>Does official Apple security framework ("Apple EndpointSecurity") targeted at AV vendors serious enough for you? They themselves built an OS subsystem specifically for AVs to use, and Microsoft has done the exact same with AMSI.
Neat
>There are actually very few techniques that are 99.999% effective...
Yes, I was thinking, for example SSH + VPN. 2 99.999% secure layers.
Also, Unix users + Apparmor. Recently in Linux unix users were vulnerated by copy.fail for example, but it's not a common event. And it already assumes (in my threat model), that users managed to vulnerate my http server to run arbitrary commands, so they would have to break 2 layers to get me (3 if I were to use apparmor)
>The cheap port-changing trick can even be 100% effective against generic massive port scanning attacks. But it's 0% effective against a targeted attack
I add them up and average them, so if something is 100% effective against 1000 attacks, but 0% effective against 10 others, it's 99% effective? Not great. Especially when you get 1000 of these per day. It's also not purely probabilistic, since attackers are smart and can find that 1%.
>It's not possible to inspect all the code we use. There's too much of it changing every second. The idea that developers have the time or ability to manually inspect every line of open-source code they import is an economic fantasy. In an era where frontier AI models like Mythos are finding and chaining 0-days in minutes, human review is simply outpaced.
Sounds like a choice you are making there. I have a 10KLoc system, you have a 100MKloc system. It is possible to inspect all the code that I use, it's not possible to inspect all the code you use.
>Also, please don't think about programmers as someone immune to attacks, as this is not true at all.
I do agree, here, I like the approach Socket is taking, they are bringing the AV security tactics with signatures and active monitoring, to code repos. But to be fair, if it were my company or I were CTO, I would rather start distributing PIPs or firing people that cause cybersec incidents. I get that there's different styles, but my strategy just values absolute cybersec much more, we are not a good fit if you are using npm and we need to bring in an Antivirus company for developers.
What I'm saying is that GOOD developers are expected to be less vulnerable than normal users, and that BAD developers benefit from the techniques that protect normal users. Again, if someone runs 'wget URL | sh' under my watch, that's a PIP, and it's being generous, there's no strike 2.