Messages in this thread | | | Date | Tue, 5 Aug 2008 20:46:00 -0400 | From | Rik van Riel <> | Subject | Re: [malware-list] [RFC 0/5] [TALPA] Intro toalinuxinterfaceforonaccess scanning |
| |
On Tue, 05 Aug 2008 20:25:29 -0400 Eric Paris <eparis@redhat.com> wrote:
> I don't think its hiding, I'm attempting to bring these companies who > just don't understand how to work in public
That's not my worry.
My real worry is that the anti-virus companies have been working with an enforcement policy that has been evolving slowly from the DOS days, while today's threat model has changed considerably.
I do not see how the proposed hooks would close off a system sufficiently to claim anything approaching security.
The way forward is to: 1) define a threat model 2) figure out what infrastructure is needed for protection 3) come up with interfaces that also help other software (eg. file range inotify to help disk indexing software)
Trying to shoe-horn the DOS anti-virus security model into a multi-user operating system with networking may not be sufficient protection for today's world. Eg. it does not protect against script virusses fetched off web sites and executed directly in a browser, office suite or any gnome-vfs enabled program. This is a major vulnerability in modern systems.
What problem are we really trying to solve?
Which problems are out of scope?
What infrastructure can solve the problem, while being useful for other things too?
-- All rights reversed.
| |