Re: Show me the Virrii!

[Valdis.Kletnieks () vt edu]

On Sun, 04 Jan 2004 21:55:49 EST, Harry Hoffman <hhoffman () ip-solutions net>  said:

> I'm not sure that not protecting against known threats is a good idea. The
> willingness to accept a "0-day" is limited by the necessity of Internet usage,
> which (usually today) is a nesessity.

On the other hand, your system getting wiped out by a nuclear blast is *also* a
known threat, but one which most people don't bother with protecting against
because the cost-benefit ratio sucks.

> Not to protect against known virii would be negligent and lazy which is why most
> modern OS's provide these "fixes" as patches to eventually become part of the
> main OS.

My point was that if the goal is to provide actual protection for the end user
rather than something that looks good next to a ruler, you quickly reach a
point of diminishing returns in trying to include more signatures.  At some
point, what you should be doing to maximize return is saying "screw it, that's
enough viruses, let's look at bundling Thor Larholm's Quik-Fix in here".

Also, consider this - if the product is otherwise good, which does more good to
the user community - release *now* with a database of 75 signatures that catch
99.8% of the stuff, or hold off for a year while we track down the 650
additional signatures needed to push it to 99.9%.  The case can also be made
that failing to do something "quite good" now because you're waiting for "
almost perfect" is even more negligent than putting in "quite good" knowing
there's only 2 or 3 9's rather than 4 (especially when the known risk of a
0-day is much higher than the extra 9 of protection against old stuff).

Attachment: _bin
Description: