Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

Can the Malware Industry be Trusted? 185

Posted by timothy from the surely-you-jest dept.
Joe Barr writes "Is the entire anti-virus / malware industry as rotten as it appears? I started digging into it as a result of the recent lame, unsubstantiated assertions of viral threats to Linux by Kaspersky Lab, but the practice doesn't seem to start or end with them. Who knows, maybe it's pandemic in that entire segment of the IT industry."
This discussion has been archived. No new comments can be posted.

Can the Malware Industry be Trusted? More

Can the Malware Industry be Trusted?

Comments Filter:

  • gee... (Score:5, Insightful)

    by grasshoppa ( 657393 ) on Thursday June 08, 2006 @11:00AM (#15494590) Homepage
    An industry blowing problems up to be bigger than they seem in order to sell more product? Conspiracy!

    The only real crime here is that we've let ourselves be suckered by them for as long as we have.

    • Re:gee... (Score:4, Funny)

      by Tackhead ( 54550 ) on Thursday June 08, 2006 @11:08AM (#15494653)
      > An industry blowing problems up to be bigger than they seem in order to sell more product? Conspiracy!

      No, that's Government. (Wait, there's a difference?)

      • Re:gee... (Score:4, Funny)

        by tnk1 ( 899206 ) on Thursday June 08, 2006 @11:41AM (#15494945)
        No, that's Government. (Wait, there's a difference?)

        That's like saying there's no difference between the organ grinder and his trained monkey. Of course, there is a difference. One of them dances around, makes monkey noises, and steals stuff from you for the benefit of the other.

      • I believe there isn't.

        You should watch century of the self [bbc.co.uk] if you get the chance. It lays out how the psyche of people have subtly being manipulated for both commercials as policital reasons.

        The documentary shocked me as I've never thought it would've been as well defined and with as clearly defined "goals".

    • Re:gee... (Score:3, Insightful)

      by scronline ( 829910 )
      Well, on the Windows platform it's well justified doom and gloom. But like with any corperation (read greedy) that sells a product, they are going to want to boost sales. So it's their job to state the reason(s) why their product is necessary. Many times the truth gets skewed in that process.

      But regardless of the fact that ANY software producer will hype their product (As I'm sure you've seen by reading /. the words Microsoft and Yankee Group should spring to mind) you have to take that hype with a grain

      • Re:gee... (Score:3, Insightful)

        by grasshoppa ( 657393 )
        However, I don't want to bash Kaspersky since after all, I prefer their AV software to any other mainstream product out there

        Nod32. Know it, love it.

        You may laugh, but there have been several times I've had people on Linux forwards me "jokes" with Windows viruses attached.

        Then that is the fault of a clueless email admin. I've setup many email servers, and I don't think a virus has ever made in past that point coming in or going out. It's quite simple really, which prompts me to call the admins in questio
        • What does it matter if the admin is/was less than knowledgable. Isn't that part of the point? My mail servers scan for all viruses and spam and....yadda yadda, but there are still those people out there that simply don't know. What about those people just learning linux? What about those rare cases where someone's filtering daemon isn't working and to allow mail to continue to pass while it's being repaired the filtering is bypassed? Or for that matter, I seem to remember a time when email filtering wa
    • I reread your comment. The irony slipped past me the first time :)

      but you know what, the entire industry isn't corrupt, there are at least 8 competing adware companies, and yes they ALL try to collect personal data, they ALL try to make the ads pay the bills. Some companies try to do it the right way. they keep the software running on their own servers, and their own products EG yahoo. some companies try to squeeze a little more out of the bottom line, and offer 'sweet deals' to opens source communities.
    • I was always pretty virus-savvy, but when I found vmyths.com Rob really opened my eyes. Someone doesn't need an antivirus program to go virus free, and I did it for years, and only got my first infection while I was running free AVG 7, and ran an insecure version of Java, giving me the javabyte virus when I must have surfed somewhere unsafe. It was easy to clean up fortunately.

      Every year Symantec has a critical flaw in their software, so someone can actually be SAFER without Norton on their computer, and a

  • Bad title! (Score:5, Insightful)

    by Rob T Firefly ( 844560 ) on Thursday June 08, 2006 @11:00AM (#15494592) Homepage Journal
    Surely they mean the anti-malware industry?

    • Re:Bad title! (Score:5, Funny)

      by truthsearch ( 249536 ) on Thursday June 08, 2006 @11:02AM (#15494604) Homepage Journal
      Exactly. I read the title and thought of course we can't trust the people who write malware... they write malware!!

    • Title is chillingly apropos (Score:4, Insightful)

      by TripMaster Monkey ( 862126 ) * on Thursday June 08, 2006 @11:05AM (#15494631)


      Not really...after all, these firms have absolutely no interest in eliminating the problem, but only in treating the symptoms. That's why they continually endorse an OS that is legendary for its security holes, while spreading FUD about more secure alternatives like *nix and MacOS, which have a chance of actually fixing the underlying problem.

      • Re:Title is chillingly apropos (Score:4, Interesting)

        by happyemoticon ( 543015 ) on Thursday June 08, 2006 @11:44AM (#15494977) Homepage

        What bugs me about the big guys is that they've become such gigantic products. They cause as many problems with their bloat as they fix, and they still don't fix everything (especially where Ad/Spyware is concerned). And this, of course, makes them REALLY not want to fix the underlying issue: people would start noticing that their computer starts up twice as fast and generally runs much better without some cyclopean anti-everything program.

        Symantec Client Security started out as an OK little product. At the time, I was very impressed that its UI was so clean. Now, they're a complicated amalgams of firewall, AV, anti-spyware, Cuisinart and dishwasher. While I realize that they sell integration, there's no reason that integration need entail poor usability and baffling complexity. I once tried to get FTP to work on a relative's computer. I found that in Norton there was no firewall rule for FTP anywhere (or it was named something weird), yet it was blocking all traffic. My only option was to completely disable their firewall (and people get pretty mad when you tell to disable something they paid for.

        The reason there's such a high pressure to integrate, of course, is that these guys make big bucks off of huge corporate licenses. Many IT or business development people I've talked to have said that they won't put anything except Norton on a desktop. I can see their point, because only dealing with one company means less IT and B2B overhead. And from Norton/Symantec's point of view, if they didn't offer a fully integrated solution, then somebody else would and they'd lose the client. So, they acquire every technology they possibly can and haphazardly jam it into their suite.

        While I'm posting, I will admit that the article is least partially true. At my company [robotgenius.net], we were somewhat embarassed to admit that we were sad when the first really apocalyptic adware site we'd found went offline. This wasn't because we wanted to drum up sales, but rather because they were a great test case for our technology.

        • At least in NIS 2006 you could create special rules to open specific ports, but it was not easy. Of course some of thier default settings were idiotic. By default NIS would block secure web pages. Add in that Symantec only offers pay for support phone calls, and you really have to wonder if they purposefully do this to hold thier customer's bank access hostage.
        • I worked for an on-site PC repair company and I would add that Norton causes more problems than spyware. I would go on more calls where PC's ran like crap because Norton products needed to be reinstalled than spyware cleanup calls. All I can say is thanks Norton for helping me pay my rent.
      • more secure alternatives like *nix and MacOS, which have a chance of actually fixing the underlying problem.

        How so? When replying, please consider that I'm Joe Sixpack, armed with the root password, just enough smarts to install stuff and not enough smarts to not install bad stuff.

        • Re:Title is chillingly apropos (Score:4, Interesting)

          by Y2 ( 733949 ) on Thursday June 08, 2006 @12:07PM (#15495160)
          more secure alternatives like *nix and MacOS, which have a chance of actually fixing the underlying problem.
          How so? When replying, please consider that I'm Joe Sixpack, armed with the root password, just enough smarts to install stuff and not enough smarts to not install bad stuff.

          I put it this way: Windows' application integration is built on a base of executing as instructions anything it finds which can possibly be executed. Documents and help files have embedded controls to be executed by the system, to name just one example. MS has learned that this is dangerous behavior, but their ability to move away from this model is severely hampered by the need to maintain compatibility, even basic functionality, with a mountain of installed base.

        • Linux and OS X have a good record for resisting drive-by installs. But as TimC points out, the threat model has to include users downloading dancing cursors and weather forecasting applets with 20-page EULAs, readable three lines at a time, which bury a cryptic line or two which means "all your base are belong to us".

          There are operating systems that can protect against that threat. They're not mainstream in design, and neither Linux nor OS X is among them.

          >please consider that I'm Joe Sixpack

          Joe Sixpack
          • Joe Sixpack -- four digit Slashdot id -- the cognitive dissonance is too much, I can't survi

            Ok, so I didn't mean that *I'm* Joe Sixpack, I meant something along the lines of "Explain to me how Linux or OS X can prevent me from screwing my machine over. While doing so, assume that I have the root password and am Joe Sixpack..."

            *I* am actually a developer with 7 years commercial experience who's been using a variety of different computer systems over the last 23 years, from my humble little Sinclair ZX Spectr
          • Linux and OS X have a good record for resisting drive-by installs.

            Not really. Consider that Firefox has had many drive-by exploits available for it, and nothing stops you installing software on Linux without root then altering startup scripts/gconf/kconfig/session manager to ensure it's always loaded. From there it's trivial to do many things, including (in the unlikely event you care) getting the root password.

          • There are operating systems that can protect against that threat. They're not mainstream in design, and neither Linux nor OS X is among them.

            Examples? I'd really like to see scum-ware persistently infect a RAM based PuppyLinux runtime. On that note, users are going to download crap, it's what users do. However, the scum-ware author ***KNOWS*** the OS layout for Win/OS-X, there's little flexibility, they can be 99% certain when estimating the fs/lib layout that what they need is there. On Linux, that's
          • Joe Sixpack -- four digit Slashdot id -- the cognitive dissonance is too much, I can't survi

            What'll really blow your mind is when you realize that his UID is actually 5 digits. ;)

          • Linux protects the user better than Windows from that on at least 2 different ways: 1) It normaly comes with the dancing cursors and weather forecasting apps included, so the user won't be that tempted to install them. 2) Most software doesn't have a EULA*, so we can teach Joe Sixpack to be sispicious of software that shows it.

            There are also 2 unrelated advantages: 1) Linux DEs don't ask confirmation every time for every stupid action, so the user gets used to read dialog windows. 2) Most document formats


          • Well, my wife doesn't have admin priv. on her OS-X box, so I don't have to worry too much about her installing things she shouldn't. The fact that the box is very usable for a non-admin user does help with resisting viral attacks.

        • "...more secure alternatives like *nix and MacOS, which have a chance of actually fixing the underlying problem." How so? When replying, please consider that I'm Joe Sixpack, armed with the root password, just enough smarts to install stuff and not enough smarts to not install bad stuff.

          Well, both of those OS's have some architectural advantages, like not needing to run network services for local actions, that make automated compromises less common. They both tend to be more responsive to vulnerabilities

      • "Not really...after all, these firms have absolutely no interest in eliminating the problem, but only in treating the symptoms. "

        Sounds familiar, hmm, where have I heard that business plan before?

        Not a big coincidence that the anti-malware firms are doing so well, when their business model mimics that of the (consistent) market darlings for the last two decades, big pharma.
      • Apparently you aren't actually keeping up with the industry.

        Symantec's CEO, John Thompson, made comments that everyone ought to buy a Mac.

        http://news.zdnet.co.uk/internet/security/0,390203 75,39269294,00.htm [zdnet.co.uk]

        (Disclaimer: I work for Symantec. My opinions are my own and not necessarily reflective of my employer.)

      • Not really...after all, these firms have absolutely no interest in eliminating the problem, but only in treating the symptoms.

        So look who is motivated to fix the problem. MS isn't, they aren't losing market share and they've introduced their own anti-virus to milk the situation. So who is? Well alternate OS vendors are (as you mentioned), since they can use it as a differentiator, but most of them don't really have a malware problem so they haven't put much effort into a better solution. Big, enterprise

    • Re:Bad title! (Score:3, Insightful)

      by gmf ( 810466 )
      Surely they mean the anti-malware industry?
      Maybe that's the same? Who knows?

    • Re:Bad title! (Score:3, Insightful)

      by buckhead_buddy ( 186384 )
      Rob T Firefly wrote:

      Surely they mean the anti-malware industry?

      I think there's a dubious market for malware. (Okay, so my old boss might be the type to commission a new virus, but most aren't.) The anti-malware markets need a continuous set of threats to be taken seriously and though they don't write the malware themselves, it's integral to their success in business.

      Advice from industry experts giving 'analysis' such as "The smarter virus writers won't deploy their security compromises until after Vista a

    • I pointed this out in an email to the 'duty editor' before the story went live, but they obviously didn't listen. Tagged 'badtitle'.

      Good thing they don't get paid for editing Slashdot. Oh, wait...

  • wtf? (Score:5, Insightful)

    by kunwon1 ( 795332 ) * <dave.j.moore@gmail.com> on Thursday June 08, 2006 @11:00AM (#15494595) Homepage
    From TFA:
    Today, players like McAfee, Symantec, Norton, and dozens of other firms fight for a share of a market worth tens-of-billions of dollars a year.

    If this guy doesn't know that Symantec == Norton, I don't think I have any use for his opinions on malware companies.

