Full Disclosure mailing list archives
Re: AV companies better hire good lawyers soon.
From: James Tucker <jftucker () gmail com>
Date: Tue, 14 Sep 2004 12:51:42 +0100
Um, I might suggest one thing, USE YOUR EXCLUSIONS! almost all of the anti-virus programs support exclusions, although this is not a best case solution, it should work. Anyone who does not know why you should be required to submit every program you ever make to AV companies needs to think about this a little more. 1. How is a submitted program to be veto'd as safe? (what if a virus is submitted?) 2. How are the AV companies to fund checking every application ever submitted? 3. What is it that your programs are doing which is showing up in the heuristics?!?!?! As far as a writer checking to see that their software is compatible across all possible local system configurations, that is an intractable problem, don't be so silly. Obviously within reason you need to ensure that it does not replace anything, does not rely upon libraries which are often changed / removed (or that are only installed on the development system), does not change system configurations unless absolutely required. Meanwhile, configurations and libraries which are standard to the platform (say, JVM SDK or OS SDK for examples) should be re-used wherever possible, to create standardised software where common points of failure can be fixed resulting in common fixes. It is important that consideration is taken to respecting the documentation when using built in libraries. (This is not always a good rule for security, the whole single points of failure problem). Doing contrary to any of the prior rules will create software which may suffer issues caused by some outside influence, furthermore it may become an outside influence for some other software, this is not required functionality and is bad software design. Applications should clearly be designed to be either static, or dynamic as appropriate (i.e. if the OS can just be configured to do it on its own, then just configure the OS to do it), not half casts in between produced with poor specifications. AV companies obviously don't follow all the rules, but they never could by purpose could they? (how are you supposed to not affect other software when that is your purpose?) AV programs are designed to protect your data, false positives are not common but are not practically possible to prevent in all cases. At the end of the day, binary code only has so many possible permutations and combinations (very very many, but so many), furthermore faster heuristic checking partially relies on shorter (and thus normally more generic) rules; as with many things IT this results in a trade off between accuracy and performance. I am sympathetic to any developer who comes up against this problem, and we are all probably aware of the business damage that can be done by such an event; however as a developer you should be capable of realising the size of the problems involved here. The only true resolution is to get hold of someone (preferably high on the ladder) in real life (phone / physical). What I am not sympathetic about is the fact that the story about the ISP dialler which is blocked by McAffee interests me purely because, if the system could no longer dial as a result of this false identification; the software had placed itself in a point of reliance somewhere between ppp, tcp/ip, and the drivers. This is non-conformist (does not just configure the OS, which is how it should be done), not recommended by Microsoft, or any other major software development company. Use what is available but reliable first, then build your own stuff. Of course I might have a completely wrong handle on why the connections stopped working after this software was removed. Personally I hate customised dialer applications and frequently remove them by hand; from the sounds of it the quoted application is such a piece of software. In terms of provided functionality for the cost of a running program (and sometimes a service too) vs. the (lack of) increased functionality over the OS itself; many of these applications I would consider malware anyway. I showed the ISPWizard site and software to several other professionals and the reaction is always the same... "eeeewwww!". Whilst such a program might work really well (and arguably had good purpose back when it was "hard" to connect to an ISP, on win95 or some derivation of), its not exactly "good" software. It provides 2 features over the normal Microsoft wizard (which you can add this functionality to anyway, and the dialer partially just does this), 1. Provides a selectable list of service numbers, 2. Automagically sets up a pile of ISP abuse on your system (branding pasted everywhere). "Setup programs created are very small and self contained (Around 300k)" this is not a feature, 300k is a huge amount of data to front an Internet dial up wizard IMO, especially as it is essentially carrying how-to-configure-a-system scripts. At least the price point is very reasonable, but I would still just distribute DUN configs (which aren't even binaries, so no more worries here). _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- AV companies better hire good lawyers soon. Feher Tamas (Sep 13)
- Re: AV companies better hire good lawyers soon. Micheal Espinola Jr (Sep 13)
- Re: AV companies better hire good lawyers soon. James Tucker (Sep 13)
- Re: AV companies better hire good lawyers soon. Heikki Toivonen (Sep 13)
- Re: AV companies better hire good lawyers soon. Florian Weimer (Sep 14)
- RE: AV companies better hire good lawyers soon. Jean Gruneberg (Sep 14)
- Re: AV companies better hire good lawyers soon. Florian Weimer (Sep 14)
- Re: AV companies better hire good lawyers soon. James Tucker (Sep 14)
- Re: AV companies better hire good lawyers soon. Mister Coffee (Sep 14)
- Re: AV companies better hire good lawyers soon. Manuel C. -aka- ekerazha (Sep 14)
- Re: AV companies better hire good lawyers soon. Barry Fitzgerald (Sep 14)
- Re: AV companies better hire good lawyers soon. Mister Coffee (Sep 14)
- Re: AV companies better hire good lawyers soon. gadgeteer (Sep 14)
- Re: AV companies better hire good lawyers soon. Micheal Espinola Jr (Sep 13)
- Re: AV companies better hire good lawyers soon. Micheal Espinola Jr (Sep 14)
- Re: AV companies better hire good lawyers soon. Frank Knobbe (Sep 14)
- Re: AV companies better hire good lawyers soon. Valdis . Kletnieks (Sep 14)
- Re: AV companies better hire good lawyers soon. Frank Knobbe (Sep 14)
- Re: AV companies better hire good lawyers soon. Nick FitzGerald (Sep 14)