4 ms·

I know nothing about antivirus software, but isn't security software supposed to be open? Otherwise, it's just security through obscurity. It sounds to me like

by drcube 15y ago

I know nothing about antivirus software, but isn't security software supposed to be open? Otherwise, it's just security through obscurity. It sounds to me like Symantec just wants to hide all their vulnerabilities.

elliottcarlson 15y ago
There is a large market for antivirus software - obviously Symantec is one of the biggest - but there are trade secrets in how their heuristics engines work and other secrets that give them a possible competitive edge.
- drcube 15y ago
  Seems to me like they would also get a competitive edge by ignoring the expensive antivirus programming and just sending the occasional false alert to the user to make them think their software is actually doing something. When they get a real virus: "Well, we can't catch all of them, sorry. Go ahead and pay for an update, that might fix it." How would you even know, unless you saw the source code?
  - Travis 15y ago
    Aside from the difficulty in uncovering the truth, I think this would be a clear example of criminal fraud. It would take a pretty large effort to cover up something like this, as well (disgruntled ex-employees would be hugely incentivized to speak to prosecutors). So while you probably wouldn't know via technical means, my gut feeling is that a conspiracy in a company that large would quickly surface.
    - drcube 15y ago
      I agree. My point was that you don't know what they're doing. It probably isn't as bad as "nothing at all", but you can't say where along the spectrum between that and "rock solid" they actually lie without taking a peek under the hood. Which is why I'm a proponent of free and open-source software wherever possible, especially for security applications.
slowpoke 15y ago
Exactly. I've been saying this time and time again in the past: you cannot trust proprietary software for security, full stop. As you point out, it's security through obscurity (which we all know isn't really security), but what's more, you can never know if there is a backdoor in proprietary software, or if it's actually doing what it's supposed to do (and not less, or more - like logging your activity or listening in on your traffic).
batista 15y ago
I know nothing about antivirus software, but isn't security software supposed to be open? This is antivirus software, a specific sub genre of security software. Historically, the most popular such packages have not been open. You are not expected to trust them not to have backdoors any more that you are expected to trust any other vendor (say, Microsoft). What you are expected to do is trust that it catches virus and third party spyware. Which, supposedly, it does, and people have been using it for ages. Even if it was open, you would need to have it in binary form to run it, so you either need to know to compile it yourself and check the code first (not an option for 99.9999999 of the users) or trust the party that compiled it for you. And then you need to check again for every virus definition and engine update downloaded. Better just trust the vendor and use it closed source...
s_henry_paulson 15y ago
This isn't antivirus software, it's PcAnywhere.

by drcube 15y ago

elliottcarlson 15y ago

There is a large market for antivirus software - obviously Symantec is one of the biggest - but there are trade secrets in how their heuristics engines work and other secrets that give them a possible competitive edge.

drcube 15y ago
Seems to me like they would also get a competitive edge by ignoring the expensive antivirus programming and just sending the occasional false alert to the user to make them think their software is actually doing something. When they get a real virus: "Well, we can't catch all of them, sorry. Go ahead and pay for an update, that might fix it." How would you even know, unless you saw the source code?
- Travis 15y ago
  Aside from the difficulty in uncovering the truth, I think this would be a clear example of criminal fraud. It would take a pretty large effort to cover up something like this, as well (disgruntled ex-employees would be hugely incentivized to speak to prosecutors). So while you probably wouldn't know via technical means, my gut feeling is that a conspiracy in a company that large would quickly surface.
  - drcube 15y ago
    I agree. My point was that you don't know what they're doing. It probably isn't as bad as "nothing at all", but you can't say where along the spectrum between that and "rock solid" they actually lie without taking a peek under the hood. Which is why I'm a proponent of free and open-source software wherever possible, especially for security applications.

slowpoke 15y ago

Exactly. I've been saying this time and time again in the past: you cannot trust proprietary software for security, full stop. As you point out, it's security through obscurity (which we all know isn't really security), but what's more, you can never know if there is a backdoor in proprietary software, or if it's actually doing what it's supposed to do (and not less, or more - like logging your activity or listening in on your traffic).

batista 15y ago

I know nothing about antivirus software, but isn't security software supposed to be open? This is antivirus software, a specific sub genre of security software. Historically, the most popular such packages have not been open. You are not expected to trust them not to have backdoors any more that you are expected to trust any other vendor (say, Microsoft). What you are expected to do is trust that it catches virus and third party spyware. Which, supposedly, it does, and people have been using it for ages. Even if it was open, you would need to have it in binary form to run it, so you either need to know to compile it yourself and check the code first (not an option for 99.9999999 of the users) or trust the party that compiled it for you. And then you need to check again for every virus definition and engine update downloaded. Better just trust the vendor and use it closed source...

s_henry_paulson 15y ago

This isn't antivirus software, it's PcAnywhere.