Should Comodo users stop using Comodo?

[Pico]

3). Rules can be added for the Firewall module on a case by case basis (like if you want to block an application that you always use from calling Home, just change the Firewall setting to Custom, let the application attempt to connect out, and choose Block always). This is something that I always do when installing a new CF build.

You should add "Enable IPv6 filtering" to your CF settings for those users on IPv6 network otherwise Firewall doesn't work...

 

[Sephirothnight]

Hello everyone, I'm not going to hide it from you, I've been using CF since version 2. I tried other security software, known and lesser known. They all have bugs (the worst was with KIS, and on their official forum this bug had been hanging around for quite a few years, so to speak). Kerio, Sygate, Jetico, look'n'stop, zonealarm, avast, avira, etc. Some are still there, others integrated elsewhere (Sygate - Symantec endpoint). Coming back to Comodo, the bugs that I encountered are the disappearance of its icon in the bar which seems to me to be corrected because I no longer noticed it (bug known from memory with Windows 10 and Windows 11, although it was not officially compatible with Windows 11 at the time), and beautiful blue screens when resetting the container (which I still have sometimes). I tried to replace it, I often read "there are much better alternatives", okay, but which ones? No matter how hard I looked, I came back to CF, much lighter and that works (for now). Now I'm waiting to see what happens next because even if there are "flaws", bugs and others. Thank you and sorry for the rambling

 

[Divergent]

There is no evidence for general instability.



In this way, you can prove that most AVs are unsafe. Just look at their forums. There are so many unhappy people.
Comodo had significantly fewer vulnerabilities exposed than, for example, Avast.

https://www.cve.org/CVERecord/SearchResults?query=avast

However, Avast's maintenance is probably better (by opinion, I did not research this).

The real metric for a vendor's trustworthiness is not the number of flaws found, but their PROCESS and RESPONSE to those flaws.

A vendor that ignores reports of critical, remotely exploitable vulnerabilities in their security product is a massive red flag, regardless of how many CVEs they have.

So, while you are correct that Avast has more CVEs on record, the evidence suggests they have a more transparent and responsive process for fixing them. Comodo's documented failure to respond to or patch these specific, critical issues is the core of the problem. A security product must be supported by a vendor that takes security seriously, and in this case, the evidence shows a failure to do so.

 

[stonjean633]

In general it should be Proactive Approach using Secure by Design Principle and Reactive Approach by Constant Patching.

 

[Pico]

You get that more or less on the Enterprise Xcitium version for lots of $$$.
Unfortunately not on the consumer CIS version...

 

[bazang]

The real metric for a vendor's trustworthiness is not the number of flaws found, but their PROCESS and RESPONSE to those flaws.

A vendor that ignores reports of critical, remotely exploitable vulnerabilities in their security product is a massive red flag, regardless of how many CVEs they have.

So, while you are correct that Avast has more CVEs on record, the evidence suggests they have a more transparent and responsive process for fixing them. Comodo's documented failure to respond to or patch these specific, critical issues is the core of the problem. A security product must be supported by a vendor that takes security seriously, and in this case, the evidence shows a failure to do so.

Comodo as a company, and by extension every last bit of its software is problematic. Those problems greatly impact usability and the user experience. That does not even address what is fixed, what is not fixed, when it is fixed, and so forth.

Any arguments that Comodo is fixing bugs is mere speculation because nobody has visibility into that process - not even the Comodo forum moderators.

Anyhow, Comodo has now reach the all-time high, peak level of a toxic topic on MT since MT was created on Day 1.

It is pointless to debate the points any further. Everything that can be said has been said ad nauseum across 20 or 30 Comodo threads. Continuing the individual agendas and campaigns of promoting the Pros and Cons of Comodo is toxic to this community. And that is so sad because I am an absolute free speech activist. But in this case, any Comodo thread is the equivalent of toxic social media.

Further discussions of Comodo at MT only serve to spread toxicity and radicalize susceptible people.

@Jack and MT staff should consider banning Comodo discussions just like was done over at Wilders for a while. Then again, the world's nations should consider the same and only make social media available from 1 PM to 3 PM daily to control the hoomans and their nonsense.

 

[bazang]

If my life depended upon it, I would not use Windows for quite similar reasons.

If my life depended on it, and I had to choose between Comodo or Microsoft Windows, then Windows would be the far probabilistically better bet.