  • money (Score:5, Insightful)

    by Lord Ender ( 156273 ) on Thursday June 08, 2006 @11:03AM (#15494610) Homepage
    If you assume that every person is motivated by money alone, then you are forced to conclude that anti-malware companies have the greatest incentive to produce malware.
    • I think that even though the anti-malware industry surely tries to play fast and loose with the virus statistics and spread FUD for the less-vulnerable-by-design OSes (as we have seen in this article) that is not malicious at all- it's simply marketing. Just about every company (and especially politicians) everywhere will spin the facts to "create the need" for their products or services. However, I do not think that any anti-malware companies make viruses. That's a very good one for the conspiracy theorist

  • people DO believe this stuff (Score:5, Insightful)

    by yagu ( 721525 ) * <yayagu@[ ]il.com ['gma' in gap]> on Thursday June 08, 2006 @11:04AM (#15494617) Journal

    Agree or disagree with the points of this article (I mostly agree), there is an elephant in the middle of the room everyone ignores.

    From the article (emphasis mine):

    Every year, US-Cert produces huge fireworks in the security trade press with their annual summary of misinformation about security flaws. The idiots in the press repeat the lie verbatim and the lie becomes real. What is the lie? That Unix/Linux is less secure than Windows. Granted, only the stupidest dolts in the universe -- and the trade press -- are going to buy that crap, but they put it out there anyway.

    "Only the stupidest dolts in the universe?" Aside from being a little insulting, it's just not true. Many intelligent people believe these reports simply because, as the article points out elsewhere, because it is repeated the lie becomes truth.

    People trust "media" to the extent they don't have expertise in some subject matter. What other result would you expect? There are too many topics, too many reports, and too many things demanding attention, general consumers and lay people, appropiately (though naively), rely on integrity of reporting bodies to filter that part of their world not their specialty(ies).

    Reporting organizations (e.g., CERT) have an ethical responsibility to normalize and make canonical data issued for general consumption.

    Unfortunately the technology world today is Microsoft's sandbox, and seemingly if anyone wants to play, be it media, competition, and lately even government, Microsoft seems to be able to control the rules. Sigh, again.

    • You can't trust (U.S.) Media. In the cae of Jane Akre vs. Fox News, a U.S. Court of Appeals Judge ruled that Fox News (and by precident, every other media outlet) did not have a duty to report the news truthfully or factually.
    • People trust "media" to the extent they don't have expertise in some subject matter. What other result would you expect? There are too many topics, too many reports, and too many things demanding attention, general consumers and lay people, appropiately (though naively), rely on integrity of reporting bodies to filter that part of their world not their specialty(ies).

      What should we expect? We should expect that if something is important to you, you at least do some research into it. It isn't like the inform
    • "Only the stupidest dolts in the universe?" Aside from being a little insulting, it's just not true. Many intelligent people believe these reports simply because, as the article points out elsewhere, because it is repeated the lie becomes truth.

      I don't mean to be semantic, but would not a truly "intelligent" being be able to be able to tell the truth from propaganda, exagerations, and lies? As in your mental capabilities has been fully developed to discern social engineering?

      Otherwise, they wouldn't they wo
    • ""Only the stupidest dolts in the universe?" Aside from being a little insulting, it's just not true."

      Sure it's true. Assumption: the population considered includes only people who use computers and know that Linux/Unix/MacOS/Windows exists.

      The stupidest dolts could be half the population if you wanted. No quantity of 'dolts' is specified, so for all it matters, the stupidest dolts could include all but the smartest dolt.

      The real implication, however (and this is the part I love) is that it's logical
    • >People trust "media" to the extent they don't have expertise in some subject matter. What other result would you expect?

      I think that's a critically important observation, and if you extrapolate a little you get to an uncomfortable realization: people look for news that reaffirms what they want to hear. With the proliferation of news sources, you can find specialized news feeds, and end up with a situation where hundreds of thousands of Americans believe we found WMD's in Iraq -- because the repeated me

  • Gadzooks! (Score:5, Funny)

    by goldaryn ( 834427 ) on Thursday June 08, 2006 @11:05AM (#15494622) Homepage
    Every year, US-Cert produces huge fireworks in the security trade press with their annual summary of misinformation about security flaws. [...] The summary gives a total for flaws found in Windows and another total for flaws found in Unix and Linux. Last year, those totals were 812 for Windows and 2,312 for Unix/Linux.

    Oh ****! Quick, someone tell me how to upgrade to this "Windows" thing!

    • Re:Gadzooks! (Score:3, Funny)

      by jrumney ( 197329 )
      Last year, those totals were 812 for Windows and 2,312 for Unix/Linux.

      There's a simple reason for the difference between general perception (at least on Slashdot) and the raw statistics above. If a vulnerability is found in openssh, it counts as a flaw for Linux, for BSD, and for any Unix flavours that ship openssh by default. If a vulnerability is found in the ssh client that ships with Windows... oh wait.

