full-disclosure - Re: [FD] AV scan on read vs write debate....

Open Source and information security mailing list archives

Message-ID: <CAEFNj3MA+94Xa62RrNrUDDYXic6o84a0qHiifn2-OMMQg0sz4g@mail.gmail.com>
Date: Tue, 1 Jul 2014 14:26:57 -0400
From: Joe Brown <joeb1kenobe@...il.com>
To: Yoann Gini <yoann.gini@...il.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] AV scan on read vs write debate....

A compromise might be to have scan on Write only, with a forced full system
scan of all files at a certain time. For example at lunch time.

1. You don't have an all the time performance hit.
2. Files will be checked on a daily/weekly basis.

Negatives are that these files may sit on the device while waiting for the
next scheduled scan.

Joe

On Mon, Jun 30, 2014 at 2:45 AM, Yoann Gini <yoann.gini@...il.com> wrote:

>
> Le 30 juin 2014 à 01:48, Reindl Harald <h.reindl@...lounge.net> a écrit :
>
> > but if you are talk with Apple "the OS is secure" priests
> > forget it, they are learning resistent
>
> This is not true anymore. Any Apple representative wont tell you that
> nowadays. Even more, Apple has a small antivirus builtin in the system. But
> signatures based, focused on major OS X threats. No heuristics, no
> detection of windows malwares.
>
> Le 30 juin 2014 à 01:38, Exibar <exibar@...lair.com> a écrit :
>
> > they claim they have a huge performance
> > improvement with scan on read turned off...
>
>
> This is also true. Sadly. I work only on Apple products (and I use
> antivirus), I never seen a good product who don’t slow down the computer as
> shit.
>
> From a sys admin perspective, Antivirus editors don’t take the Mac
> seriously, their product are slow and sometime published with too much bug
> inside. That don’t help Mac users to have any trust in it…
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/
>

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives