McAfee + FUD ?

["r0tten c0re" <david.jonass () googlemail com>]

Hi all,

Seems like McAfee choose to counter FUD by more FUD which triggered this :
http://www.nruns.com/_downloads/PR-08-02_Reaction_to_McAfee_statement.pdf

I have been aware of the ongoing AV insecurity catastrophe but not
read about this mcafee<->nruns discussion. Anyways a good read.

"n.runs welcomes the AV-Industry SDL (Secure Development Lifecycle)
effort spearheaded by McAfee. While we greatly support the
introduction of an SDL, it will not entirely extinguish flaws with
security relevance. Although it has the potential of greatly reducing
their number and impact, it will not lead to invulnerable software. In
order to reach this goal, we consider it necessary to reduce the
amount of trusted code to an absolute minimum, reduce the attack
surface to an absolute minimum and place all untrusted code into a
strictly confined environment. This way no matter how badly the code
behaves, and no matter how many vulnerabilities it has, it cannot
violate the security requirements."

Regards,
David

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/