101–110 of 124 posts
Earlier quoted context omitted.
I don't think the parent is talking about vulnerabilities, but the fact that if you know how the antivirus engine works it may be easier to write a virus able to avoid detection.
Sounds like a vulnerability. Isn't that how the argument went about source code? "If you know how the program works it may be easier to write an exploit." But then experience taught people that exposing source code to the bright sunlight by opening its source could actually make software more secure through many eyes finding holes. Why is this not applicable to virus detection algorithms?
Earlier quoted context omitted.
Yup. The tire fire of the security industry is saying that letting other people look at the code is a security risk. Personally, I think maybe they got scared that someone might figure out that their code is worse than everything else on the planet, and so they want to try to put the clothes back onto the Emperor.
Not sure that applies in this case. If the only party you allow to look at your code is one that's heavily invested in secretly hacking it, then you're probably going to give them some zero-days which they'll use maliciously. It's different if you let everyone look at it, since a white-hat might find something helpful. But this isn't a choice between everyone and no-one, it's between a known black-hat and no-one.
I am missing some key piece of information? Why is Symantec willing to allow the US Government to review the code bot not "foreign" states? What makes the US Government the pinnacle of virtue and honor?
Earlier quoted context omitted.
> Can't speak for the US, here in Germany the Kaspersky tools are used on large companies responsible for critical infrastructure. That is a terrible idea, as anyone who knows anything about Russia would tell you.
Ya. Using American software, you might be getting NSA's eyes on you. Using Russian software, you'll probably have FSB's eyes on you. So take your pick :)
Earlier quoted context omitted.
Blue Coat. Has problems with foreign governments being unfriendly? I guess what goes around comes around: http://surveillance.rsf.org/en/blue-coat-2/
What a fantastic website is that! To add to your point: Amazing how skewed ones morals can be if they believe they're doing the right thing by providing those countries these kinds of tools.
https://en.m.wikipedia.org/wiki/Unethical_human_experimentat...
So they're basically admitting that their antivirus tools aren't secure enough to handle a basic code review? Yup, totally makes me want to buy copies. "No, guys, security by obscurity totally works in this one case! Because it's us! Come on, you trust us right?"
Open it out to code review by only a few number of people, mainly governments, and you are opening it out to a small set of people doing code review explicitly driven by the primary intention of finding vulnerabilities in it. This would apply to even the US govt, who routinely request software vendors to delay patching or even disclosing 0-day vulnerabilities till they have sufficiently exploited it.
Allowing more scrutiny will work only if enough eyeballs are devoted to it driven by benevolent intentions. Best results would be to open source the whole thing but that would not make business sense to the company.
Basically, either you open it out completely or not open it up at all. Opening out to a few government funded hackers is probably the worst choice they could make.
Earlier quoted context omitted.
You're intentionally conflating "basic code review" with "politically charged state actor performing code review", which are not the same thing. Did they say they allow no audit or outside code review? Or simply that political nation states who have intelligence agencies that actively subvert security solutions to compromise computers (the very things AV companies work to prevent) shouldn't have access to the very co…
Usually companies allow source code review beccause they're trying to sell their solutions in the countries in question. Look at it from the perspective of those countries Symantec "hey buy all our security software it's super-great" Foreign Gov. Customer: "sure can we check the source code first to see if there are any heinous security bugs or NSA backdoors" Symantec "Oh gee no, allowing to you see the source code o…
You can't please all customers if customer wants you to protect them from another potential customer of yours, you have to pick a side and stick to it.
Do you need to access source code in order to analyze software for backdoors? Shouldn't you be looking directly at the compiled machine code? There's no guarantee that the source code you are looking at matches the binaries that are being distributed isn't it?