5 ms·

This is the standard strategy that every antivirus product has used for most of their history. Remember the one about Symantec doing exactly this in a kernel mo

This is the standard strategy that every antivirus product has used for most of their history. Remember the one about Symantec doing exactly this in a kernel module: https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compro... I've known for over a decade that antivirus products are strangely destabilizing and stayed away from them myself. For the last year or so that Tavis has been investigating them, we know why. They're just really dumb. Because the popular commercial computer security product market is a "market for lemons": https://www.schneier.com/blog/archives/2007/04/a_security_mark.html https://www.schneier.com/blog/archives/2007/04/a_security_ma...

jobu 9y ago
First I've heard of the "Market for Lemons" concept (https://en.wikipedia.org/wiki/The_Market_for_Lemons https://en.wikipedia.org/wiki/The_Market_for_Lemons) It seems pretty obvious now that I think about it, and it definitely goes hand-in-hand with the "Confusopoly" concept (https://en.wikipedia.org/wiki/Confusopoly https://en.wikipedia.org/wiki/Confusopoly). Why should companies compete on quality or price when they can put all that effort into advertising and marketing that scares or confuses most people into buying their product
- vanderZwan 9y ago
  I wonder if you can apply that to modern politics as well. Why try to have well-informed citizens when you can scare them?
- thecrazyone 9y ago
  I don't get this Market for Lemons thing. Am I missing any axioms that make this logic correct?. My quips with the theory are: 1) Why are there only binary (2) qualities of cars - good or bad. And why are they static? What market is this trying to model? 2) Wouldn't it be sufficient for peaches (as opposed to lemons) to be lowered in cost to market price i.e. the avg. Somehow peaches are of immutable cost/ quality with zero seller margins? Aside: 1) Also, why is the state of the cars being considered to be unknowable i.e. even in a given model of car, the units are not of consistent quality? Is this a production quality issue (i.e. inconsistent quality of units in a given model) 2) Why is this state of unknowable or perhaps inconsistent quality an equilibrium? meaning wouldn't a middle man who tests cars try and separate the lot and charge for his services? This market situation that is being modeled seems contrived, at least to the extent that I understand from the Market for lemons wikipedia article
  - sobani 9y ago
    The binary part is to make it easier to understand. This is not about new cars, this is about second hand cars. And even if it was about new cars, you wouldn't know for another 5 years if the new car you bought was bad quality or not. (assuming you can't rely on the reputation of the car maker) The problem with second hand cars is that I sell my car every 5 years, so I basically don't have any reputation. And you don't know how well I maintained my car. All you can see it that it looks shiny. You can't let me test it, because you don't know if I got the certificate from a genuine unbiased party or from my brother in law. So if you want to test the quality of the car, it's going to cost you. Plus I'm not even sure if you can let it be test cheaply. I can paint over rust, roll back the odometer and do some quick fixes to make the car run smoothly, for now. Are you going to have the car taken apart in the test? The problem now becomes that I know the quality of the car and you don't. The uncertainty is going to drive the price down. Sellers of good cars will hesitate to compete, because it's impossible for them to ask for a premium price. I'll probably keep the car longer (it's still good, why not) or sell it to a friend, who can rely on my reputation. Now the average quality of cars on the open market goes down, which drives the price down even further, which makes it even less likely a good car will end up on the open market, which drives the price even further down, etc.
pitay 9y ago
It may also be good to look at 'The market for silver bullets' (2008) [1]. This discusses security products as products where both the seller and buyer do not know enough to judge the efficacy of security products. Also where the cost of a breach may be far lower than the PR costs and fallout for example. [1]: http://iang.org/papers/market_for_silver_bullets.html http://iang.org/papers/market_for_silver_bullets.html
Majestic121 9y ago
I may be misunderstanding, but I would expect the "market for lemon" to be only valid for a physical market, no ? The principle being that high quality cars are sold faster and get out of the market, so the average quality decrease. But for antivirus, selling the antivirus does not get it out of the market (the inverse is pretty much true since it makes it more famous), hence the average quality does not decrease.
- sitharus 9y ago
  In this case it's the customer that is removed from the market. Nobody (deliberately) buys two antivirus products. The effect is the same, nobody's going to develop and market a 'peach' antivirus product since the users don't understand it and are very price sensitive.
- tempay 9y ago
  The problem is the average user doesn't know what makes a quality antivirus product and they also don't want to pay a high price for one. As a result antivirus manufacturers are incentivised to produce a cheap product which only needs to tick all the same boxes of their competitors in product comparison tables, even if features don't actually improve security. Producing a high quality product is far more expensive and may result in fewer customers due to the previous point.
- ploxiln 9y ago
  You misunderstand the physical car market metaphor - the high quality cars are not sold faster. They are taken off the market and not sold at all, because the market price is too low. The market price is too low because the buyers can't tell good from bad, so they just guess they will get average quality, and just pay what the average is worth. They don't pay for the high-quality used cars - even if they did, it would usually be for the wrong cars.
- throwaway41597 9y ago
  You mean "why can't peach sellers make it up with volume?", marginal cost of copying software is zero, right? The problem is : so can lemon sellers. The price already accounts for this and it is too low to fund a peach seller (research, software engineering, customer service...).
deleted 9y ago
[deleted]
thecrazyone 9y ago
I don't understand how this is a "market for lemons" is relevant here. I'm not sure what you're aiming to communicate. I did take the time to read the linked blog post but not the linked paper from there. There is no binary system of good or bad antivirus products but a spectrum and they all have different prices. They've been put to real (viruses and malware in the wild) and synthetic tests to test their efficacy by av-test and others. So they work, maybe not 100% but more than 99% on many benchmarks. Comparing it to a allegedly failed device like Secustick and claiming (not sure where's the evidence for it) there are no good security products and then saying it's "Because the popular commercial computer security product market is a "market for lemons":" seems like begging the question or confirmation bias or both I'd like to hear your thoughts. I hope I'm not trying to nitpick :)

