be counterproductive and, above all, pointless.

I chat with a Comodo member on Discord, and I understand a little why Comodo doesn't include this or that feature... It's a shame, but Comodo focuses on the sandbox aspect. That's cool, but it's not what I'm looking for :)

And no, there's no point in attacking each other. All antivirus programs have their fans and haters, but when it comes to personal attacks or censorship, I say no.

Shadowra
 
-Statements that “all other products are compromised by FUDs” are very generic and broad. Whilst it’s a know fact that malware authors use staged and fragmented attacks tailored to the existing security product (which can very easily be discovered), things are more nuanced.
—To get to to the stage where attackers discover the security product, already stage1 loader needs to be running.
—It doesn’t take long before nosy vendors like Avast that extract sheer volumes of telemetry from the users (in their words 250MB average daily per user) detect the FUDs.
—In a real-world scenario, executing malware is not as easy and straightforward as downloading from a repository and executing knowingly.
—Not all attackers properly test the bypasses they deliver against all popular AVs, a lot of them just upload on Jotti (because VT is patrolled) and believe that lack of detection there is equal to lack of detection from the real product.
—Many products include additional tools to further strengthen the user protection, some of them being very close to the Comodo reputation-based protections.

Yes, the FUD problem is an interesting and nuanced topic, which is not fully addressed in this thread. The standard view is from the developers of modern AVS/EDRs, which use advanced Machine Learning, behavioral protection, and other next-gen security layers. Sometimes it is beneficial to change the viewpoint to see the problem from another perspective (a form of mental gymnastics).

From the viewpoint of allowlisting-based security, a new FUD stream is "like an exploit" of next-gen security layers. Please do not get me wrong, the term "like an exploit" is used as an analogy because a new FUD stream has some similarities to an exploit. The exploitation lasts until next-gen machinery is sufficiently updated. This can usually last weeks or months. The particular sample of a new FUD is mainly ineffective after one day because the next-gen machinery can learn quite quickly, but FUD is usually updated after one day to avoid detection. After some weeks/months, there is a sufficient amount of morphed FUD samples to learn how to immediately recognize a new FUD sample of a particular FUD stream. In this moment, this FUD stream is "dead". After some time, the attackers can significantly modify the FUD stream, and the show goes on.

I think that currently, the most comprehensive protection is a combination of next-gen security layers with allowlisting. This is especially true in Enterprises. Depending too much on next-gen features (popular Home AVs) or depending too much on allowlisting (CIS) is not the best solution.
As @Trident noticed, some next-gen solutions use reputation-based layers based on AI (file detonation in a virtual environment, file prevalence, etc.). The problem with such protection is that the file is not examined locally but rather in the cloud. This can be abused by the attackers in many ways.
 
Last edited:
I chat with a Comodo member on Discord, and I understand a little why Comodo doesn't include this or that feature... It's a shame, but Comodo focuses on the sandbox aspect.

I think so. They cooperate with Xcitium, and the sandbox is crucial to both Comodo and Xcitium.
 
Here is an example of a difference between (1) local auto-containment with allowlisting and (2) cloud virtual environment with AI allowlisting.

(1) Unknown file is executed and auto-contained.
  • The malware does not recognize a sandbox and runs in the sandbox.
  • The malware recognizes a sandbox and behaves nicely or refuses to run. Some users can wrongly think that the file is benign and add it to the local whitelist (allowlisting is not for all users).
(2) The execution of the Unknown file is postponed. The file is uploaded to the cloud and executed/analyzed in a virtual environment.
  • The malware does not recognize the virtual environment, and it is recognized as dangerous. The file is not allowed to run locally.
  • The malware recognizes the virtual environment and behaves nicely or refuses to run. Next, it is allowed to run locally.
I skipped in (1) the events of escaping from the local sandbox and false negatives. They happen in the wild much more rarely than recognizing a virtual environment in (2).
Sometimes, when testing (1) by AV testing labs, a false negative did not cause infection in the wild (the malware was Unknown in the real attack), but it can be counted as a failure in the AV tests (a false negative signature was created before the test).
 
Last edited:
That as well is very nuanced, in addition to dynamic behavioural analysis, most of the sandboxes use static analysis and some (like Check Point) use CPU-level emulation. Malware detecting the virtual container is not a guarantee that it will evade detection. Then there are all these local layers. Often information is shared between layers, even though emulation or static analysis may not have reached the required confidence to pull triggers, very little evidence may be needed from behavioural blocking for the file to be removed, for example, a connection to paste.ee may be enough.

It’s a lot of ifs and buts, skilled attackers that are looking to bypass security layers always find a way, for them Comodo (or anything) won’t be any difference.

There are also many vectors (like Phishing) that are not handled by Comodo at all. For example Avast is capable of detecting and even categorising SCAM content in PDF files and emails (with some false positives) whereas Comodo containment will hardly help in this situation.
These solutions have evolved to offer more than just an antivirus.
 
Several posts simply repeat the same criticisms without offering new research or personal testing. Constructive debate requires fresh data; if you don’t have something new to add, please refrain from reposting old points.
That's exactly what Comodo would say "please try again with latest version" just to suppress (Comodo) user's feedback and keep (Comodo) users running around like hamsters in a tredmill labeled as "not guilty until proven" and denying the prove from the past.
 
  • Hundred Points
Reactions: Trident
Status
Not open for further replies.