  • perceived standard? (Score:5, Insightful)

    by OffTheLip ( 636691 ) on Thursday June 08, 2006 @11:05AM (#15494625)
    Microsoft has established itself as a standard so much so that even a 'unbiased' consumer organization such as Consumer Reports basically only acknowledges MS when reviewing computers and making recommendations. Apple is a player but not top tier. It's no wonder AV companies pander to MS and spread FUD. Logically, one would think that a business that exists to correct flaws in another product would lead consumers to shy away form that product but no, because MS is a standard.

    • It's no wonder AV companies pander to MS and spread FUD. Logically, one would think that a business that exists to correct flaws in another product would lead consumers to shy away form that product but no, because MS is a standard.

      Wait, why on earth would an industry that exists to correct flaws in another product lead consumers away from that product? If AV companies encouraged people to ditch Windows, actually be careful on the internet and take other measures to avoid malware, and people listened to th

      • I think OffTheLip was referring to the obvious point that if a product has spawned an entire industry that revolves around fixing it so that it actually works, that potential customers should be wary of using that product due solely to the existence of that industry. It implies that there are very serious problems with the original product. I do not think he meant that the industry itself should be engaging in self-destructive activities.

        The only situation where this is not the case is where the customers
  • Sure.

    OK if I install this spyware in your computer and just backup your credit card numbers for you without your permission?

    Thanks.

    Oh, no, that's ok, you don't have to answer. We'll do it anyway.

  • I trust some of the anti-malware industry (Score:3, Interesting)

    by Coopjust ( 872796 ) on Thursday June 08, 2006 @11:09AM (#15494668)
    Well, I certainly don't trust the malware industry :)
    Seriously, however, I never buy any peice of security software without looking for testing results and reviews.
    Also, I will never use any product that makes false positives intentionally (to scare the user into using/buying the product). That's just asking for trouble.
    • > Also, I will never use any product that makes false positives intentionally

      Hmm, you make an interesting point. Ever notice that when you run one of these expensive security suites and you don't get any meaningful results, you always get a couple of "dangerous" cookies found, just to keep the results above zero?

      The logic must be: Don't tell them it's clean. Use fud if necessary.

  • Fear and Protection Rackets (Score:5, Insightful)

    by RichMan ( 8097 ) on Thursday June 08, 2006 @11:11AM (#15494700)
    The whole thing is a protection racket. The more they can make you afraid of the consequenses and aware of the "threat" the more you are willing to pay for protection. The whole thing is based on a vulnerable infrastructre.

    If there was a solid infrastructre that was trusted the whole industry would disappear. The industry is based on the Microsoft Operating system and its designed vulnerabilities. The industry would not exist without the flaws in the Microsoft Operating systems and workflow. If Microsoft fixed its stuff, or if people migrated to a solid infrastucture the industry would disappear. I am sure the industry as a whole is looking at Linux as a big threat, it could destroy their whole reason for existing.

    As a whole the Linux client is not a market for this industry. They need to make Linux/OSS users feel the threat so we will by their product.
    • The whole thing? Let's not get carried away, please. The bad guys are out there. They are writing viruses and ammassing botnets for fun and profit. They are out to get you.

      TFA is on the mark in terms of the vacuous ethics of computer security software press releases and scare mongering but that doesn't mean that solid, secure operating systems would elliminate the need for anti-malware products. Maybe I'm wrong but I don't think the patching mechanisms for Linux distros and Macs or are so fantastic and/or t
    • A protection racket would be the anti-virus companies writing and releasing viruses, then charging you for protection from them. That's not what is happening here. Anti-virus products are certainly sold using scare tactics, but then again so is insurance. If someone discovers that Symantec is behind the latest virus that they're selling protection from, I guarantee criminal charges will follow.

  • AV for MacOSX: $59 -- Why? (Score:5, Informative)

    by JonTurner ( 178845 ) on Thursday June 08, 2006 @11:13AM (#15494717) Journal
    Agreed, the industry is full of FUD, along with other substances.

    Noticed a copy of AntiVirus for Mac OSX @ CompUSA last week. $59! Three questions:
    1) Who buys this stuff?
    2) Why so much?
    3) Why?

    To my knowledge there is only one virus in the wild for OSX and it never really made an impact. I understand that AV for Mac scans for the billions of Windows viruses, but considering that the Mac is extraordinarily unlikely to become infected, it's similarly unlikely a Mac will pass on a virus. I know it's part of being a good net citizen, but ultimately scanning email is your own responsibility. I don't scan for Linux or mainframe viruses, or iPaq scripts. Why should I scan for Windows viruses?

    Or am I missing something?

