Serious Discussion Why does the Comodo "Disappearing HIPS rules" bug require a complete source code rewrite?

"Your dismissal of concerns about MT’s image overlooks the broader responsibility shared by all community members—not just owners. A platform’s reputation is shaped by the quality of its discourse, and when discussions stray from constructive engagement, it affects everyone who values the space. Calling out a strawman doesn’t negate the relevance of maintaining standards. Ownership isn’t a prerequisite for caring about the integrity of a community—participation is."
Nice try, but nah. There is no "broader responsibility shared by all community members."

The only pre-requisite to what is and what is not acceptable on a resource is ownership. Not participation.

Sure it's good enough for any forum and any site. It generates click-bait, content doesn't matter.
The AI have read does not generate "click-bait" content.

Definitely not my agenda, I got no gains from the Comodo game.

I really don’t care.
You've ready my content. I sure ain't here for no high-minded debates about anything.

But MT members dictating whose content is acceptable and when a thread should be closed should never be allowed to happen by MT ownership. Of course, the MT owner could claim "I agreed with the MT member request" but that would be disingenuous. Owners here - unless something has changed - would prefer to stay out of it and allow threads to run for as long as they don't violate Terms of Service.

Nowhere in the MT Terms of Service does it state "Use of AI is prohibited to generate any content and any MT member does use AI to generate content and post that content is in violation."

There are a few MT members that work really, really hard to ensure the AI they use does not generate click-bait garbage. It's quality stuff - 100% credible sources.

Anyways, there's nobody here except for one person who tried to use AI for feckless, impotent retort - but even if garbage AI was used, I just don't care.

People better get used to others using AI - good, bad, or evil - because that is the thing nowadays. If they're triggered by AI use, and its use is going to be prohbited, then at some point in the near future, MT owners will have to shut down 100% of all threads.
 
Last edited:
  • Like
Reactions: Halp2001
It is unclear if this HIPS problem with disappearing rules is still present.
It is on the list of bugs that could not be reproduced in CIS v12.3.1.8104 Beta (Comodo staff information in January 2024).
I checked all reports on bugs in 2024-2025, and there were no user reports about erased rules during system shutdown.


However, this rule is included on the list of bugs created afterwards in August 2024 by a moderator on the Comodo forum.
I posted those two lists in another thread:


It is possible that the moderator collected the bugs from older posts and did not notice that it is not actual in the newer CIS version.

However, several HIPS issues (not necessarily bugs) were reported by users:

One of the users posted his opinion on HIPS issues:
 
Last edited:
However, this rule is included on the list of bugs created afterwards in August 2024 by a moderator on the Comodo forum.
I posted those two lists in another thread:

Should Comodo users stop using Comodo?
It is possible that the moderator collected the bugs from older posts and did not notice that it is not actual in the newer CIS version.
Or maybe they thought they fixed (they created an executable that writes and deletes rules continuously and restarted a few times). The bug probably didn’t manifest and was later on reported again.

Anyway, even if they did not notice it was fixed and readded from posts, this shows that Comodo cares very little about bugs, they don’t keep any internal records of the bugs. If they don’t bother to create one Excel sheet, this shows clearly the kind of business Comodo is.

Both scenarios speak volumes to people that understand business operations (not people who’ve spent their life working on technical bits and bobs).

Comodo on the inside is the typical representation of “Fawlty Towers”, if anyone has seen the series they would understand the meaning of it.

 
It is unclear if this HIPS problem with disappearing rules is still present
Any HIPS module, even the most restrictive (Paranoid), can be bypassed with some (little) effort. And as any HIPS Module can be a source of bugs and without doubt cause user confusion, the best practice is not to employ it. It certainly is not needed in CruelCF.

So for those that take issue with Comodo's HIPS:

Ophela- Meghan, it hurts when I do this...
Meghan- Then don't do that.

Resolution...
 
Any HIPS module, even the most restrictive (Paranoid), can be bypassed with some (little) effort. And as any HIPS Module can be a source of bugs and without doubt cause user confusion, the best practice is not to employ it. It certainly is not needed in CruelCF.

So for those that take issue with Comodo's HIPS:

Ophela- Meghan, it hurts when I do this...
Meghan- Then don't do that.

Resolution...
I’m gonna have to agree (even though it doesn’t happen often). Comodo HIPS performs best when it’s off (which I believe it is by default). Anyway, does anyone wanna be HIPS-ationed this day and age?

Don’t reply “only people that truly care about security”. 😆
 
It is unclear if this HIPS problem with disappearing rules is still present.
It still exists. It has never been fixed and there's an old post somewhere on the Comodo forum where Melih states it will never be fixed because he ain't paying for an entire source code re-write.

It is on the list of bugs that could not be reproduced in CIS v12.3.1.8104 Beta (Comodo staff information in January 2024).
The bug is easily reproduced.

1. Set HIPS to Paranoid Mode.
2. Create an Allow or Block rule at every HIPS prompt (as the user wishes - it does not matter and I'm not interested in debating about how to use HIPS).
3. Eventually, within 48 hours, all the HIPS rules created will disappear.

The rules database has a fatal flaw that causes all the rules to disappear.

Any HIPS module, even the most restrictive (Paranoid), can be bypassed with some (little) effort.
Containment can be bypassed with some (little) effort.

And as any HIPS Module can be a source of bugs and without doubt cause user confusion, the best practice is not to employ it.
Then the HIPS feature should be removed from Comodo.

It certainly is not needed in CruelCF.
True, but your configuration - at least partly by intent - is configured to avoid many bugs, while at the same time ignoring how some want to use the product.

So for those that take issue with Comodo's HIPS:

Ophela- Meghan, it hurts when I do this...
Meghan- Then don't do that.

Resolution...
True, but it is dismissive of how others want to use the product - specifically use the HIPS. Telling anybody to use a security software product a particular way, at least in your case, well meaning, efficient, and effective - still it is not helpful for those that got issues with decades old unfixed Comodo bugs.

They would do well to learn acceptance. That's their own journey of self-discovery and enlightenment. Out of scope (OOS) for this discussion.
 
  • Hundred Points
Reactions: Pico
Or maybe they thought they fixed (they created an executable that writes and deletes rules continuously and restarted a few times). The bug probably didn’t manifest and was later on reported again.
Haibo Zhang, one of the old VPs at Comodo - he and I had multiple online meetings about the issue - and it was clear that the disappearing HIPS rules bug will never be fixed. The fixes require an entire source code rewrite from Square 1. In other words, a complete product re-design.

Now you know Melih is never going to do that - both "just because" and for other reasons, the greatest of which is financial.
 
  • +Reputation
Reactions: Trident
Anyway, does anyone wanna be HIPS-ationed this day and age?

Don’t reply “only people that truly care about security”. 😆
No one does in reality, you have a few old security folk from back in the day and enthusiasts but otherwise there is a reason why it's died out.

The problem with HIPS is not the protection, it's the prompts. You get prompt fatigue and then let go of something malicious. That's why the tech died/mutated.

Control is great until you realize you can't control 10000000 different edge cases with 10000000 different types of software..
 
  • Hundred Points
  • Like
Reactions: rashmi and Trident
No one does in reality, you have a few old security folk from back in the day and enthusiasts but otherwise there is a reason why it's died out.
It died out because people cannot handle it. That's not a reflection on HIPS. It is a refection on people - the same as people killing themselves slowly because they eat "heart clog" daily in copious amounts and live ridiculously sedentary lives. The typical person ain't got the skillz to cope with HIPS.

HIPS can be extremely effective providing some of the highest levels of security.

HIPS did nothing wrong. The people who cannot handle it did something wrong. They are the problem. Not HIPS.

Control is great until you realize you can't control 10000000 different edge cases with 10000000 different types of software..
Control is amazingly effective when done correctly. Just don't adopt the "users want to use stuff" dinosaur model. Lock the users out and protect them from themselves.

Not popular. At least partially anti-captialist in that it reduces the profit potential. But hey, Apple made it work like crazy until some minor game developer whined and complained to the courts and thereby ruined Apple's high quality security for everybody else.
 
The same could happen at containment prompts when a user makes a selection mistake and something malicious runs uncontained.
HIPS can be used in such cases as an additional protection layer.
 
I hope that this thread would close quickly as it seems that it only produces more flame mostly irrelevant of the topic
It seems that discussion is on right track again.

I have checked HIPS rules cleanup bug with latest CIS build, and yes, it's still present with enabled rules auto-creation for safe apps. It definitely shouldn't be used.
However, HIPS rules list on XCS is not resetting on reboot, so it definitely doesn't require full HIPS rewrite that @bazang is constantly referring to.
CIS and XCS are different products, they had same codebase in the past (and would in the future, if the stars will align)

Also, I should note that enabled HIPS serves as self-protection for CIS, one can remove all other rules and create rule allowing everything for all applications group but leave CIS group rule with enabled inter-process memory protection.
Untitled.png
 
AI has no brains and only collects and throws up the average human answers inlcuding garbage it finds on the internet.
Discriminating a robot is not against any law.
Many of the common criticisms, that AI is generic, inaccurate, or just regurgitates internet garbage, often stem from users who haven't yet learned that interacting with an AI is a skill in itself. They treat it like a simple search engine, not a powerful collaborator.
 
  • Like
Reactions: Halp2001 and rashmi
The same could happen at containment prompts when a user makes a selection mistake and something malicious runs uncontained.
HIPS can be used in such cases as an additional protection layer.
Yes!
HIPS is unnecessary in Comodo since they introduced full containment. It extends protection and is useful for users who can employ it efficiently and who use HIPS features for other purposes.
 
It died out because people cannot handle it. That's not a reflection on HIPS. It is a refection on people - the same as people killing themselves slowly because they eat "heart clog" daily in copious amounts and live ridiculously sedentary lives. The typical person ain't got the skillz to cope with HIPS.

HIPS can be extremely effective providing some of the highest levels of security.

HIPS did nothing wrong. The people who cannot handle it did something wrong. They are the problem. Not HIPS.
Very true. People do underestimate the power of HIPS.
 
Last edited:
  • Like
Reactions: Andy Ful
Many of the common criticisms, that AI is generic, inaccurate, or just regurgitates internet garbage, often stem from users who haven't yet learned that interacting with an AI is a skill in itself. They treat it like a simple search engine, not a powerful collaborator.
The main problem is that AI output does change with whatever is presented / input to it, it is manipulative.
It hasn't got human brain power. it's an ice-cold machine containing zillion bits knowing only 1 or 0 and consuming / wasting loads of power / energy and other resources which could be better used for poor people for free instead.
 
It still exists. It has never been fixed and there's an old post somewhere on the Comodo forum where Melih states it will never be fixed because he ain't paying for an entire source code re-write.


The bug is easily reproduced.

1. Set HIPS to Paranoid Mode.
2. Create an Allow or Block rule at every HIPS prompt (as the user wishes - it does not matter and I'm not interested in debating about how to use HIPS).
3. Eventually, within 48 hours, all the HIPS rules created will disappear.

Thanks for confirming the issue.
The issue can be solved as follows:
  1. Before rewriting the HIPS settings, create a backup of the settings and check if the backup is not corrupted.
  2. If OK, switch the protection to rely on backup settings.
  3. Rewrite the main settings and check if they are not corrupted.
  4. If OK, switch the protection to rely on the main settings.
On Windows start:
  1. Verify that the main settings and backup are identical and not corrupted.
  2. If all OK, check which settings (main or backup) are active.
  3. If backup settings are active, switch to main settings.
  4. etc.
  5. In the case when both the main and backup settings are corrupted (disk errors), disable HIPS and show an appropriate warning.

The above or similar procedure (extended also to cover more corruption events), based on the backup, will protect against almost all possible HIPS rewriting problems. It does not require code rewriting.
The anti-corruption function can be added, or it can be implemented in a new ELAM driver.
 
