[lkml]   [2008]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: TALPA - a threat model? well sorta.
    It seems to me that this "scan on file open" business is the
    wrong way to do things - because it reduces performance.

    If you scan on file open, then your security sw is too late and
    getting in the way.

    It is better to scan in advance. Most machines has lots of idle time.
    Use that time to scan in advance, and mark the files as "clean".

    A "clean" file can be opened without further checking anytime - giving
    normal high performance. A file that gets written to becomes "dirty"
    until checked again. Some mechanism for making a clean copy of a
    clean file might help avoid excessive "dirtying".

    "Scan on open" might still be useful for cases when the system
    haven't kept up with writing, but please don't aim to have
    this be the _primary_ mode of scanning. A file server
    where most of the stuff is pre-scanned will likely perform much better
    than one scanning everything on open.

    Helge Hafting

     \ /
      Last update: 2008-08-15 12:11    [W:0.039 / U:8.156 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site