> It's an imperfect technique for real-world programs, but so is everything. No, it's mostly a bullshit technique. The thing is that the malware author can se

> It's an imperfect technique for real-world programs, but so is everything. No, it's mostly a bullshit technique. The thing is that the malware author can see "how much" of the halting problem AV software "solves", and then deliberately hide their bad/suspicious actions just out of reach of that limit. Simple everyday heuristics are good for a lot of things, but the one thing that they are mostly ineffective against is intentional deception.