 

[bazang]

If my life depended upon it, I would not use Windows for quite similar reasons.
You cannot fully depend on any AV. You said it many times, if I correctly remember. Some experts even say that AV can be worse than malware (it can be sometimes).
Many people are disappointed, even with AV/EDR managed at a high level, because their efficiency is significantly lower than expectations (especially in Enterprises).

Your post is based on unofficial opinions that cannot be confirmed and can be biased. Those opinions are not strictly related to the current CIS 2025. However, they add to some other opinions (including mine) that Comodo management is not at a high level. People who require high-level management should not use Comodo.
High-level management can be crucial when uninterrupted work is important. Bugs in AV can cause downtime at work, which may result in large financial losses.

I know very well how Comodo works internally. And it is the reason for all of CFW/CIS problems.

So my perspective is fully informed with insights about Comodo that few others have.

Nobody but a security geek that knows, has the experience, and is willing to play the "Comodo Squid Game" should ever use Comodo. That's my estimation and - yes - its a professional opinion pulled from many data points, the history of the Comodo company and its products, and knowing that the average user has no idea what they're getting themselves into when they choose to use Comodo.

If @cruelsister sat next to every one of them and explained stuff, then rainbows would form, unicorns would spontaneously roam the Earth, and gold coins would reign down from the heavens, and everyone would live happily ever after using Comodo. But that is not practical even for a Knight Defender of Comodo and CFW superhero like @cruelsister.

So nothing that I've posted has trashed the thread, sent it off the rails, or was ever intended to violate your stated thread rules.

Let's all be very honest and accept reality for what it is. To @cruelsister 's credit, she posted long ago - and only one time - that they would use Comodo as long as it protected. Nobody paid attention to that single, small, easily missed post. The meaning of it is clear - there's problems, but they've not reached the threshold of @cruelsister 's risk acceptance threshold for them to abandon CFW. When that happens, they will. Not sure if anyone understands that, but it means she is not enslaved by Comodo and is willing to jump ship to another security solution - when they deem fit. As is their right.

In the meantime, @cruelsister keep posting those "fanatical, immoral, promotion videos."

 

[Pico]

Any arguments that Comodo is fixing bugs is mere speculation because nobody has visibility into that process - not even the Comodo forum moderators.

They had in the past but now not anymore so it seems...

 

[bazang]

They had in the past but now not anymore so it seems...

Even 15 years ago they did not. They just reported them. There was very limited, unclear feedback from Comodo devs. And those mods were just as frustrated as the Comodo users rage posting on the forum. The mods took a different tack though - they just threw up their arms to say "We can't do anything about the Comodo scuzzlebutt and crap show."

No offense intended with the terminology, but it is accurate.

 

[Divergent]

Comodo as a company, and by extension every last bit of its software is problematic. Those problems greatly impact usability and the user experience. That does not even address what is fixed, what is not fixed, when it is fixed, and so forth.

Any arguments that Comodo is fixing bugs is mere speculation because nobody has visibility into that process - not even the Comodo forum moderators.

Anyhow, Comodo has now reach the all-time high, peak level of a toxic topic on MT since MT was created on Day 1.

It is pointless to debate the points any further. Everything that can be said has been said ad nauseum across 20 or 30 Comodo threads. Continuing the individual agendas and campaigns of promoting the Pros and Cons of Comodo is toxic to this community. And that is so sad because I am an absolute free speech activist. But in this case, any Comodo thread is the equivalent of toxic social media.

Further discussions of Comodo at MT only serve to spread toxicity and radicalize susceptible people.

@Jack and MT staff should consider banning Comodo discussions just like was done over at Wilders for a while. Then again, the world's nations should consider the same and only make social media available from 1 PM to 3 PM daily to control the hoomans and their nonsense.

This is an incredibly important post, and it gets to the root of the entire problem. You've perfectly described what happens when a security vendor fails in its most basic duty, Communication and Transparency.

Let's break down your points, because they are the key to understanding the risk here.

"Any arguments that Comodo is fixing bugs is mere speculation because nobody has visibility into that process - not even the Comodo forum moderators."

You have just performed a perfect "Root Cause Analysis". This is the single most critical security issue at play. For any other type of software, this would be a problem. For a security product, it is a deal-breaker.

In the security industry, we have a principle called "Trust but Verify." A security vendor asks for the highest level of trust—permission to run with the deepest privileges on our systems. In return, they have an absolute obligation to be transparent about how they handle vulnerabilities.

