4 ms·

I wonder about the mindset that allows one to accept running MacAfee on a freakin' Point of Sale device is something that just has to be done?!

andrewf 17y ago
If credit card data is going to pass through the device, anti-virus software is mandated by PCI-DSS.
- Raphael_Amiard 17y ago
  It's still wrong. Anti virus software in general are not very far from virii themselves in what they do to your computer. This whole macafee story just proves the point, but it's not the first time such a thing happens. AVG had that happen to them too a year back.
- noonespecial 17y ago
  Hmmm interestingly, the "unix exemption" seems to have been dropped from 1.1 to 1.2 of DSS document. Part 5.1 used to include this note: Note: Systems commonly affected by viruses typically do not include UNIX based operating systems or mainframes. Consumer grade MacAfee that auto updates is still probably a very poor choice for this application as they should have a test bed in the lab that they beta all changes on before they roll out to thousands of machines that likely need a truck roll if something goes wrong.
  - count 17y ago
    You can run McAfee on linux now as well (mostly for scanning email and CIFS shared files, I assume?). PCI DSS and DoD IA controls require it. Enterprise grade McAfee still sucks, it's just a more manageable suck. Despite that, it still blew up with the bad DAT file - those are the same between product lines.
- dalore 17y ago
  The WTF here is that anti-virus software is mandated by PCI-DSS and not procedures that stop virii in the first place.
- Luyt 17y ago
  > If credit card data is going to pass through the device, anti-virus software is mandated by PCI-DSS. Even when the POS is not running Windows? Or does the PCI-DSS assume all computers are running Windows?
  - noonespecial 17y ago
    Its a perfect example of the classic "if it can then it must" brainless rule application. I once had a car that had a bad bulb socket in the "cyclops" brake light so it wouldn't pass inspection. Did I fix the socket to get past? Hell no. I removed the whole light. If it wasn't there, it didn't have to work. Those were the rules.
blub 17y ago
It doesn't have to be done. I've worked on POS and smart-weighing systems that were cross-platform (Windows and Linux). Neither used AV, but they were tightly locked down. My impression was that most customers don't care about the OS. Some prefer Windows, they already have the tech personnel in place. On the other hand, the Linux ports were done because a very big customer said that they had to have Linux... It certainly cost them more than licensing Windows. :) From a dev point of view, Windows was easier, as it is generally more friendly towards C++ development. The OSes were about equally capable, I didn't see any Linux technical advantages in practice.
michaelfairley 17y ago
Reminds me of http://xkcd.com/463/ http://xkcd.com/463/
- Legion 17y ago
  Except now, the condom isn't just pointless, but it's an active threat in itself. You might even say it's... a trojan. groans

andrewf 17y ago

If credit card data is going to pass through the device, anti-virus software is mandated by PCI-DSS.

Raphael_Amiard 17y ago
It's still wrong. Anti virus software in general are not very far from virii themselves in what they do to your computer. This whole macafee story just proves the point, but it's not the first time such a thing happens. AVG had that happen to them too a year back.
noonespecial 17y ago
Hmmm interestingly, the "unix exemption" seems to have been dropped from 1.1 to 1.2 of DSS document. Part 5.1 used to include this note: Note: Systems commonly affected by viruses typically do not include UNIX based operating systems or mainframes. Consumer grade MacAfee that auto updates is still probably a very poor choice for this application as they should have a test bed in the lab that they beta all changes on before they roll out to thousands of machines that likely need a truck roll if something goes wrong.
- count 17y ago
  You can run McAfee on linux now as well (mostly for scanning email and CIFS shared files, I assume?). PCI DSS and DoD IA controls require it. Enterprise grade McAfee still sucks, it's just a more manageable suck. Despite that, it still blew up with the bad DAT file - those are the same between product lines.
dalore 17y ago
The WTF here is that anti-virus software is mandated by PCI-DSS and not procedures that stop virii in the first place.
Luyt 17y ago
> If credit card data is going to pass through the device, anti-virus software is mandated by PCI-DSS. Even when the POS is not running Windows? Or does the PCI-DSS assume all computers are running Windows?
- noonespecial 17y ago
  Its a perfect example of the classic "if it can then it must" brainless rule application. I once had a car that had a bad bulb socket in the "cyclops" brake light so it wouldn't pass inspection. Did I fix the socket to get past? Hell no. I removed the whole light. If it wasn't there, it didn't have to work. Those were the rules.

blub 17y ago

It doesn't have to be done. I've worked on POS and smart-weighing systems that were cross-platform (Windows and Linux). Neither used AV, but they were tightly locked down. My impression was that most customers don't care about the OS. Some prefer Windows, they already have the tech personnel in place. On the other hand, the Linux ports were done because a very big customer said that they had to have Linux... It certainly cost them more than licensing Windows. :) From a dev point of view, Windows was easier, as it is generally more friendly towards C++ development. The OSes were about equally capable, I didn't see any Linux technical advantages in practice.

michaelfairley 17y ago

Reminds me of http://xkcd.com/463/ http://xkcd.com/463/

Legion 17y ago
Except now, the condom isn't just pointless, but it's an active threat in itself. You might even say it's... a trojan. groans