61–70 of 124 posts
Anti-virus products are a huge security risk.
Some might think it is joke, but it is dead serious: https://googleprojectzero.blogspot.com/2016/06/how-to-compro... Unfortunately running an anti-virus is an overly broad requirement in some industries to pass certifications and audits. It's one of the cases where "security" mandates and requirements leads to insecurity.
The article decries balkanization of tech services but it noticeably omits a middle path -- offering consulting services for open source software. Surely, in this aspect, it stands to reason that this section of the tech services industry is more robust in the face of such an encroachment. The only losers in such a situation are the likes of Symantec, whom claim secrecy and obfuscation are a feature rather than a bug…
It would make more sence to make the code open source but not free - anyone can see but nobody can use the code.
Anti-virus products are a huge security risk.
This is not impractical for my situation, because I do not have a large throughput of dubious files, perhaps a couple every 6 months or so.
Earlier quoted context omitted.
Well, Kaspersky Lab is a russian company.
Interesting enough, the CEO of Kaspersky already offers the source code for review in the US: https://www.engadget.com/2017/07/02/kaspersky-lab-offers-sou... Can't speak for the US, here in Germany the Kaspersky tools are used on large companies responsible for critical infrastructure. With the option for source code review, I'm still with a good impression on their tools when compared to Symantec and no option for r…
That is a terrible idea, as anyone who knows anything about Russia would tell you.
Earlier quoted context omitted.
Somebody please reply to this. Both this comment and the above comment seem reasonable. I don't know what to believe!
For me Worrying about "vulnerabilities in their virus detection method" seems unlikely. We're talking about downloadable software here, not a cloud service like google. Once a hostile nation state has access to your binaries (as they would with an installed product like A-V) they can just fuzz the A-V detection method to find bypasses. Heck that's what pentesters and red teamers do on a regular basis, A-V bypass is a…
We also did third party security audits on a regular basis, but still wouldn't be comfortable allowing that to be done with other countries. Purely my own opinion here, but my concern wouldn't be a security one so much as an intellectual property one- it's pretty well known that other governments (China, Russia) have strong links to their commercial sectors and little regard for IP protection.
So they're basically admitting that their antivirus tools aren't secure enough to handle a basic code review? Yup, totally makes me want to buy copies. "No, guys, security by obscurity totally works in this one case! Because it's us! Come on, you trust us right?"
To play devil's advocate, they may not be worried about vulnerabilities in their code but rather vulnerabilities in their method of virus detection, the same way Google doesn't share details about their search algorithm partly so it isn't gamed by spammers. Actually this is common in software that is meant to protect against sophisticated attackers. Blizzard and Valve used to have periodic mass bans but they would ne…
Earlier quoted context omitted.
To play devil's advocate, they may not be worried about vulnerabilities in their code but rather vulnerabilities in their method of virus detection, the same way Google doesn't share details about their search algorithm partly so it isn't gamed by spammers. Actually this is common in software that is meant to protect against sophisticated attackers. Blizzard and Valve used to have periodic mass bans but they would ne…
What's the difference between vulnerabilities in code and vulnerabilities in virus detection? Isn't the virus detection done in code? Is security through obscurity valid for virus detection but not code?
So they're basically admitting that their antivirus tools aren't secure enough to handle a basic code review? Yup, totally makes me want to buy copies. "No, guys, security by obscurity totally works in this one case! Because it's us! Come on, you trust us right?"
The article decries balkanization of tech services but it noticeably omits a middle path -- offering consulting services for open source software. Surely, in this aspect, it stands to reason that this section of the tech services industry is more robust in the face of such an encroachment. The only losers in such a situation are the likes of Symantec, whom claim secrecy and obfuscation are a feature rather than a bug…
It would make more sence to make the code open source but not free - anyone can see but nobody can use the code.