    • Re:AV for MacOSX: $59 -- Why? (Score:5, Interesting)

      by buckhead_buddy ( 186384 ) on Thursday June 08, 2006 @11:41AM (#15494940)
      Symantec AntiVirus products for Mac (in my experience) are incredibly popular among people moving from PC's to Macs: the so called "Switcher" market. It's really just a matter of having built a reputation on fear in one market and the user feeling naked without that product.

      Some argue that it's not bad to have a security infrastructure in-place, even if theres very little self-propagaiting malware out there. It makes one "ready" to deal with the inevitable threats when they are discovered. It makes one confident that they will be the first ones to recognize and recover from any future infection.

      That seems like a good idea until you realize that to install and remove malware means the software will need to operate with very high permissions. Installing programs like Clam or Symantec Antivirus are possibly giving hackers more potential ways to exploit your system than if you hadn't installed the anti-malware to begin with. I think there actually have been low-level, local security holes found based soleley on security software that the user has installed.

      On the Mac, I think there is more harm than good done right now with anti-virus products. It's almost like feeling you must hang that lucky pair of fuzzy dice in your new car because you think it helps you not have accidents, when in fact their interference in your driving might be what causes you to have one.

    • > Or am I missing something?

      You're thinking about practical and effective anti-virus measures. Think stupider.

      Some organizations have a high-level policy that says that all machines must have up-to-date anti-virus software, and until you can certify that this is the case, you can't use the corporate network, because your MAC address will not be on the router's whitelist.

      You can bribe the IT guys (probably more than $60), you can hack your MAC to an allowed one (possible MAC collision, lose your job if y

    • #include
      #include "OStest.h";

      main(){
      if((is_OSX() || is_Unixey()) && !has_slashdot_flames()){

      printf ("Scanning for viruses..........!");
      printf ("None found! Goodbye! \n");

      }else if(is_MS_OS())

      printf ("AHHH!!!!!! $@$*!@*&DU}{#$%3xfad\n");
      printf ("\n");
      printf ("You're screwed, sorry. \n");
      printf ("\n");
      printf ("caused an invalid page fault in \n");
      printf ("module ORA2.EXE at 0137:0044dba7.\n");
      printf ("Registers:\n");
      printf ("EAX=0258f108 CS=0137 EIP=0044dba7 EFL

  • What a stupid title (Score:2, Insightful)

    by guspasho ( 941623 )
    "Can the Malware Industry be Trusted?"

    Of course it can't! It's the friggin' malware industry! Their business plan centers around installing stuff on your PC that you don't want on there and didn't ask for, and abusing your PC without your permission for their own purposes. Why on God's green earth would someone like that be trusted?

  • Work on your public image (Score:5, Interesting)

    by gr8_phk ( 621180 ) on Thursday June 08, 2006 @11:15AM (#15494740)
    From TFA "The idiots in the press repeat the lie verbatim and the lie becomes real. What is the lie? That Unix/Linux is less secure than Windows. Granted, only the stupidest dolts in the universe -- and the trade press -- are going to buy that crap, but they put it out there anyway."

    idiots, dolts, crap. There is a lot of name calling in there. He sounds like a teenager complaining about her friends. I don't claim to be the most articulate person around, but this guy shouldn't be writing articles. People judge you by the words you use. I got so distracted by his name calling I had to post before finishing the article, and I'm wondering if I'll be able to reach the end or take his side given the tone.

    • Agreed. I read that far and stopped reading. Maybe I'm being overly harsh and judgemental, but I'm busy, and don't have time to waste on the sort of article that that gave me the impression this was going to be.

      Sure, it's an opinion piece, but name-calling isn't called for.
    • Hmm. I notice our IT guy at work claims that Windows is more secure than Linux or OSX. I also notice that he refuses to take my challenge to put freshly installed Windows, OSX and Linux machines on the open internet for 24 hours to see which of them get compromised. He's gone so far as to claim that OSX "Wouldn't even be a challenge for hackers." There'd probably be no work for the IT department if the company switched to OSX, so I suppose it's understandable that he takes that position. Sure does make him

  • In the news (Score:5, Funny)

    by 955301 ( 209856 ) on Thursday June 08, 2006 @11:16AM (#15494750) Journal
    - The malware industry cannot be trusted to report when things are improving or a better alternative to their bread and butter os exists.

    - Doctors poor at telling hypochondriac when there is nothing wrong with them.

    - Car companies not reliable source of information about bicycles and public transit.

    - Lawyers cannot be trusted to create legislation that doesn't criminalize everything.

    - Politicians appear to be lying or misleading to get elected.

    - Wolves unwilling to notify sheep in advance of attack.

    • Actually, doctors are notorious for telling people they are being hypochondriacs when they actually have medical problems. No skin off the doctors' noses, as they get paid anyway, and often they get more because a condition requires more treatment when caught later.