Last edited:
The main problem is that AI output does change with whatever is presented / input to it, it is manipulative.
It hasn't got human brain power. it's an ice-cold machine containing zillion bits knowing only 1 or 0 and consuming / wasting loads of power / energy and other resources which could be better used for poor people for free instead.
Thank you for sharing your perspective. You've raised several important points that get to the heart of the current debate around AI, and I think they actually help illustrate the idea I was trying to convey.

The very issues you've highlighted, its changeable nature, its non-human processing, and its resource cost, are precisely why I argue that interacting with an AI is a skill in itself.

You mentioned that its output changes and described this as "manipulative." I see that same quality not as manipulation, but as responsiveness, which is its most powerful feature. An AI is less like a search engine giving a fixed answer and more like a lump of clay. A novice might be frustrated that it doesn't hold a shape on its own, but a skilled potter knows how to apply the right pressure and technique to mold it into something beautiful. The AI is the same; its final output is shaped entirely by the quality and specificity of the user's input. What one person calls "manipulation," a skilled user calls "direction."

You are absolutely right that it "hasn't got human brain power" and is an "ice-cold machine knowing only 1 or 0." This is a critical distinction. The goal isn't to replicate a human, but to augment human intelligence with a tool that has different strengths. We don't get angry at a calculator for not understanding the philosophy of mathematics (π is just a stored value to it, not a beautiful concept). We value it because it can perform calculations with a speed and accuracy no human can match. The skill is in knowing when and how to use the calculator. Similarly, the skill with AI is learning to leverage its massive pattern-matching ability without mistakenly expecting it to have human consciousness or common sense.

Finally, regarding the immense power and resource consumption, that is a profoundly important and valid ethical concern. It's a societal-level conversation we must have about technological priorities. However, this issue is distinct from the skill required to use the tools that already exist. In a way, learning to use these tools skillfully is the best way to honor that resource investment. A skilled user can get to a valuable result in a few efficient queries, while a novice might waste computational cycles with dozens of frustrating, dead-end prompts.

Ultimately, many of the frustrations people have with AI stem from a mismatch in expectations. When we treat it like a simple vending machine or a magic oracle, we're bound to be disappointed. But when we learn to treat it as a complex instrument, we can begin to use it to create truly powerful and useful things.

To bring the discussion back on topic, the reality is that Comodo's HIPS is rarely used, and not just due to stability. The core issue is that effectively managing a HIPS requires a deep understanding of the operating system, an expertise that most self-proclaimed 'power users' on this forum simply don't have. This isn't unique to Comodo, it's the exact same reason we see them express frustration with the advanced controls in products like ESET or AppGuard.
 
Thanks for confirming the issue.
The issue can be solved as follows:
  1. Before rewriting the HIPS settings, create a backup of the settings and check if the backup is not corrupted.
  2. If OK, switch the protection to rely on backup settings.
  3. Rewrite the main settings and check if they are not corrupted.
  4. If OK, switch the protection to rely on the main settings.
On Windows start:
  1. Verify that the main settings and backup are identical and not corrupted.
  2. If all OK, check which settings (main or backup) are active.
  3. If backup settings are active, switch to main settings.
  4. etc.
  5. In the case when both the main and backup settings are corrupted (disk errors), disable HIPS and show an appropriate warning.

The above or similar procedure (extended also to cover more corruption events), based on the backup, will protect against almost all possible HIPS rewriting problems. It does not require code rewriting.
The anti-corruption function can be added, or it can be implemented in a new ELAM driver.
The same and many more ideas / proposals on how to fix this bug have been presented / proposed on Comodo forum some time ago but Comodo's response is zilch, void and everlasting silence. It's my opinion too that it could be fixed in a couple of code lines but who am I to judge about that...
The only thing I got to hear on Comodo forum was that it could not be fixed due to this or that reason.
 
  • Like
Reactions: EASTER and Andy Ful