4 ms·
The fundamental problem is that anti-virus software operates on the principle of enumerating badness: a list of known viruses and their signatures, a list of su
by andreasvc 14y ago
The fundamental problem is that anti-virus software operates on the principle of enumerating badness: a list of known viruses and their signatures, a list of suspicious patterns in binaries such as obfuscation techniques.
OSes should move to the opposite strategy, enumerating exactly what is allowed, and dropping anything else by default. The challenge here is that the granularity should be small enough for this to be effective, but on the other hand this gives configuration overhead for the user. For example, the firewall could enforce that only the user's preferred email application is allowed to send and receive mail. Currently the permissions in plugins and smartphone apps are too broad to be meaningful, but they're already experienced as a nuisance, so it's a difficult problem.
- rjbond3rd 14y ago> OSes should move to the opposite strategy, enumerating exactly what is allowed SELinux tries to do that, on a coarse level (but can't prevent user-inflicted problems).
- munin 14y ago> OSes should move to the opposite strategy, enumerating exactly what is allowed, and dropping anything else by default. when they do, it results in hackers being emo about Gatekeeper or the app store or whatever.
- RHSeeger 14y agoThe problem that most of the complaining is about (from what I've seen) over current sandboxing solutions is not that you need to enumerate what your application can do. Rather, it's that the OS makers decide that certain functionalities are not allowed by apps (running downloaded code, etc) and just don't allow them. I think a lot of people would prefer that all functionalities be available, but each one need to be specifically allowed by the user. That being said, that makes life harder for the user.
- arnsholt 14y agoThe most fundamental problem is that perfect anti-virus is impossible. According to Rice's theorem, you cannot in the general case prove any run-time property of a program solely by looking at its code, which means that can't 100% reliably detect viruses simply by looking at the code.
- torus 14y agoThis is a better approach, but as you say it does put the configuration overhead on the user - and many users will just click "yes" when asked whether to allow something. So user eduction is important, but hard to ensure across a whole organisation for example.