      Hrm....
  • This is my reason for liking Clam antivirus, an open source product and maintained by the public. The governments should sponsor such products with constant donations.
  • Malware publishers are motivated by the money they get from what they do. It's not about morals, it's not about good business, it's ONLY about money. Money is the most powerful motivator there is. If you wave enough cash in front of a group of people, no matter what they have to do, someone will take you up on your offer.

    There will always be takers. So by default we can say that the malware business will remain rotten to the core until it is not only made illegal, but also prossicuted ruthlessly until w
  • As long as there have been companies selling antivirus software, the rumor has been circulated that they were also developing new viruses to keep themselves in business. In reality, I think that there will always be plenty of "volunteers" to handle this aspect of the business for them.

  • Can the ****** industry be trusted? (Score:3, Insightful)

    by shodai ( 970706 ) on Thursday June 08, 2006 @11:34AM (#15494876)
    No.

  • Yes, Rotten To The Core (Score:3, Insightful)

    by aldheorte ( 162967 ) on Thursday June 08, 2006 @11:37AM (#15494896)
    Yes, the anti-virus industry is as rotten as it appears, if not more so. In talking to non-expert computer users who use anti-virus, anti-virus causes more problems than it solves. Anti-viral software with automatic updating is essentially like installing a rootkit on your computer controlled by the anti-virus vendor. With just a little bit of training, and perhaps a different email client than Outlook, as well as using Firefox instead of (or patching) IE, viruses and malware are easily avoided.

    Anyone who is serious about security doesn't run anti-virus because it does not fix the root issues of vulnerability.

    Thy key is that anti-virus can be sold on fear and, since the average computer user doesn't understand that there is nothing mystical about viruses and their vectors are easily identified, fear sells a product that actually makes your computer less secure and less usable. That said, there are some good free programs out there, like ClamAV and Spybot Search & Destroy to help you as a system administrator check out suspicious files or clean up a mess on a specific case by case basis (the latter only applying to Windows).
    • With just a little bit of training, and perhaps a different email client than Outlook, as well as using Firefox instead of (or patching) IE, viruses and malware are easily avoided.
      There's still open ports that should never be allowed to listen for instructions on a hostile network - you really need to put a MS Windows box under the adult supervision of a firewall - preferably an external one or a little firewall/router embedded system built into your network card.

  • Too pejorative (Score:5, Informative)

    by Himring ( 646324 ) on Thursday June 08, 2006 @11:38AM (#15494910) Homepage Journal
    Every year, US-Cert produces huge fireworks in the security trade press with their annual summary of misinformation about security flaws. The idiots in the press repeat the lie verbatim and the lie becomes real. What is the lie? That Unix/Linux is less secure than Windows. Granted, only the stupidest dolts in the universe -- and the trade press -- are going to buy that crap, but they put it out there anyway.

    I got to that point in the article and remembered the red ink on a paper I wrote in grad school, wherein the professor said, "too pejorative to be taken as an objective analysis of the topic."

    In all things academic or reporting, if you do not really have it, then at least fake objectivity....

  • Counterpoint (Score:2, Insightful)

    by sopwith ( 5659 )
    Whether or not the malware industry can be trusted, anyone who calls a company a "servile buffoon" probably can't be trusted to be a impartial and logical journalist.

    Things are never as extreme as they seem - there are good & bad guys (and in-between guys, and girls too! :) in both the anti-malware and journalism industries. I don't trust the Kaspersky Kooks at all, but McAffee and some of the other companies (e.g. PC Tools Software, F-Secure) do have some credibility in my book.

    Then too, we know that t

  • No! Stay vulnerable. Please. (Score:4, Insightful)

    by xkr ( 786629 ) on Thursday June 08, 2006 @11:43AM (#15494955)
    The anti-malware software industry is like the insurance industry. They want to provide their paying customers with benefit, but the last thing they ever want to do is encourage consumer behavior, law, or product changes that actually eliminate the problem, thus putting themselves out of business.

  • No, not really (Score:3, Insightful)

    by FishandChips ( 695645 ) on Thursday June 08, 2006 @11:43AM (#15494963) Journal
    Perhaps the question needs wider phrasing: can the IT industry - not just the malware side - be trusted? Personally I don't think so because they seem addicted to denying the consequences of their own actions or foisting the cost on the public. You can see this everywhere from the paltry, tokenish efforts to tackle malware and spam by corporations that regularly turn in billions in profits, to the Heath-Robinson-like, energy-guzzling design of the PC itself, to dumping clean up and recycling via shady deals with the Chinese. Let's not even look at moral issues like DRM and Hollywood or Chinese censors.

