3 ms·

> If you can protect a computer from a virus, you can protect it from a DVD ripper. The antivirus vendors, champions of "Enumerating Badness", (http://tinyurl.

> If you can protect a computer from a virus, you can protect it from a DVD ripper. The antivirus vendors, champions of "Enumerating Badness", (http://tinyurl.com/8a2uk http://tinyurl.com/8a2uk) would like us to think so. Yet it is pure nonsense. It is much the same as saying that if a house is safe against burglars, it must also be "safe" against the owner engaging in officially forbidden sex acts in the master bedroom.

tptacek 17y ago
Marcus Ranum also believes that closing holes in Linux is "enumerating badness", and counts as one of the "dumbest ideas in security". Since you didn't make an argument that refered to any technical detail of the antivirus/antimalware problem on general purpose operating systems, I'm content simply to point out that your sources are both comical and non authoritative. Also: let me strongly encourage you to run your views on computer security past Ranum, and report back his response. Warn me first so I can get a get a cold glass of milk to blast out my nose when you do.
- asciilifeform 17y ago
  I have never heard of Ranum before. He was simply the top Google hit for the well-known phrase "enumerated badness." For all I know, he might also be, say, a Creationist. This is immaterial. Please make an actual argument, as opposed to trumpeting my supposed ignorance of everything in general terms. Does your front door lock work by checking a video feed against a database of known burglar mug shots and clicking shut in the event of a match, or by staying locked sans a key? Security through enumerated badness (as opposed to actual robustness, as in the above example) is Bad. The phrase has a meaning. If you believe that it means something other than what I believe it to mean, please say so. So far, all of your arguments have been thinly veiled appeals to authority. Please take a moment to think of one which is not. I would like to believe that you have genuine thoughts, and would like to hear them.
  - wmf 17y ago
    I don't think tptacek is defending the AV industry; I suspect he's advocating systems that are either inherently virus-resistant or use whitelisting, which is pretty much the opposite of what we usually call "antivirus". If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing, if not necessarily exactly what TCG is proposing.
    - asciilifeform 17y ago
      > If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing Limiting malware to an officially approved subset is a curious definition of "escape." And any program which causes my computer to deliberately act against my orders is malware, whether it was created by a script kiddie or a multi-billion-dollar media cartel.
      - tptacek 17y ago
        Nobody here disagrees with that. What's funny is that it's the current situation that allows companies like Sony to do that to your computer.
        asciilifeform 17y ago
        Let's posit that Sony (or another company) is in the consortium holding the TPM root key. They will then be able to install a truly undetectable and unremovable you-name-it. You are quite correct in implying that a TPM would prevent a repetition of the Sony scandal. It would do this simply by preventing discovery. Of course, it is also possible that Sony in particular would not be given access to the magic key. They may have to pay a steep tribute to, say, Microsoft, to slip the payload through. Whether currently sold TPM chipsets are capable of such feats is immaterial. The camel's nose is in the tent.

tptacek 17y ago

Marcus Ranum also believes that closing holes in Linux is "enumerating badness", and counts as one of the "dumbest ideas in security". Since you didn't make an argument that refered to any technical detail of the antivirus/antimalware problem on general purpose operating systems, I'm content simply to point out that your sources are both comical and non authoritative. Also: let me strongly encourage you to run your views on computer security past Ranum, and report back his response. Warn me first so I can get a get a cold glass of milk to blast out my nose when you do.

asciilifeform 17y ago
I have never heard of Ranum before. He was simply the top Google hit for the well-known phrase "enumerated badness." For all I know, he might also be, say, a Creationist. This is immaterial. Please make an actual argument, as opposed to trumpeting my supposed ignorance of everything in general terms. Does your front door lock work by checking a video feed against a database of known burglar mug shots and clicking shut in the event of a match, or by staying locked sans a key? Security through enumerated badness (as opposed to actual robustness, as in the above example) is Bad. The phrase has a meaning. If you believe that it means something other than what I believe it to mean, please say so. So far, all of your arguments have been thinly veiled appeals to authority. Please take a moment to think of one which is not. I would like to believe that you have genuine thoughts, and would like to hear them.
- wmf 17y ago
  I don't think tptacek is defending the AV industry; I suspect he's advocating systems that are either inherently virus-resistant or use whitelisting, which is pretty much the opposite of what we usually call "antivirus". If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing, if not necessarily exactly what TCG is proposing.
  - asciilifeform 17y ago
    > If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing Limiting malware to an officially approved subset is a curious definition of "escape." And any program which causes my computer to deliberately act against my orders is malware, whether it was created by a script kiddie or a multi-billion-dollar media cartel.
    - tptacek 17y ago
      Nobody here disagrees with that. What's funny is that it's the current situation that allows companies like Sony to do that to your computer.
      - asciilifeform 17y ago
        Let's posit that Sony (or another company) is in the consortium holding the TPM root key. They will then be able to install a truly undetectable and unremovable you-name-it. You are quite correct in implying that a TPM would prevent a repetition of the Sony scandal. It would do this simply by preventing discovery. Of course, it is also possible that Sony in particular would not be given access to the magic key. They may have to pay a steep tribute to, say, Microsoft, to slip the payload through. Whether currently sold TPM chipsets are capable of such feats is immaterial. The camel's nose is in the tent.