Secure Coding mailing list archives

Re: Administrivia & Request: Aloha, the moderator is back


From: jnf <jnf () datakill org>
Date: Mon, 29 Mar 2004 17:26:25 +0100

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Really what I find most frustrating time and time again, is simply that 
everyone seems to think that mcaffee/nortons/etc are competent and decent 
av software, which im sure some here probably will disagree with me, but a 
quick google on either will show a lengthy trackhistory of problems, 
really I wish kaspersky would get more coverage as it really is superior 
(i realize at this point im just tossing opinions around, but really look 
into the matter some and im fairley confident you will end up agreeing 
with me) In addition to that everyone seems to miss one vital problem 
about viruses in general (aside from the problems inherant in allowing vbs 
in email and things of that nature), is simply that users are not 
educated, and no one really attempts to make them educated- no program or 
security will ever stop the end user who truly believes that porn.exe is 
actually a picture of some naked girl. Problems will continue as long as 
people accept answers like 'if you had a firewall, this couldnt have 
happened' [of course it couldve, plus maybe the correct answer here is 'if 
we didnt have a skewed method of deciding whether your system was patched 
or not you mightve actually gotten the patch and avoided the worm but 
instead our system decided your system was patched and it wasnt, but if 
you had a firewall it wouldnt have happened], and we continue to expect 
people to not know anything about computers. At least basic file type 
extension knowledge should be manadtory at any workplace where email or 
inet access exists. I guess I am somewhat rambling at this point, but I 
guess my overall points summed up are:

1) people should really actually look into what exists for av software and 
compare them rather than listening to the kid at compusa who most likely 
doesnt even know what differences exist. 
2) stop accepting insane ideas about what the users shouldve been doing to 
cover up the fact that the software maker made a huge goof [i.e. 
msblaster]
3) this is the year 2004, we can no longer accept total computer 
ignorance, face it computers are here to stay and not knowing how to use 
one is like saying i dont know how to use the phone- further more the most 
basic knowledge of computers (i.e. file extensions) is required, and not 
knowing it is like not knowing the area code to your phone number.

of course these wont solve everything, but i think if people implemented 
those ideas we would see a huge decrease in such activity- but thats just 
my 4 peso's.

j

p.s. 
i am in no way affiliated with kaspserky, i just like their software, on a 
side note i am not the only one, go find a virus writer in say #virus, and 
ask them what av scanner they think is the best and why.




On Sun, 28 Mar 2004, Kenneth R. van Wyk wrote:

Aloha all,

Just got back from a couple of weeks of sun and golf in Hawaii with my wife 
and, although I was checking email daily (thanks to T-Mobile unlimited GPRS 
data), it's been pretty quiet here on SC-L.  In any case, though, I'm back now and 
open for business, FYI.

And here's a bit of food for thought...  I've been invited to be on an 
upcoming TechTV segment on the topic of computer viruses.  I'm not sure how 
much leeway I'll have in steering the discussions, but if appropriate, I'd 
sure like to slip in a good word for software security as a vital topic that 
isn't being adequately addressed presently.  I'd love to hear suggestions 
from this group as to what _the_ key message is that you think I should try 
to get across to the viewers.  Responses on or offline would be most 
appreciated.

Mahalo,

Ken van Wyk

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (OpenBSD)

iD8DBQFAZu0XsKAeTAhLiCERAk6BAJ9TQxrpBc6rIefVJgC0huvKCNDJtwCfa6M0
p/Bpjss6/xPUIyyoDeN6N/4=
=J/Gv
-----END PGP SIGNATURE-----






Current thread: