Messages in this thread | | | Date | Tue, 5 Aug 2008 18:55:24 -0400 | Subject | Re: [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning | From | "J. Bruce Fields" <> |
| |
On Mon, Aug 04, 2008 at 05:00:16PM -0400, Eric Paris wrote: > Please contact me privately or (preferably the list) for questions, > comments, discussions, flames, names, or anything. I'll do complete > rewrites of the patches if someone tells me how they don't meet their > needs or how they can be done better. I'm here to try to bridge the > needs (and wants) of the anti-malware vendors with the technical > realities of the kernel. So everyone feel free to throw in your two > cents and I'll try to reconcile it all. These 5 patches are part 1. > They give us a working able solution. > > >From my point of view patches forthcoming and mentioned below should > help with performance for those who actually have userspace scanners but > also could presents be implemented using this framework. > > > Background > ++++++++++ > There is a consensus in the security industry that protecting against > malicious files (viruses, root kits, spyware, ad-ware, ...) by the way > of so-called on-access scanning is usable and reasonable approach.
Can you point to any helpful explanations of that concensus?
Off-hand it's surprising. (A defense that depends on cataloging every possible individual attack sounds difficult!)
--b.
| |