[lkml]   [2008]   [Aug]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [malware-list] [RFC 0/5] [TALPA] Intro toalinuxinterfaceforonaccess scanning
    On Tue, 05 Aug 2008 20:25:29 -0400
    Eric Paris <> wrote:

    > I don't think its hiding, I'm attempting to bring these companies who
    > just don't understand how to work in public

    That's not my worry.

    My real worry is that the anti-virus companies have been working
    with an enforcement policy that has been evolving slowly from the
    DOS days, while today's threat model has changed considerably.

    I do not see how the proposed hooks would close off a system
    sufficiently to claim anything approaching security.

    The way forward is to:
    1) define a threat model
    2) figure out what infrastructure is needed for protection
    3) come up with interfaces that also help other software
    (eg. file range inotify to help disk indexing software)

    Trying to shoe-horn the DOS anti-virus security model into a
    multi-user operating system with networking may not be sufficient
    protection for today's world. Eg. it does not protect against
    script virusses fetched off web sites and executed directly in
    a browser, office suite or any gnome-vfs enabled program. This
    is a major vulnerability in modern systems.

    What problem are we really trying to solve?

    Which problems are out of scope?

    What infrastructure can solve the problem, while being useful
    for other things too?

    All rights reversed.

     \ /
      Last update: 2008-08-06 02:49    [W:0.021 / U:6.112 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site