|
Marc Clifton wrote: Why do viruses exist? Because of bugs in the operating systems and applications that we do pay for
Sometimes.
Years ago I got ahold of the source code for a virus called the I Love You Virus[^]
Aside from the silly email stuff, it essentially was 3 pages of VB code that deleted whatever it could from the Windows folder and all subfolders under it.
No 'bug' allowed that. Some deviant came up with this and wrote it.
If it's not broken, fix it until it is
|
|
|
|
|
Kevin Marois wrote: it essentially was 3 pages of VB code that deleted whatever it could from the Windows folder and all subfolders under it.
Kevin Marois wrote: No 'bug' allowed that.
You don't think an OS should protect against uninitiated code execution and file deletion?
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
Sure. It's just that it's not possible.
There's always someone smarter. And any attempt to protect can always be overcome.
If it's not broken, fix it until it is
|
|
|
|
|
Kevin Marois wrote: There's always someone smarter. And any attempt to protect can always be overcome.
But the same applies to the anti-virus products.
From the end-user POV the OS should be secure and its the OS supplier who should bear the burden of making it so. The current 3rd party arrangement seems very flawed.
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
Do you make your software virus proof?
If it's not broken, fix it until it is
|
|
|
|
|
To the best of my ability - but most of the responsibility lies with the OS and browser since they're doing the low level stuff.
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
And someone better will defeat it... But that's your fault, right?
By your logic, YOU should have put more time and expense into defeating all viruses that might attach your software.
If we as developers tried that, the cost of our apps would skyrocket and the app side would be exponentially huge, and it would never be done.
If it's not broken, fix it until it is
|
|
|
|
|
Kevin Marois wrote: If we as developers tried that, the cost of our apps would skyrocket and the app side would be exponentially huge, and it would never be done.
Which is why we rely on the OS and its API's to be secure. 
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
"If we as developers" includes OS providers. They do have some level of protection in there, but they cant stop everything and if they tried the already over-priced Windows would never be purchased.
If it's not broken, fix it until it is
|
|
|
|
|
Kevin Marois wrote: If we as developers" includes OS providers. They do have some level of protection in there, but they cant stop everything
Of course but you seem to be suggesting that only a rudimentary level of security is OK and we should rely on 3rd party anti-virus developers to do the hard stuff.
If the AV folks can do it - why not the OS developers?
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
Kevin Marois wrote: By your logic, YOU should have put more time and expense into defeating all viruses that might attach your software
The answer to that is obviously no, but as a developer, I don't think it's unreasonable to be expected to at least try to mitigate potential issues when you design your apps. That's why, after all, threat modeling tools exist. They're not just for OS designers.
It starts with not requiring the user to run as an admin, not saving passwords in plaintext--those sorts of things. You're not entirely absolved from any responsibility just because there's an anti-virus running that's trying to protect the user from himself.
|
|
|
|
|
So then where do you draw the line separating "uninitiated code execution and file deletion" from "legitimate code execution and file deletion?"
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
|
|
|
|
|
That's the $64,000 question. Today Linux distros, OS X and Windows all have slightly different answers but all of them provide pretty good security. All are more secure today than they were 10 years ago or even last year.
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
This is the reason it's unreasonable to try to code around it.
Who decides who can and cannot delete files?
If it's not broken, fix it until it is
|
|
|
|
|
Kevin Marois wrote: it's unreasonable to try to code around it.
 Do you prefer the "Wild West" days of DOS where any attachment in an e-mail could wipe your HD? Just because it's difficult doesn't make it unreasonable.
Kevin Marois wrote: Who decides who can and cannot delete files?
Notifying the user and asking permission / requiring a password is where they usually end up. Windows has things like User Account Control, Firewall and Drive Encryption. OS X has GateKeeper (App signing), Encryption and Firewall.
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
Kevin Marois wrote: Who decides who can and cannot delete files?
Ultimately, Access Control Lists, and they generally work as designed.
|
|
|
|
|
Mike Mullikin wrote: You don't think an OS should protect against uninitiated code execution and file deletion?
No! No, I don't. Unless you know how to implement mind reading capabilities and embed it into OS, anything you do regarding this 'issue' will be more of an annoyance then actual solution.
|
|
|
|
|
Mladen Janković wrote: No! No, I don't.
 You would prefer that an e-mail attachment or some script in a web page could (without your permission or knowledge) modify / delete files on your computer?
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
If I clicked attachment it's damn job of a mail client to open it and not to nag me. It's my own fault if the attachment has malicious behavior.
I have used clients that make you go through all kind of hoops just to open attachments, f*ck that!
|
|
|
|
|
...and if some web site is hacked and a "normal" link runs a script that kills your data too bad, huh? That's harsh!
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
Kevin Marois wrote: No 'bug' allowed that. Some deviant came up with this and wrote it.
That's a very good example and creates a strong point toward the debate.
Wow, that sounds sarcastic when I typed it, but I really mean it.
|
|
|
|
|
Do you also expect fire or health insurance to be free?
|
|
|
|
|
Mladen Janković wrote: Do you also expect fire or health insurance to be free?
Of course not, but keep in mind that the word "insurance" is misleading. It doesn't ensure that your house won't burn down or that you won't die. It is more of an "assurance", that you can replace damaged property or your spouse won't be financially crippled by your death.
AV software isn't "insurance" or even "assurance." It's preventing (in a condom sort of way) problems with something that's originally flawed.
Marc
|
|
|
|
|
Fine! Fire and burglar alarms should be free.
|
|
|
|
|
Mladen Janković wrote: Fire and burglar alarms should be free.
No, because it's not an intrinsic problem with your house. 
And granted, I'm arguing more for the sake of the argument than any real reason. 
Marc
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