You are right to be frustrated by this. A silent vendor creates an environment where users cannot make an informed risk assessment.

**"It is pointless to debate the points any further... Continuing the individual agendas and campaigns... is toxic to this community."**

I understand and share your frustration with the toxicity. However, the solution is not to ban the discussion, but to "change the terms of the discussion".

The debate becomes toxic when it's based on feelings, brand loyalty, or anecdotal evidence. The way to detoxify it is to anchor it to "verifiable facts". The discussion should not be "Is Comodo good or bad?" but rather, "Does Comodo meet the minimum standard of accountability for a security vendor?"

Based on the evidence of the unpatched CVEs and the vendor's documented non-response, the answer to that question is "no".

Why Banning the Topic is More Dangerous

I respect your perspective as a free speech activist, and your suggestion to ban the topic comes from a good place, a desire to heal the community. However, from a security standpoint, this would be a critical mistake.

"Suppressing Threat Intelligence:" This forum is a place where users share threat intelligence. The information about the unpatched CVEs is a vital piece of intelligence that helps other users protect themselves. Banning the topic would prevent this information from reaching people who need it, leaving them vulnerable.

"Rewarding Bad Behavior:" If a vendor learns that it can simply ignore vulnerability reports and wait for the community to get tired of talking about it, we are creating a dangerous precedent. The "only" leverage a user community has is public discussion and accountability.

"The Path Forward: Demand a Higher Standard"

Instead of banning the topic of Comodo, the community should adopt a higher standard for the discussion itself. The conversation should be relentlessly focused on evidence:

"Is there a public security advisory for this issue?"

"What is the CVE number and its status?"

"Has the vendor published official patch notes detailing the security fixes?"

If the answer to these questions is "no," then the debate is over. An unmaintained security product is not a secure product.

You are right to be tired of the noise. But the solution is not silence. It is to replace the noise with clear, factual, and evidence-based analysis. Your post does a brilliant job of highlighting why that is so necessary.

 

[Digmor Crusher]

Here are the rules of this thread.
We will use the ad absurdum proof (reductio ad absurdum), which is a logical argument that establishes a claim by demonstrating that the logical consequence of a proposition is absurd, contradictory, or untenable, thereby showing the proposition must be false.

1. The initial proposition = Comodo is not "bad" (If we end with a logical absurdity, then we will prove that Comodo is "bad")
2. Posts have to contain solid evidence of something without assuming that Comodo is bad.
3. Posts cannot contain personal attacks or attacks on Comodo users.
4. Posts cannot contain repetitive arguments without a reason.
5. Posts that do not fulfil the above may be removed.

Wasn't Andy trying to do this by setting rules for this thread. But as always Comodo threads go off the rails, they always will, people have to get their points across ad nauseam.

 

[Pico]

One can spend a lifetime trying to get the evidence which is nowhere to be found because with each new version this whole evidence-circus starts all over again...

 

[Divergent]

Wasn't Andy trying to do this by setting rules for this thread. But as always Comodo threads go off the rails, they always will, people have to get their points across ad nauseam.

It's interesting that when concrete evidence was provided, the immediate reaction was deflection. The strategy of citing other companies was paradoxical, as it inadvertently provided a benchmark that showed this company's policies are, in fact, lacking.

 

[bazang]

This is an incredibly important post, and it gets to the root of the entire problem. You've perfectly described what happens when a security vendor fails in its most basic duty, Communication and Transparency.

Let's break down your points, because they are the key to understanding the risk here.

"Any arguments that Comodo is fixing bugs is mere speculation because nobody has visibility into that process - not even the Comodo forum moderators."

You have just performed a perfect "Root Cause Analysis". This is the single most critical security issue at play. For any other type of software, this would be a problem. For a security product, it is a deal-breaker.

In the security industry, we have a principle called "Trust but Verify." A security vendor asks for the highest level of trust—permission to run with the deepest privileges on our systems. In return, they have an absolute obligation to be transparent about how they handle vulnerabilities.

You are right to be frustrated by this. A silent vendor creates an environment where users cannot make an informed risk assessment.

**"It is pointless to debate the points any further... Continuing the individual agendas and campaigns... is toxic to this community."**

I understand and share your frustration with the toxicity. However, the solution is not to ban the discussion, but to "change the terms of the discussion".

The debate becomes toxic when it's based on feelings, brand loyalty, or anecdotal evidence. The way to detoxify it is to anchor it to "verifiable facts". The discussion should not be "Is Comodo good or bad?" but rather, "Does Comodo meet the minimum standard of accountability for a security vendor?"