    OTOH, no industry can be trusted. If it wasn't for some tireless public-minded advocates the auto industry would probably have us still driving deathtraps with engines designed in the 1950s or the pharma industry, for example, would have us growing three heads while being charged 50 bucks for a paracetamol.
    • Perhaps the question needs wider phrasing: can the IT industry - not just the malware side - be trusted?

      Um, you're asking this of a bunch of people reading slashdot on company time...

  • Conspiracy? Maybe. Stupidity? Definitely. (Score:4, Insightful)

    by GregStevensLA ( 976873 ) * on Thursday June 08, 2006 @12:08PM (#15495167)

    Can the anti-malware industry be trusted? Can microsoft be trusted? Can the IT industry be trusted?

    One thing that all of this overlooks, is that it doesn't take malice for hysteria to spread.

    premise: people fear what they don't understand.
    premise: most people don't understand computers.

    I have a friend who fancied himself a home-taught computer expert. Armed with TweakXP, a few anti-virus tools, and a small handful of other gadgets, he was always offering to "optimize" and "fix" his friends' computers.

    And lo! and behold, every single computer that was ever brought to him had "a major virus" or "a serious trojan" problem on it. Of course, there is so much media hype about viruses (and people's bad browsing habits) that this was fairly believable. However, the mere consistency of his diagnoses started making me suspicious....

    Sure enough, after a few in-depth conversations, it turns out that he was using bad virus-detection software: some unknown little program that he assumed was "better than all the rest" because it "always found more" (it didn't occur to him that most of them were false positives); and moreover, it turns out he didn't even have a clear understanding of what a "virus" is.

    But let me tell you: he had a stream of people in and out of his apartment that were absolutely convinced that ANY time there was EVER a problem with their machine, it MUST have been because of a virus.

    • It's not malice that is spreading these beliefs, and I think that the original author is aware of that. Just how many times did he use the word 'idiots' in that article?

      But it's definitely arguable that malice (or at least extreme greed, to the point of not caring about the truth, security, safety or anything else but profit) is behind the *starting* of these rumours. Then the computer-ignorant masses believe and spread the beliefs, because, after all, the security experts said so!

  • Not since F-Secure "discovered" the Sony RootKit and decided "work with Sony" rather than remove that crap from my system have I trusted them. In fact, as a litmus test ANY anti-virus software that still doesn't immediately and completely remove all known Sony and other DRM infections is just shy of useless in my opinion. They clearly do not have my own user's interests at heart -- and we're the ones paying these jokers! Removing StarForce would be nice too!

    • Not since F-Secure "discovered" the Sony RootKit and decided "work with Sony" rather than remove that crap from my system have I trusted them.

      Unfortunately if they had made a public announcement about it we would probably only remember them as the brave former company that stood up to Sony and were finally and posthumously found to be correct all along - so they had to talk to Sony first in a long slow process. Commercial malware is only going to be dealt with properly by those who don't have anything to l

  • NO (Score:2)

    by ajs318 ( 655362 )
    Anti-virus, anti-spyware, anti-adware stuff ..... it's all closed-source payware. That alone just goes to show that the primary motivation for writing it is not to get the job done properly, but to milk people for money.

    Open Source software, which by definition is approaching perfection like 1-e**(-k*x) approaches unity, will never, ever be subject to malware. It's the very antithesis of everything the anti-malware industry is about.
  • Can I trust a man who breaks into my house, rapes my wife and kills my children? I dunno. Any takers?
  • Any time someone claims Windows is more secure than Linux, ask them this: If Windows is so secure, why are the AV companies pushing harder at the market for Windows AV products than for Linux?
  • Does the pharma industry exaggerate the bird flu threat?
    Does the car industry exaggerate the additional safety an extra airbag on every corner of the car provides?
    Does the low-carb food industry exaggerate the effect low-carb food has on your weight?
    Does the perfume industry exaggerate the amount of stink you produce if you don't sprinkle their 10-bucks-a-shot stuff under your arms?

    Can ANY industry be trusted that they don't blow the effect of their product (or the threat of "what if you don't buy it") out
  • The fatal flaw in the anti-virus / malware industry is that it exists primarily to fix a problem with Windows. Specifically, it's a bad idea to form a business around fixing a flaw in someone else's product, because as soon as the flaw is fixed, the business is killed overnight.

    I like to think of the example of Rusty Jones. In the northeast, road salt destroys cars. Back in the 70s and 80s, as soon as someone would buy a car, they would drive it to Rusty Jones and get their rustproofing service. As soo

  • That are just one company. If the entire industry is so bad, why then didn't the author have problems with the other anti malware companies?

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close