jobu 9y ago

First I've heard of the "Market for Lemons" concept (https://en.wikipedia.org/wiki/The_Market_for_Lemons https://en.wikipedia.org/wiki/The_Market_for_Lemons) It seems pretty obvious now that I think about it, and it definitely goes hand-in-hand with the "Confusopoly" concept (https://en.wikipedia.org/wiki/Confusopoly https://en.wikipedia.org/wiki/Confusopoly). Why should companies compete on quality or price when they can put all that effort into advertising and marketing that scares or confuses most people into buying their product

vanderZwan 9y ago
I wonder if you can apply that to modern politics as well. Why try to have well-informed citizens when you can scare them?
thecrazyone 9y ago
I don't get this Market for Lemons thing. Am I missing any axioms that make this logic correct?. My quips with the theory are: 1) Why are there only binary (2) qualities of cars - good or bad. And why are they static? What market is this trying to model? 2) Wouldn't it be sufficient for peaches (as opposed to lemons) to be lowered in cost to market price i.e. the avg. Somehow peaches are of immutable cost/ quality with zero seller margins? Aside: 1) Also, why is the state of the cars being considered to be unknowable i.e. even in a given model of car, the units are not of consistent quality? Is this a production quality issue (i.e. inconsistent quality of units in a given model) 2) Why is this state of unknowable or perhaps inconsistent quality an equilibrium? meaning wouldn't a middle man who tests cars try and separate the lot and charge for his services? This market situation that is being modeled seems contrived, at least to the extent that I understand from the Market for lemons wikipedia article
- sobani 9y ago
  The binary part is to make it easier to understand. This is not about new cars, this is about second hand cars. And even if it was about new cars, you wouldn't know for another 5 years if the new car you bought was bad quality or not. (assuming you can't rely on the reputation of the car maker) The problem with second hand cars is that I sell my car every 5 years, so I basically don't have any reputation. And you don't know how well I maintained my car. All you can see it that it looks shiny. You can't let me test it, because you don't know if I got the certificate from a genuine unbiased party or from my brother in law. So if you want to test the quality of the car, it's going to cost you. Plus I'm not even sure if you can let it be test cheaply. I can paint over rust, roll back the odometer and do some quick fixes to make the car run smoothly, for now. Are you going to have the car taken apart in the test? The problem now becomes that I know the quality of the car and you don't. The uncertainty is going to drive the price down. Sellers of good cars will hesitate to compete, because it's impossible for them to ask for a premium price. I'll probably keep the car longer (it's still good, why not) or sell it to a friend, who can rely on my reputation. Now the average quality of cars on the open market goes down, which drives the price down even further, which makes it even less likely a good car will end up on the open market, which drives the price even further down, etc.

pitay 9y ago

It may also be good to look at 'The market for silver bullets' (2008) [1]. This discusses security products as products where both the seller and buyer do not know enough to judge the efficacy of security products. Also where the cost of a breach may be far lower than the PR costs and fallout for example. [1]: http://iang.org/papers/market_for_silver_bullets.html http://iang.org/papers/market_for_silver_bullets.html

Majestic121 9y ago

I may be misunderstanding, but I would expect the "market for lemon" to be only valid for a physical market, no ? The principle being that high quality cars are sold faster and get out of the market, so the average quality decrease. But for antivirus, selling the antivirus does not get it out of the market (the inverse is pretty much true since it makes it more famous), hence the average quality does not decrease.

sitharus 9y ago
In this case it's the customer that is removed from the market. Nobody (deliberately) buys two antivirus products. The effect is the same, nobody's going to develop and market a 'peach' antivirus product since the users don't understand it and are very price sensitive.
tempay 9y ago
The problem is the average user doesn't know what makes a quality antivirus product and they also don't want to pay a high price for one. As a result antivirus manufacturers are incentivised to produce a cheap product which only needs to tick all the same boxes of their competitors in product comparison tables, even if features don't actually improve security. Producing a high quality product is far more expensive and may result in fewer customers due to the previous point.
ploxiln 9y ago
You misunderstand the physical car market metaphor - the high quality cars are not sold faster. They are taken off the market and not sold at all, because the market price is too low. The market price is too low because the buyers can't tell good from bad, so they just guess they will get average quality, and just pay what the average is worth. They don't pay for the high-quality used cars - even if they did, it would usually be for the wrong cars.
throwaway41597 9y ago
You mean "why can't peach sellers make it up with volume?", marginal cost of copying software is zero, right? The problem is : so can lemon sellers. The price already accounts for this and it is too low to fund a peach seller (research, software engineering, customer service...).

deleted 9y ago

[deleted]

thecrazyone 9y ago

I don't understand how this is a "market for lemons" is relevant here. I'm not sure what you're aiming to communicate. I did take the time to read the linked blog post but not the linked paper from there. There is no binary system of good or bad antivirus products but a spectrum and they all have different prices. They've been put to real (viruses and malware in the wild) and synthetic tests to test their efficacy by av-test and others. So they work, maybe not 100% but more than 99% on many benchmarks. Comparing it to a allegedly failed device like Secustick and claiming (not sure where's the evidence for it) there are no good security products and then saying it's "Because the popular commercial computer security product market is a "market for lemons":" seems like begging the question or confirmation bias or both I'd like to hear your thoughts. I hope I'm not trying to nitpick :)