Messages in this thread | | | Subject | RE: [malware-list] TALPA - a threat model? well sorta. | From | tvrtko.ursulin@sophos ... | Date | Thu, 14 Aug 2008 13:27:54 +0100 |
| |
Jonathan Press wrote on 14/08/2008 13:03:40:
> > Hm, maybe by implementing a facility with which a client can register > it's > > interface usage intent? Something like: > > > > register(I_HAVE_NO_INTEREST_IN_CONTENT); > > register(I_WANT_TO_EXAMINE_CONTENT); > > > > All former ones would run first because they only want to have the > > opportunity to block and do something unrelated to file content (like > > HSMs), and later group would be ran last since they want to examine > the > > content. > > > > Ordering inside those two groups is not important because I don't see > how > > a model other than restrictive can make sense with content security > > scanning. > > I'm not sure I understand why "interest in content" means not blocking, > and vice versa. However, I think this is a good idea if made more > explicit, i.e.:
Small misunderstanding because both would block. If you go back to Ted's original post I was replying to, he was worried about how would anti-malware scanning interact with HSM since both may end up using the same interface. HSM, as far as I understand it, needs to block on open and "plant" the right file in place, while anti-malware also needs to block and examine the right content. That is why ordering matters, anti-malware needs to run after the content is put in place. And that is what my idea solves (slight overstatement since I spent only seconds on it) by separating them in two groups of clients. First which has no interest in content and second which does.
-- Tvrtko A. Ursulin Senior Software Engineer, Sophos
"Views and opinions expressed in this email are strictly those of the author. The contents has not been reviewed or approved by Sophos."
Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, United Kingdom.
Company Reg No 2096520. VAT Reg No GB 348 3873 20.
| |