3 ms·

The observation is that there is an anti-malware facility. Then there's a leap to the conclusion that it is an anti-virus facility. Did I miss some important

by pohl 17y ago

The observation is that there is an anti-malware facility. Then there's a leap to the conclusion that it is an anti-virus facility. Did I miss some important detail here? I thought a virus was a very specific type of malware, and there's not enough detail to conclude that it is "anti-virus".

tptacek 17y ago
Meh. There's no meaningful difference. Malware's the general term. A virus is malware that spreads passively. A worm is malware that spreads actively. "Trojan" is a bad term for the malware trait (which worms and viruses can have) of allowing unauthorized users access to the infected host. It's probably better not to dignify the "science" of malware by enforcing proper usage of terminology.
- pohl 17y ago
  The distinction becomes relevant when comparing operating systems and their relative susceptibilities to viruses. That a given operating system is vulnerable to malware in general is not notable, because users will be duped by dancing babies, porn, and infected stolen software. That a given operating system ever allowed unaided self-replication take place is, and this is where Apple's marketing message has been placed.
  - wmf 17y ago
    I see your point that an OS that only gets trojans is better than an OS that gets trojans, viruses, and worms. However, I think it is possible to confine trojans better than we do today and it would be a shame to just give up hope on that front.
  - tptacek 17y ago
    Huh? There is no feature in OS X that makes it any harder to write self-replicating code ("worms"). Code running in almost any OS X process has full access to all the xnu system calls, and (invariably) to at least one user's home directory and Library/ folder. There's no operating system in common use for which malware distinctions are meaningful. They're all equally vulnerable.
    - tvon 17y ago
      * A worm is self-replicating across a network, typically without any interaction from a user. * A trojan requires a user to grant the malware privileges, or just to install it or at least to run it with their own privileges. I don't see how that's not an important distinction.
      - tptacek 17y ago
        Neither OS X nor Windows has been free of remote code execution vulnerabilities. Neither OS X nor Windows has any current published unpatched remote code execution vulnerabilities. Nothing in the architecture of OS X or Windows prevents remote code execution vulnerabilities. About the best thing you can say for OS X with respect to this problem is the fact that most of the "interesting" services are disabled by default, which did not used to be the case on Windows. I don't disagree that this was a win, but it was hardly an architectural difference.
        tvon 17y ago
        I should have indicated what I was responding to: > Huh? There is no feature in OS X that makes it any harder to write self-replicating code ("worms"). Code running in almost any OS X process has full access to all the xnu system calls, and (invariably) to at least one user's home directory and Library/ folder. That's not what a worm is, and you keep mixing up terms in this thread. * Malware is code that does bad things to your computer. * A virus is self-replicating code that probably does bad things (harmless, proof-of-concept code is sometimes let loose). A virus is a kind of malware. * It's a worm when it's delivered and spreads over the network by a remote exploit. * It's a trojan when it's delivered by tricking the user into installing it. The difference between malware and a virus, okay that's fairly minor, but a virus vs a worm vs a trojan is significant. This isn't some lingo the kids use on IRC either, these are all terms you can find int he OED (at least the one that comes with OSX).
        tptacek 17y ago
        Like I said upthread: I disagree with your definitions, but debating malware terminology is silly; the terms mean whatever the antivirus companies and "researchers" say they do. You win. The meaningful topic you can debate is whether OS X is more or less resistent to any form of malware than Windows is. I'll argue that there's simply no significant difference, and, respectfully, I think you'll lose with the opposing argument, but I'm happy to hear you out.
- tvon 17y ago
  A trojan is malware that misrepresents itself as something else (eg, user is tricked into willingly downloading and installing SuperFunGame.exe which is actually malware), it has nothing to do with the result of running the malware (which may or may not be to allow 3rd party access to your system). As with the trojan horse, it's just a delivery mechanism for something else.
  - tptacek 17y ago
    I might just be getting old, but I seem to remember virtually every virus being distributed as "SuperFunGame.exe" as well. My point, though, is that these terms are silly, and arguing over them dignifies an undeserving research field. So you win. ;)
- deleted 17y ago
  [deleted]

by pohl 17y ago

tptacek 17y ago

Meh. There's no meaningful difference. Malware's the general term. A virus is malware that spreads passively. A worm is malware that spreads actively. "Trojan" is a bad term for the malware trait (which worms and viruses can have) of allowing unauthorized users access to the infected host. It's probably better not to dignify the "science" of malware by enforcing proper usage of terminology.

pohl 17y ago
The distinction becomes relevant when comparing operating systems and their relative susceptibilities to viruses. That a given operating system is vulnerable to malware in general is not notable, because users will be duped by dancing babies, porn, and infected stolen software. That a given operating system ever allowed unaided self-replication take place is, and this is where Apple's marketing message has been placed.
- wmf 17y ago
  I see your point that an OS that only gets trojans is better than an OS that gets trojans, viruses, and worms. However, I think it is possible to confine trojans better than we do today and it would be a shame to just give up hope on that front.
- tptacek 17y ago
  Huh? There is no feature in OS X that makes it any harder to write self-replicating code ("worms"). Code running in almost any OS X process has full access to all the xnu system calls, and (invariably) to at least one user's home directory and Library/ folder. There's no operating system in common use for which malware distinctions are meaningful. They're all equally vulnerable.
  - tvon 17y ago
    * A worm is self-replicating across a network, typically without any interaction from a user. * A trojan requires a user to grant the malware privileges, or just to install it or at least to run it with their own privileges. I don't see how that's not an important distinction.
    - tptacek 17y ago
      Neither OS X nor Windows has been free of remote code execution vulnerabilities. Neither OS X nor Windows has any current published unpatched remote code execution vulnerabilities. Nothing in the architecture of OS X or Windows prevents remote code execution vulnerabilities. About the best thing you can say for OS X with respect to this problem is the fact that most of the "interesting" services are disabled by default, which did not used to be the case on Windows. I don't disagree that this was a win, but it was hardly an architectural difference.
      - tvon 17y ago
        I should have indicated what I was responding to: > Huh? There is no feature in OS X that makes it any harder to write self-replicating code ("worms"). Code running in almost any OS X process has full access to all the xnu system calls, and (invariably) to at least one user's home directory and Library/ folder. That's not what a worm is, and you keep mixing up terms in this thread. * Malware is code that does bad things to your computer. * A virus is self-replicating code that probably does bad things (harmless, proof-of-concept code is sometimes let loose). A virus is a kind of malware. * It's a worm when it's delivered and spreads over the network by a remote exploit. * It's a trojan when it's delivered by tricking the user into installing it. The difference between malware and a virus, okay that's fairly minor, but a virus vs a worm vs a trojan is significant. This isn't some lingo the kids use on IRC either, these are all terms you can find int he OED (at least the one that comes with OSX).
        tptacek 17y ago
        Like I said upthread: I disagree with your definitions, but debating malware terminology is silly; the terms mean whatever the antivirus companies and "researchers" say they do. You win. The meaningful topic you can debate is whether OS X is more or less resistent to any form of malware than Windows is. I'll argue that there's simply no significant difference, and, respectfully, I think you'll lose with the opposing argument, but I'm happy to hear you out.
tvon 17y ago
A trojan is malware that misrepresents itself as something else (eg, user is tricked into willingly downloading and installing SuperFunGame.exe which is actually malware), it has nothing to do with the result of running the malware (which may or may not be to allow 3rd party access to your system). As with the trojan horse, it's just a delivery mechanism for something else.
- tptacek 17y ago
  I might just be getting old, but I seem to remember virtually every virus being distributed as "SuperFunGame.exe" as well. My point, though, is that these terms are silly, and arguing over them dignifies an undeserving research field. So you win. ;)
deleted 17y ago
[deleted]