[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.DEB.1.10.0808151257440.15109@asgard.lang.hm>
Date: Fri, 15 Aug 2008 13:05:47 -0700 (PDT)
From: david@...g.hm
To: Valdis.Kletnieks@...edu
cc: "Press, Jonathan" <Jonathan.Press@...com>,
Peter Zijlstra <peterz@...radead.org>,
Helge Hafting <helge.hafting@...el.hist.no>,
linux-kernel@...r.kernel.org, malware-list@...ts.printk.net,
hch@...radead.org, andi@...stfloor.org, viro@...IV.linux.org.uk,
alan@...rguk.ukuu.org.uk, Arjan van de Ven <arjan@...radead.org>
Subject: Re: [malware-list] TALPA - a threat model? well sorta.
On Fri, 15 Aug 2008, Valdis.Kletnieks@...edu wrote:
> On Fri, 15 Aug 2008 10:47:15 PDT, david@...g.hm said:
>
>> in any case the vunerability is limited as the next time the signatures
>> are updated the files would get scanned again, so I don't think it's a big
>> problem in practice.
>
> This problem is actually identical to "new file scanned, but you don't have
> the signature available yet so malware isn't detected".
>
> Those of us who have seen large mail servers pile up queues in the 10s of
> millions in the 45 minutes between when the worm went critical-mass and when
> we got a signature might disagree on it not being a big problem in practice.
>
> Of course, if that's considered "outside" the threat model, somebody better
> start writing down exactly what small corner of threat model this is actually
> helping against...
go back to the beginning of this thread. that is defining the (very
limited) thread model that they are trying to defend against.
the rest of us are not trying to defend against this threat model. we are
trying to identify the appropriate infrastructure that could be used by
the TALPA folks for their work, that can also be reasonable for inclusion
in the kernel (which includes being suitable for other similar purposes,
such as filesystem indexing)
we agree that the threat they are trying to defend against is a very small
portion of the overall threat, but there are other components (including
SELinux) that are available to deal with other portions of the overall
threat.
if you want to say that the solution is too limited to be worth while,
then you need to write a new threat model that you think is what should be
defended against and then we can start discussing how to defend against
it.
David Lang
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists