lkml.org 
[lkml]   [2008]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [malware-list] TALPA - a threat model? well sorta.
From
Date
Peter Zijlstra wrote on 18/08/2008 11:14:00:

> On Mon, 2008-08-18 at 12:09 +0200, Helge Hafting wrote:
> >
> > Scanning on open should be a last resort. Scan in advance when you
can.
> > Of course, removable media cannot be scanned until it is inserted and
> > mounted,
> > that is obvious. The scanning can start as soon as the filesystem is
> > mounted though,
> > there is no reason to wait until users try to access something.
> >
> > A CD inserted into a CD-server may not necessarily be needed
immediately, so
> > scanning in advance will help here too. The user inserting a CD in a
home
> > computer may start to use stuff right away, or perhaps he spends
> > some time reading the docs before a complicated install. Sill room for
some
> > scanning in advance, which also may end up with the nice effect of
> > caching the CD.
>
> Hmm, then there is the issue that an active scanner will avoid me from
> removing the media again. Most annoysome when the machine won't promptly
> give back the disk.
>
> Imagine me browsing through a stack of unmarked dvd-rw media trying to
> find the one with the right file on it, but having to wait every time
> for the whole media to get scanned..
>
> Not a nice picture.

I agree. And not only that but also the fact that most of the time I would
not want mount to trigger a background scan of everything because not all
might be accessed later. Therefore it would be just wasting resources and
ruining user experience. This argument is flawed in a way that is
unsolvable in the same way normal preload to page cache is unsolvable
because it is impossible to predict the usage pattern.

--
Tvrtko A. Ursulin
Senior Software Engineer, Sophos

"Views and opinions expressed in this email are strictly those of the
author.
The contents has not been reviewed or approved by Sophos."


Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon,
OX14 3YP, United Kingdom.

Company Reg No 2096520. VAT Reg No GB 348 3873 20.



\
 
 \ /
  Last update: 2008-08-18 12:29    [W:0.103 / U:0.768 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site