Ds is 18m and experimenting with hitting and biting atm. I think he's exploring the sensations. I just explain and sign that it hurts. Then ask him to be gentle, at which point he strokes me as this is his understanding of gentle. He's too young to control the impulse so i offer him acceptable alternatives eg a high five or xylaphone for hitting, Food to bite. A lot of what he does is hitting or biting inanimate objects anyway, so i mostly leave him to that...picking battles and all that.
I don't use time out or firm no's. He wouldn't undertand the former, and the latter would stop him from hearing the explinationy bit after, and to me that's the important bit. There's no malice in it in ds's case so i'm trying not to be reactionary or antagonistic in my response and so far it's working find for us.
It is distressing for us mums. But a 19 month old is not yet truly social and will not develop empathy for a couple of years. He will have a limited understanding of the impact but can comprehend an immediate consequence.
You are right, the best response is to say "No" firmly and remove yourself and sibling from them. (I appreciate that there will be some situations, like a bus, where this is impossible. In which case improvise - turn away etc). Do this consistently and firmly. Don't smile or respond in anyway that a little one could perceive as entertaining.
Children of all ages will sometimes start a negative behaviour to initiate an interaction that they perceive as play. You need to show them that they don't get any interaction when they bite/scratch/spit etc. Be consistent, bear with it and it will go away.
I am always repeating the rules of the house: Kind words, kind hands and kind feet. Angeldog's point about teaching kind hands (stroking) is a good one to use.
If he takes himself to time out it does suggest that he knows what is coming next which is good - he understands consequences. I'd ignore the smiles - don't read anything into them. I don't personally use time out until 3 yrs ++ as it has limited impact.
A note of caution - if you implement any of this, it will probably get a bit worse initially. The little monkeys usually up their game to see what will happen. If you persist it should stop.
The other thing of course is your DD's feelings. She needs to see and hear that something is being done. You may need to explain to her that you are responding to her being badly treating by doing X. It may not be that obvious to her as she is so young. She will also benefit from hearing the house rules, and it'll reassure her that this isn't to be tolerated.