Re: Re: Malware sharing? People are full of shit [was: Getyour computer viruses here!]

[Nick FitzGerald <nick () virus-l demon co uk>]

James Kehl wrote:

> As the success/survival of Val's project depends on getting new samples
> and analysis, it will flop if the people with the samples don't like the
> rules they're forced to provide them under. No samples means no blackhats
> downloading samples, so Val isn't the only one in control. :)

Which is why he won't be getting any sampels from me...

> On the other hand, I haven't noticed anyone saying that the current system
> the good guys use is perfect, so the failure of the only proposed
> alternative isn't really what anyone wants.

This is by far NOT the _only_ alternative.  There are innumerable VX 
and other open access malware sample sites out there.  There are also 
some limited scope "quasi-official(-ish)" groups that share samples 
among all their members and with fairly open entry requirements...

> Could I possibly suggest that the people arguing for better blackhat
> exclusion etc. actually just set up a site that they _would_ be happy to
> see exist or provide samples to?

I won't be, as I am already where I need to be re: access to samples 
_AND_ as I'm a "viruses are just bad and you have to be especially 
especially trusted to get any from me" bigot, such a site would have to 
have very strict pre-analysis of samples to ensure that viruses were 
not made available to the "less trusted" who may still be "trustworhty 
enough" for access to "lesser" malware...

And, of course, the "pre-ananlysis" stage means that this site would 
NOT meet one of Val's major stated objectives, meaning that Val and his 
close suporters would just keep doing what they are doing anyway.


Regards,

Nick FitzGerald

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.