Based on the evidence of the unpatched CVEs and the vendor's documented non-response, the answer to that question is "no".

Why Banning the Topic is More Dangerous

I respect your perspective as a free speech activist, and your suggestion to ban the topic comes from a good place, a desire to heal the community. However, from a security standpoint, this would be a critical mistake.

"Suppressing Threat Intelligence:" This forum is a place where users share threat intelligence. The information about the unpatched CVEs is a vital piece of intelligence that helps other users protect themselves. Banning the topic would prevent this information from reaching people who need it, leaving them vulnerable.

"Rewarding Bad Behavior:" If a vendor learns that it can simply ignore vulnerability reports and wait for the community to get tired of talking about it, we are creating a dangerous precedent. The "only" leverage a user community has is public discussion and accountability.

"The Path Forward: Demand a Higher Standard"

Instead of banning the topic of Comodo, the community should adopt a higher standard for the discussion itself. The conversation should be relentlessly focused on evidence:

"Is there a public security advisory for this issue?"

"What is the CVE number and its status?"

"Has the vendor published official patch notes detailing the security fixes?"

If the answer to these questions is "no," then the debate is over. An unmaintained security product is not a secure product.

You are right to be tired of the noise. But the solution is not silence. It is to replace the noise with clear, factual, and evidence-based analysis. Your post does a brilliant job of highlighting why that is so necessary.

Banning anything is the nuclear option of very last resort.

Take the cyanide capsule before hitting the red "ban" button.

Said in jest, but serious.

 

[bazang]

Wasn't Andy trying to do this by setting rules for this thread. But as always Comodo threads go off the rails, they always will, people have to get their points across ad nauseam.

So what? They get the last word or strenuously do stuff.

You don't have to read any Comodo threads.

Your problems are solved.

 

[Digmor Crusher]

So what? They get the last word or strenuously do stuff.

You don't have to read any Comodo threads.

Your problems are solved.

Was I talking to you? But maybe you should stop replying to them and make everyone happy.

 

[bazang]

Was I talking to you? But maybe you should stop replying to them and make everyone happy.

It is a public forum. If you make a post, then you naturally are desiring a response.

No. I don't think I will allow anyone to censor me, no matter how much it bothers you.

I am not the problem. You are.

The solution is for you to stoping reading the thread posts, instead of silencing MT members by complaining and smashing the Report button, and other means.

 

[Andy Ful]

@bazang and @Divergent,

I am afraid that @Digmor Crusher is right. This thread has some rules caused by the logic explained in the OP.
Most of what you both posted either contradicts the rules of this thread or is untrue.
You probably cannot accept that the proof method in this thread forces us to initially believe in the statements of the Comodo staff about the new version of CIS, if there is no solid evidence that the Comodo staff is wrong.
I can understand this because you believe, based on Comodo's history (you have the right to do it), that Comodo and CIS 2025 are similarly invalid as in the past.
However, in this thread, we try to prove it (if possible) and not just believe in it.

For example, let's analyze the statement below used by @bazang.
STATEMENT: "Any arguments that Comodo is fixing bugs is mere speculation because nobody has visibility into that process - not even the Comodo forum moderators."

However, Comodo staff announced that 40 older bugs are no longer present in the new version. This contradicts the STATEMENT, except when one assumes that Comodo lies (Comodo is bad). So, the STATEMENT is untrue or contradicts the rules of this thread.
Furthermore, there is no evidence that most of the older bugs were not fixed (no such reports). The lack of visibility into the process of fixing bugs does not prove that all the bugs are unfixed. I confirmed two issues that were silently fixed in the new CIS version. I have the full right to insist that the STATEMENT is untrue.

I will not analyze your other statements; you can do it by yourself.
Unfortunately, your last posts do not bring anything interesting to this thread. Of course, the same posts can be valuable in other threads about Comodo, which can use another logic of proof.
If you cannot accept the rules of this thread, please stop posting here. If you have something interesting to say, please post without breaking the rules.

 

[Andy Ful]

One can spend a lifetime trying to get the evidence which is nowhere to be found because with each new version this whole evidence-circus starts all over again...

You and some others use extreme arguments that can be easily disproved. For example, when you say that all bugs are unfixed. I know one bug and one vulnerability that were recently (silently) fixed. This significantly decreases the strength of your argumentation.