Slashdot Mirror

← Back to Stories (view on slashdot.org)

The Netscaping of Symantec and McAfee

Posted by ryuzaki0 on from the sounds-painful dept.

rs232 writes to mention a C|Net article about the uncertain future of the popular anti-virus software companies. "I mention Netscape because, if you believe Symantec and McAfee, a similar situation is about to unfold within the security industry. Microsoft, again recognizing late that it had failed to seize upon this thing called security, is now about to bundle its own security solutions within Windows Vista and further enforce new security policies that lock out some third-party security solutions altogether. Vendors Symantec and McAfee have looked into the future and realized that people may one day speak of them in the way that we now speak reverently of the early builds of Netscape."

105 of 385 comments (clear)

  1. This is NOT the same thing by Shados · · Score: 5, Insightful

    Netscape had a product, which filled in a need customers had: a web browser.

    Symantect and McCafe are only parasites, leeching from Microsoft's -mistakes-. It was unevitable that Microsoft would one day try to fix those mistakes, and unlike things like Office Suites, it is Microsoft's -responsability- to fix this mistake, and it is a feature that SHOULD be part of an operating system (aka: security, though Microsoft's implementation is debatable).

    Not only that, but McCafe's and Symantec's products are viruses of their own, doing unthinkable things to the operating system and screwing over their users: They are malwares. I, for one, HOPE these 2 companies die soon, or find a new business model.

    1. Re:This is NOT the same thing by Anonymous Coward · · Score: 5, Interesting

      not to mention that signature based antivirus is going to die, and companies who do av/as right (don't let unknown stuff run in the first place, instead of trying to clean up after the fact) are going to eat symantec/mcafee's lunch (bit9, etc.)

    2. Re:This is NOT the same thing by Salvance · · Score: 5, Insightful

      Parasites, yes. But would you rather have them as a parasite or Microsoft to build its own set of Parasitic software. Unfortunately, Microsoft still isn't fixing their O/S to create something as secure as Linux or Mac ... they're just following the same path that McAfee and Symantec have in the past. What's worse is that Microsoft now has an incentive (although an unethical one) to create holes for viruses - they could create insecure code, put the fix in their OneCare product, then exclaim to the world that their virus scanner is the only one that protects against the vulnerability.

      --
      Crack - Free with every butt and set of boobs
    3. Re:This is NOT the same thing by From+A+Far+Away+Land · · Score: 5, Insightful

      There is a big difference between Symantec and Netscape. Netscape was a program that was superior to IE, because you could Compose as well for free. Symantec will never be free, and in fact breaks about as many systems as it protects in my experience. McAfee is about as horrible as Symantec. The world could do with a few less AV vendors.

      --
      Oh You POS
    4. Re:This is NOT the same thing by Bemopolis · · Score: 5, Interesting

      Agreed. This is like abortion clinics complaining about lost revenue when condom manufacturers reduce their failure rate.

      And no, the fact that in this analogy the end-user is getting screwed either way is not lost on me.

      Bemopolis

      --
      "I guess the moral of the story is, don't paint your airship with rocket fuel." -- Addison Bain
    5. Re:This is NOT the same thing by kripkenstein · · Score: 4, Insightful

      Agreed: not the same thing. But for different reasons.

      As far as antivirus software goes, Microsoft are charging for OneCare, just like Symantec and McAfee, whereas in the web browser market, IE and Netscape were given away for free. That is a significant difference. When people pay for something, they need to make a choice; just using the free web browser already installed on their computer isn't a choice, it's a default that people barely notice. Now, when people must make a conscious choice, it is harder to win them over. So, in this respect Symantec and McAfee seem safe. However, they will, at the minimum, need to share the market with Microsoft. And there is always the chance of Office repeating itself - a paying product in which Microsoft won a monopoly. Really, Wordperfect is the example we should have before our eyes, not Netscape, as far as antivirus software goes.

      As for antispyware, Defender is given away for free. This is exactly like Netscape, and I expect the antispyware market to die out, except for antispyware that lives as part of a bundle with an antivirus, which is not free.

    6. Re:This is NOT the same thing by miffo.swe · · Score: 2, Insightful

      Microsoft bundling their own antivirus/antispyware is not fixing any mistake. The error lies in the security errors made by Microsoft and can only be fixed by eradicating those said errors. Antivirus does not in any way highten security in windows. All it does is mitigate the more commonly used viruses that has already struck enough people. Anybody making a directed attack against someone just flies through any antivirus. As long as the vulnerability used by the virus is still in there the problem exists and is a serious security threat. Antivirus should not be part of the OS in any way or form. The reason the antivirus inustry exists is that its pretty hard for Symantec, Mcaffe etc to patch holes/correct bad design choices in Windows. They have to sell antivirus to mitigate errors but im damn shure that if they could they would rather fix the holes used by the viruses. There is a reason that nobody in the linux camp is that thrilled about implementing anvtivirus functions. Its the wrong way to solve the problem of bad code, bad choices and contempt of security. I would have no problem if Symantec and the whole security industry vanished because microsoft suddenly made better products. The problem is they just skip the "more secure products" part and just swallows a band aid solution that dont really fix any of the inherent security problems in Windows.

      --
      HTTP/1.1 400
    7. Re:This is NOT the same thing by ClickOnThis · · Score: 2, Insightful

      Netscape had a product, which filled in a need customers had: a web browser.

      Symantect       [sic] and McCafe [sic] are only parasites, leeching from Microsoft's -mistakes-.

      No matter what you think of them as companies, Symantec and McAfee were indeed fulfilling a need that Microsoft was ignoring.

      It was unevitable [sic] that Microsoft would one day try to fix those mistakes, and unlike things like Office Suites, it is Microsoft's -responsability- [sic] to fix this mistake, and it is a feature that SHOULD be part of an operating system (aka: security, though Microsoft's implementation is debatable).

      So ... you're saying it is not Microsoft's responsibility to fix mistakes in Office? Or that they just do it as a favor?

      Also, you're missing the point. This is not like the Netscape vs MSIE war, where Microsoft simply relied on obscurities in their API, "home turf" advantage, and the "three E's" strategy for breaking standards. In Vista, Microsoft is actually trying to shut out third-party security products. Do you trust Microsoft to be your only source for security products? Should anyone??

      Not only that, but McCafe's [sic] and Symantec's products are viruses of their own, doing unthinkable things to the operating system and screwing over their users: They are malwares. I, for one, HOPE these 2 companies die soon, or find a new business model.

      Uh huh. Please explain what these "unthinkable things" are, and how they "screw over" their users. Let's not have any unsubstantiated and polarized name-calling.

      --
      If it weren't for deadlines, nothing would be late.
    8. Re:This is NOT the same thing by Cherita+Chen · · Score: 5, Insightful
      What's worse is that Microsoft now has an incentive (although an unethical one) to create holes for viruses - they could create insecure code, put the fix in their OneCare product, then exclaim to the world that their virus scanner is the only one that protects against the vulnerability.

      Ok, everyone... Let's put on our tin-foil hats now. Seriously, that's probably one of the silliest things I've heard (since listening to coast to coast AM w/Art bell).

      Unethical things such as what you are describing are not common business practices, especially when you are talking about a multi-billion dollar software company. Perhaps you small start-up my do some stupid crap like that, but when you are talking about a corporation that employs tens of thousands of employees, it becomes more and more difficult to cover up garbage like you are describing. It would literally be the case of "Killing the goose that lays golden eggs" - for supper.

      --
      I'm not fat, just big boned...
    9. Re:This is NOT the same thing by ctr2sprt · · Score: 5, Insightful
      But would you rather have them as a parasite or Microsoft to build its own set of Parasitic software.

      I don't think it makes business sense for them to use AV as a long-term patch. It takes a lot of time and energy to keep AV signatures up-to-date, which means it costs money. If MS intends to give away or sell below cost its AV software - which it would almost have to do in order to drive McAfee et al. out of business - they could be losing a whole lot of money. And of course, if MS eventually slacks off (as they did with IE) or starts charging big bucks for new signatures, competition will spring back up. Symantec, for example, is a fairly diversified company: I don't see them going broke even if NAV never sells another copy. (They own Veritas now, remember.)

      The best use of AV software for MS is as a short-term patch until they can release a real one. Say a zero-day exploit of Outlook is discovered. A new signature can be rolled out in a few days to their AV client, giving them a little breathing room to develop a patch for Outlook and test it to make sure it doesn't break anything else. This way, MS would only have to target the very latest or most serious malware. I expect that would make maintenance of an AV system much easier and cheaper.

