McAfee, Symantec Think Vista Unfair

davidwr writes "Is Microsoft unfairly locking anti-virus companies out of Vista? Symantec and McAfee seem to think so and they aren't being very quiet about it, placing a full-page ad in the Financial Times. If you've found the ad online, please post a link."

Comments

No love lost for both of them

[Nanite]

Personally, I wouldn't care if both Mcafee and Symantec went bankrupt tomorrow. Both feature bloated, buggy software, and symantec's sales pressure to 'Upgrade' to newer buggier software rather than renewal of the old software is just disgusting. Granted, I don't know if MS could do a better job, given their abysmal track record on security and virus prevention. They love to just leave the barndoor open for stuff like that. But they may be able to produce a spyware/virus solutions that works better within their systems, better than the monkeys at Mcafee and Symantec anyways.

Re:No, that's not correct

[Markusis]

I really hate this popular Slashdot myth that viruses only exist because OSes are designed improperly. No, wrong. ... There isn't an OS level defense for this short of an Orwellian trusted computing scheme. If I sent you a version of Apache with malicious code in it and you installed it as root, I could do whatever I wanted. Doesn't matter how secure your OS is, you gave it the permissions it needs.
</snip>

This is why SELinux and App Armor exist. With a proper SELinux or App Armor setup you could install Apache as root and all it will be allowed to do is what Apache does normally. So, it would only be allowed to read the /etc/httpd directory and the /var/www directory. It would only be able to write to the /var/log/httpd directory and listen on port 80 and 443. So, this could prevent an exploit in Apache from taking over the rest of your system.

Admittedly this example wouldn't help a desktop user. But, there is no reason why SELinux or App Armor couldn't help a desktop user. One example would be if Firefox was locked down to only allow downloads to the ~/Downloads directory or something like that. Now any hole in firefox would only be able to damage your ~/Downloads directory and presumably your firefox cache directory or something. It wouldn't be able to delete ~/Pictures and ~/Music. The browser example is kind of complicated because it has so many tasks these days. But, the point is that you can prevent a lot of problems by employing some kind of mandatory access control system.

Oh, and it really isn't that hard to use one of these systems either. Yeah, they can be pretty nasty if you really get into it (especially SELinux). But, for a desktop user there really isn't anything to worry about. I use Fedora Core 5 at work and at home and I've kept SELinux enabled on both systems. App Armor is really nice to use for the purposes of locking down a server system in this way. SELinux is more generic but it is much more complex than App Armor.