full-disclosure - Re: Anti virus installations on Windows servers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 1 May 2009 13:52:34 -0400
From: T Biehn <tbiehn@...il.com>
To: Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Anti virus installations on Windows servers

The example provides an easy to concoct scenario where perhaps
anti-virus software might be employed to great benefit where the
actual OS's security would be a moot point. A sort of catalyst for
expanding VK's ability to consider the other side of the argument, by
not handing this to him on a silver platter I give him the opportunity
to grow as a person. Thank you for ruining this.

It's interesting to see that so many on this list have become so
hypnotized that they would go so far to say that A/V is useless and
the only possible protection is switching to some other OS. They are
the definition of idealist and cannot see past their own rhetoric,
unable to consider any other possible scenario, or look at a problem
from a broader perspective.

Let me address your point directly, you obviously share the same delusions:
Being so generic it is possible to concoct a situation in the above
framework wherein A/V would not be applicable.
Pointing this out has no bearing on my argument.
It is equally obvious to point to an example when, yes, an A/V
(however deployed) would provide a worthwhile added value to the user
experience, this point is sufficient for winning the debate.

-Travis

On Fri, May 1, 2009 at 8:38 AM, Pavel Kankovsky
<peak@...o.troja.mff.cuni.cz> wrote:
> On Wed, 29 Apr 2009, T Biehn wrote:
>
>> What do you suggest to use on a server that must accept uploads of
>> binaries from users?
>> Should these binaries be scanned by an anti-virus? Can we trust that
>> end users have competent Anti-Virus?
>
> This question is a kind of non-sequitur because you have not told us
> what kind of binaries are uploaded, where do they come from, what is
> the server supposed to do with them.
>
> Let me fill the gaps myself for the sake of demonstration: Users compile
> their own programs for some obscure kind of embedded computer and upload
> the resulting binaries to a server that is supposed to archive them for
> future reference. Should these binaries be scanned by an anti-virus?
> What do you think?
>
> --
> Pavel Kankovsky aka Peak                          / Jeremiah 9:21        \
> "For death is come up into our MS Windows(tm)..." \ 21th century edition /
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/