      Of course, it may not happen that way. This is MS we're talking about. They might be doing this just because it offends their sensibilities to see someone else making money.

    10. Re:This is NOT the same thing by Instine · · Score: 2, Informative

      I think the fact the parent hasn't been marked troll or flamabait, when similar coments about M$ even usually would, says a great deal about these two products (I know each has more than one product... ). They are awful. They alter the way your browser interacts with the web in ways that DO NOT improve security but DO hinder your browseing, AND WITHOUT ASKING YOU!!! Sorry for the caps, but really, they're bad. Yet they make so much cash.
      We're supposed to feel sorry for them? Urm... no. They will not be missed. And whats their argument? They can't hack Vista, like they used to hack XP? In which case there's nothing for them to do - right?

      --
      Because you can - or because you should?
    11. Re:This is NOT the same thing by Tim+C · · Score: 5, Insightful

      Netscape was a program that was superior to IE, because you could Compose as well for free.

      Disclaimer: Since moving over to a Windows PC, I have only ever used Netscape, then Mozilla, then FF as my main browser. I have never and probably will never use IE.

      That said, Netscape 3 was better than IE 3. Netscape 4 was better than IE 3. Netscape 4 was worse than IE4, and wasn't even in the same league as IE 5. NN4 was slow, bloated, and crashed at the drop of a hat. IE4 was faster and much more stable, and IE 5 was better again. There were browser torture tests released during Mozilla development that IE 5 had no trouble with that utterly choked Netscape. Hell, you couldn't even resize Netscape's window without it having to re-request the page from the server!

      Don't get me wrong, I used NN4 right up until around about the time that Mozilla M8 or M9 was released, but to say that NN was superior to IE because of Composer is one hell of a stretch, given that Navigator was barely usable.

      --
      It's official. Most of you are morons.
    12. Re:This is NOT the same thing by Anonymous Coward · · Score: 2, Insightful

      Unethical things such as what you are describing are not common business practices, especially when you are talking about a multi-billion dollar software company.

      It's also true that a multi-billion dollar energy company would never create a fictitious energy crisis purely to boost the earnings of a small number of their shareholders...

    13. Re:This is NOT the same thing by WhodoVoodoo · · Score: 5, Interesting

      No, however it may suddenly be much less of a priority to the QA managers to ensure that releases are secure, because any flaw may then bolster a revenue stream for Microsoft. And anyhow if they don't catch it in time they could just push a stopgap to their own AV suite which everybody has by default based on their intimate, insider knowledge of their own territory.

      My tinfoil hat might be a bit tight, but this does stink a bit. At the very least, what's going on is questionable.

    14. Re:This is NOT the same thing by Keeper · · Score: 2, Insightful

      They weren't exactly able to keep it secret though, were they?

      Seriously, when was the last time Microsoft made a product announcement that wasn't leaked weeks ahead of time?

    15. Re:This is NOT the same thing by AdamKG · · Score: 5, Funny

      And, in this analogy, Linux users are still immune!

      --
      groupthink: It's good for self-esteem.
    16. Re:This is NOT the same thing by hackerm · · Score: 3, Insightful

      Isn't the whole point of Microsofts new "security initiative" that things like a zero-day exploit of Outlook wouldn't even be possible? I mean, they're not going to implement the same type of anti-virus softwares/mechanisms that exist today, I would expect them to at least try to attach the problem at its roots so that that kind of software wouldn't be necessary in the first place.

    17. Re:This is NOT the same thing by aiken_d · · Score: 3, Insightful

      I can't speak for the guy you're responding to, but my read was that he was saying that MS has no obligation to *produce* office; that it's a new line of business. But fixing the fundamental security problems in Windows is indeed part of MS's responsibility to its customers, and anti-virus companies who complain about it are being disingenuous. If the words I've put in his mouth are accurate, I totally agree with him.

      And you clearly have no experience working with Symantec or McAfee anti-virus products. They *do* unspeakable things to the OS, like hooking all sorts of the OS that they have no business touching (the IP stack, for instance). They also don't uninstall cleanly, so once someone reaslizes how screwed up their computer is after using the crappy products, only a total reinstall can get things back to normal.

      Both Symantec and McAfee seem to engage in the "perception of security by constant annoyance" school of thought (much like TSA). Other anti-virus vendors (Trend Micro, NOD32, etc) manage to work just as well without making the OS unstable and generally annoying to use. The sooner Microsoft fixes the underlying problems and gets those incompetents out of the security space, the better it will be for consumers and product-driven (rather than marketing-driven) security companies.

      -b

      --
      If I wanted a sig I would have filled in that stupid box.
    18. Re:This is NOT the same thing by a_n_d_e_r_s · · Score: 3, Insightful

      Netscape Navigator wasn't being given away for free - it was sold.

      But Microsoft gave away its browser for free - to steal market share. That stopped that market to developed and Netscape could no longer sell its browser and forced Netscape to give Navigator away for free.

      So yes its basically the same thing with Microsoft killing another market by its dominating force.

      --
      Just saying it like it are.
    19. Re:This is NOT the same thing by Shadow99_1 · · Score: 4, Insightful

      Actually when you think about it, this is nearly the perfect way for MS to get people to pay monthly for running windows... Oh sure, not everyone will use it, but it's a start for them... That has been a goal of theirs for a very long time now, but they couldn't come up with a good method to do it. This is perfect for them.

      Combine that with patching the OS like you mentioned and it make them look like they are taking security seriously, while recieving yet more cash from customers... It's a great scheme for MS. The elimination (if you actually beleive it will 'eliminate' anyone) of Symantec and McAfee would be a nice side benefit. Of course the reality is neither copy should worry about replacing MS's built-in controls, since it will have next to zero impact... But they know perfectly well they can use this to hurt MS and make them look poor and defenseless compared to the jugernaught MS represents... So they'll wring this oppurtinty for everything it's worth...

      --
      we are all invisible unless we choose otherwise
    20. Re:This is NOT the same thing by Jah-Wren+Ryel · · Score: 2, Insightful

      [sic]

      Do you understand the reason people insert the latin word "sic" when they include quotations?

      I'll give you a hint, it does not mean "spelled incorrectly."

      The use of "sic" is indication to the reader that all though the quotation looks funny, it really was originally written thus. On slashdot, when all you are doing is quoting the damn post you are responding to, there is no question of the accuracy of the quote, anyone can click on "parent" and read the original themselves.

      When you use it the way you have, all you do is call attention to yourself as a pseudo-intellectual spelling nazi. So quit waving your e-penis around and put it back in your pants, it isn't anything to be proud of in the first place.

      --
      When information is power, privacy is freedom.
    21. Re:This is NOT the same thing by walt-sjc · · Score: 4, Informative

      An example of the "unspeakable things" is outbound email scanning, where they add a proxy layer on smtp transactions. Only one big problem: this breaks authenticated SMTP. The only fix is to disable it. Inbound scanning is even more pathetic, only supporting VERY few email clients, such as Outhouse and Outhouse Express due to the implementation.

    22. Re:This is NOT the same thing by WindBourne · · Score: 3, Insightful
      Unfortunately, Microsoft still isn't fixing their O/S to create something as secure as Linux or Mac

      That is actually a good thing. Keep in mind that no general malware author targets anythign BUT windows due to the ease of doing so. If Windows ever becomes more secure than Linux/Mac/*nix/Mainframes/etc., then the malware will target everything BUT windows.

      --
      I prefer the "u" in honour as it seems to be missing these days.
    23. Re:This is NOT the same thing by hackerm · · Score: 2, Interesting

      Yes, but I think they they will get it in the end. Look what happened when they realized that they needed an Internet strategy. No matter what you think about their methods, they succeeded in the end. Hopefully they will repeat that success story now.

    24. Re:This is NOT the same thing by SCHecklerX · · Score: 4, Insightful

      Not really. There have always been good offerings, and even best practices, that are not signature based. But the general populace doesn't see the value in them b/c they can't be that great if they never have an update against the 'trick the stupid user' du jour!

      As the head of a security company I used to work for used to say: "People would rather take an aspirin for their headache than avoid what gives them that headache in the first place"

    25. Re:This is NOT the same thing by WhatAmIDoingHere · · Score: 2, Insightful

      hold on hold on..

      McAfee's software crashed your XP install, and you had to buy a new HARD DRIVE?!

      How does an OS install getting fucked up mean you need to buy new hardware? And how the HELL is the power supply failing the fault of SOFTWARE?!

      --
      Not a Twitter sockpuppet... but I wish I was.
    26. Re:This is NOT the same thing by Clover_Kicker · · Score: 4, Insightful
      If MS intends to give away or sell below cost its AV software - which it would almost have to do in order to drive McAfee et al. out of business - they could be losing a whole lot of money.

      How much have they spent propping up XBOX and MSN?

      Microsoft isn't afraid to burn a few hundred million bucks if they want to keep a player in a given marketplace.
    27. Re:This is NOT the same thing by dabraun · · Score: 2, Interesting

      Microsoft is not following the path that McAfee and Symantec have followed. There is no antivirus software built into windows - the whole discussion that "Microsoft is trying to kill A/V venders" seems completely misguided. Yes, they are trying to make the OS more secure, you might argue that they are trying to kill anti-spyware products (since they *are* including this in the OS) but A/V? I don't get how this is 'the next netscape' when there is no A/V software bundled, or even strongly tied - to Vista.

      Never mind that Netscape pretty much killed themselves with the abomination that was Communicator. I was a netscape-only user until the disparity in quality between IE4 and Communicator appeared and was so blatant that I couldn't see continuing to use Netscape. IE4's betas were more stable than Communicator's RTM product - I was a die-hard microsoft hater at that time and still this was clear. Of course, we paid for the fact that IE4 sacrificed security in favor of features, performance, etc. in the long run (i.e. they implemented cool features with little regard for the long-term consequences.)

    28. Re:This is NOT the same thing by cheater512 · · Score: 3, Informative

      But *nix IS more popular - just not in the home.

      If a botnet creator could break in to Linux servers he most certainly would.
      Millions of high powered servers with big fat net connections. The net would tremble in fear.

      Instead they are forced to infect crappy home computers.

    29. Re:This is NOT the same thing by sago007 · · Score: 2, Insightful

      I got into the Internet thing very late and started using IE3 and later IE4 before changing to Netscape 4. I believe that Netscape 4 was a better browser than Internet Explorer 4.0 it was more stable (especially then running Java).

      Then IE 5.0 came and I started using it. It was just so much better than IE4 and N4...

      Then Netscape 6.0 came and it was a piece of crap it crashed 3 times as often as IE. It is weird but my reason for using Netscape 6.0 in that period was in fact a stability question... Then IE crashed it took most of Windows 98 down as well. It didn't happened then Netscape crashed. I have preferred programs separated from the System core ever since.

      Then I changed to Windows 2000 I started using IE again since stability was no longer an issue.

      Later switched back to Netscape to use pop-up blockers and tabs (amazing back then)

      Never went back to IE since (and most likely wont as I am not running Windows anymore)

      A little on the main topic:
      I don't think Symantic and McAfee should be the only ones worrying. I think Microsoft will go for Adobe next. If MS can dominate with a flash-like program, a photoshop like program and a acrobat like program they can effectively stop anyone from switching from windows ever again!

    30. Re:This is NOT the same thing by arminw · · Score: 3, Interesting

      .....The best use of AV software for MS is as a short-term patch.....

      The best use of an A/V patch would be not to need one in the first place. There is no need for such crap on Mac OSX. How many Mac owners run special anti-virus software? How about Linux users? Why can't MS make their OS at least as secure as OSX? Maybe they don't want to? Security should be built in, not added on by third party software. By reducing the number of services needed by most users and limiting their system access, Apple makes their OSX a much more difficult target in the first place.

      --
      All theory is gray
    31. Re:This is NOT the same thing by Deathlizard · · Score: 4, Interesting

      Netscape was practically Free. it's licencing allowed just about anyone outside of governments free use of the Browser. In fact, The only Netscape browser I can remember that had a Nag screen was 2.01, and Microsoft at one time was selling IE in stores the same way Netscape was.

      Even under this situation, MS didn't start really gaining share until late IE4 Early IE5, and code quality was the reason Netscape started slipping market share. Not Win98 or Free browsers like Netscape would like you to believe. By that logic, Linux with Apache is just as guilty with doing Netscape in as Microsoft with IE, Since most of Netscape's money was made on Netscape's Web server software and not their browsers.

      Navigator was absolute junk by the time Netscape was done with it. They kept claiming that MS was purposely denying access to windows so they couldn't code it better, well then explain why the Sun terminal I used to use at school had the same Netscape "crash after 1 hour use" bug that windows had, In fact, when they created mozilla.org and open sourced the thing, the first thing the Dev's for mozilla.org did was chuck the code and started from scratch.

      Netscape could have saved their product, they could have diversified into other markets, they could have recoded it to work better, they could have did a ton of things, but in the end while Opera with their pay browser was still keeping their business going, Netscape decided that suing MS was the easier of all the other options. pure and simple.

      Simply put, Microsoft did not Kill off Netscape. Netscape killed off Netscape.

      --
      In Soviet Russia, Trojan exploits YOU!
    32. Re:This is NOT the same thing by Shawn+is+an+Asshole · · Score: 2, Informative

      I've had co-workers bring me their computers, along with a new hard drive claiming that it "crashed" and thought they needed a new hard drive. The problem turns out to be a severe spyware/virus infestation causing it to not even boot, but the hard drive itself was fine (no bad blocks).

      --
      "It ain't a war against drugs.it's a war against personal freedom" --Bill Hicks
    33. Re:This is NOT the same thing by Compholio · · Score: 2, Funny
      And, in this analogy, Linux users are still immune!
      So what are we then? eunuchs? Thats's no fun...
    34. Re:This is NOT the same thing by CastrTroy · · Score: 2, Interesting

      It doesn't make business sense for MS to release buggy software either. It would be a lot easier if they just released software with fewer bugs. People would be happier, and they wouldn't have to spen so much time fixing it. It's always less work to design something right the first time, then to try to fix it later, after it's been released. Just because it seems like it makes better business sense, doesn't mean MS is going to follow that path. I think that MS should do what Apple did, and drop their old OS, to get rid of all the legacy crap that's holding them back, but that doesn't mean they'll do it.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    35. Re:This is NOT the same thing by Andrew+Kismet · · Score: 2, Funny

      Eunuchs, unix, close enough...

    36. Re:This is NOT the same thing by lgw · · Score: 2, Interesting

      All the big major AV products moved away from reliance on virus signatures some time ago (though though checking for signatures never hurts). Running suspect code in a virtual sandbox to see whether it will decrypt a hidden payload and launch an attack is the new arms race.

      --
      Socialism: a lie told by totalitarians and believed by fools.
    37. Re:This is NOT the same thing by drsmithy · · Score: 2, Insightful

      If a botnet creator could break in to Linux servers he most certainly would.
      Millions of high powered servers with big fat net connections. The net would tremble in fear.

      Most of which would be detected and repaired in a matter of hours (if not minutes).

      "High powered servers with big fat net connections" are incredibly poor targets for people trying to create botnets, which is why they aren't targeted for them.

    38. Re:This is NOT the same thing by Anonymous Coward · · Score: 2, Funny

      The use of "sic" is indication to the reader that all though [sic] the quotation looks funny, it really was originally written thus.

      Heh.

    39. Re:This is NOT the same thing by malcomvetter · · Score: 2, Insightful

      I'm convinced that the days are numbered on all of these signature-based anti-virus applications. It's what Marcus Ranum refers to as "Enumerating Badness". There is nearly infinitely more malicious code than trustworthy code. Why bother trying to discover them all?

      And by definition, signature-based AV requires at least one customer organization getting infected before the signatures can be distributed to customers. How many customers will be dumped on before they wake up and realize that taking an inventory of all legitimate applications and technically enforcing a policy that allows only those to run is a much more effective approach at maintaining an infrastructure? Signature-based AV is the easy-chair of the Windows Admins.

      If you really want to know what value AV vendors have added to the IT world it's that IT organizations have effectively "outsourced" the inventory functions of identifying good vs. bad software. Whether Microsoft wipes them off the face of the planet or not, it's really irrelevant: very soon organizations will inventory their legitimate code and implement a "Default Deny" policy where no code can execute except what is explicitly allowed, instead of vice versa. Why will they? Because the Finance guys will finally figure out how it works. Signature-based AV = Lazy Admins. Smart CFOs will drive the end of Symantec and McAfee (or the diversification of their product line).

      Microsoft already has a tool that could (with tweaking and better deployment tools) one day put all the AV vendors out of business, if this new SDL delivers as expected (Vista will of course be the first OS under the new SDL) and the number of privileged-service exploits is reduced.


      The real topic of interest here in this thread is that slashdot readers/critics like to knock Microsoft whether they they are susceptible to malware OR whether they are making efforts to eradicate it. Funny how the critics don't complain about how Symantec and McAfee have been bumped out of the Mac OSX AV business ...


      -Tim

    40. Re:This is NOT the same thing by mabhatter654 · · Score: 2, Insightful
      Ha, you gotta be kidding, a company really focused on the customer's opinion would not enter a market with such a conflict of interest in the first place. See, MS owning any Antivirus is a conflict of interest with their own partner ISVs as well as that business has a conflict with producing good security from the start.

      It's kind of like an Accounting Auditing firm that also sells consulting services to the same clients to reduce taxes or improve investments... while sending a different team of auditors to verify the results are 'legal'... we had that scam too!

    41. Re:This is NOT the same thing by smasm · · Score: 2, Funny

      MS literally has a golden-egg laying goose? So that's where all their money comes from...

    42. Re:This is NOT the same thing by drsmithy · · Score: 3, Insightful

      If the virus spread itsself (which by definition it must) then it wouldnt matter at all if it was removed within hours. It only takes 30 seconds to wipe a website off the net for hours with that amount of cpu and bandwidth.

      You're missing the point. A botnet that can't be relied on to be working for more than a day or two before falling apart is worthless. Thus, botnet farmers target home Windows machines, where problems are rarely noted *at all*, let alone promptly chased down and fixed.

      Managed server machines are incredibly poor environments for the types of malicious code that typically infest desktop PCs. They (relatively) are too well configured and too closely watched.

    43. Re:This is NOT the same thing by yuna49 · · Score: 2, Interesting

      You mean like, for instance, this bug: http://security.itworld.com/4352/020620apache/pfin dex.html

      My Apache server was hacked via this (or some similar) exploit. The attacker installed an IRC bot in /tmp. I didn't notice it for a while until I saw some suspicious entries in my logs. Of course, since Apache runs chrooted as an unprivileged user, there wasn't much else the attacker could do.

      For now I solved the problem by creating a group with write privileges to /tmp that excludes the Apache user. Next time around I'll just give /tmp a separate partition with noexec enabled.

    44. Re:This is NOT the same thing by HiThere · · Score: 2, Insightful

      Considering that people use a signature based antivirus in their biological systems...I'd like some evidence that "signature based antivirus is going to die" rather than just an assertion. It seems quite improbable.

      Now if you'd said that signature based antivirus is going to need to change significantly, then I'd be agreeing with you.

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    45. Re:This is NOT the same thing by arminw · · Score: 3, Insightful

      .....The reason apple has less virus problems is because the marketshare isn't there for people to bother. If OS X or linux ever took say 25% marketshare,.........

      The marketshare argument is bogus. Apache server has a a larger marketshare than MS Information server and has fewer security problems. Historically, the largest numbers of computers have been in the business world. MS basically rode in on the coattails of IBM and managed to stay there. Now, with the Internet, the number of computers owned by consumers is steadily increasing. Of that number, Apple is getting an increasing share. I have never seen any market breakdown on systems only sold to consumers by brand.

      Neither Apple not MS had a multi-user system since the computers they were run on were PERSONAL computers, which by definition were and still are essentially single user machines. Apple abandoned their single user OS heritage and, as you wrote, bought a UNIX flavor system that was conceived from the ground up as a multiuser computer with a basic security foundation upon which to build. MS Windows is STILL a single user system at heart, with various attempts at security bolted on afterwards. VISTA is not going to change that, because if it did, EVERY single PC program in existence would no longer run under it. Unlike Apple, MS could not, has not and will not abandon essentially their entire application base, especially in the corporate market. Apple's emphasis on the consumer segment, as well as the fact that they build their own hardware gives them a much larger latitude to radically change their application compatibility structure. The processor switch to INTEL, for example, it means that not even ONE OS9 program or earlier will run on their current crop of machines. There are too many legacy programs in much of the enterprise establishment that are still in daily use. MS cannot afford to break them all overnight and therefore cannot ever provide the kind of security that Apple and Linux can bring to the table. In view of their difficulty, MS is doing remarkably well and will likely be the cornerstone of computing, at least in the enterprise, for a long time.

      --
      All theory is gray
  2. What? by Anonymous Coward · · Score: 4, Insightful

    Who speaks reverently of the early builds of Netscape? 2 and 3 weren't awful, but they weren't great either. And I think we all remember the abortion that was 4.

  3. Speak reverently of Symantec? by xs650 · · Score: 4, Funny

    "Vendors Symantec and McAfee have looked into the future and realized that people may one day speak of them in the way that we now speak reverently of the early builds of Netscape."

    Speak reverently of Symantec...... Bwahahahahaha

    1. Re:Speak reverently of Symantec? by chill · · Score: 3, Interesting

      No kidding.

      Norton, maybe. Norton Commander and Norton Tools were excellent, but once Symantec absorbed Peter Norton & Co., it was a quick downhill ride from there.

      --
      Learning HOW to think is more important than learning WHAT to think.
  4. So what? by garcia · · Score: 4, Insightful

    McAfee and Symantec exist because of problems that exist in the Windows code. They are concerned b/c Microsoft is releasing its own "security" software, which I agree with to a point, but they are also pissed off because MSFT is locking them out of the kernel (as they have been since x64's XP).

    So b/c MSFT is actually doing some stuff to try and protect themselves from outside code (in addition to outside vendors) we're supposed to feel sorry for these people? Either revamp your products and find different stuff to fix or move along.

    That or stop whining about MSFT locking you out of the kernel and concentrate on them selling software that "fixes" problems in their own buggy OS.

    1. Re:So what? by Chabil+Ha' · · Score: 3, Insightful

      That's what you get for being a one trick pony. Eventually competitors move in to dilute market share or you run into an antiquation problem where your product is obsolete/useless. While some may bitch that this is another way of Microsoft consolidating their monopoly power, this change has been a long time coming. What else does McAffee do? Symantec has many different types of tools like backup software and disk repair utilities, but what else?

      Take a look at Creative. At one point the realized that the Sound Blaster brand was not going to get them very far once generic sound cards found their way into every PC that gets manufactured. What did they do? Well, they gave graphics cards a try. I remember back in the 90s when you could get a Voodoo2 chipset from them. Now? They were one of the first to enter the MP3 player markets and continue to have *some* success despite Apple dominating that arena.

      Get a life McAffee and Symantec, your days of being a market bottom feeder are coming to an end.

      --
      We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
  5. Death of Symantec et al a Good Thing by smack.addict · · Score: 3, Insightful

    The so-called security vendors are best off when there is a proliferation of viruses and people are scared to death of the Internet. Their business model disappears if the Internet actually becomes a secure platform.

    Microsoft wants to see the number of exploits impacting its operating system disappear to zero. Only if they are successful will they kill the security vendors. And if not, the security vendors will prosper.

  6. Netscape netscaped itself by krell · · Score: 4, Insightful

    I stopped using Netscape as their "new and improved" releases became huge, very slow bloated with unneeded features that don't even belong in a browser (email? Use an email client!) and crashed all the time. (It took the Mozilla guys to do for free what Netscape engineers were paid to do and failed to do: make a nice version of that browser). McAfee, etc should not have to worry about this as long as they improve their products instead of turn them into unusable monsters.

    --
    Where were you when the voynix came?
    1. Re:Netscape netscaped itself by C0vardeAn0nim0 · · Score: 4, Informative

      there are many paid engineers working for mozilla foundation, and before that, AOL kept a bunch of people on the payroll working on mozilla/netscape.

      what changed was not the salary status of the developers, but the managment style guiding the devolopment.

      --
      What ? Me, worry ?
  7. Haven't we seen this before... by __aaclcg7560 · · Score: 3, Interesting

    Vendors Symantec and McAfee have looked into the future and realized that people may one day speak of them in the way that we now speak reverently of the early builds of Netscape.

    I don't see a problem with that since I don't use either product and wouldn't mind seeing these two outfits go into the software oblivion. Microsoft will get lazy about updating the features on its security software and open source will come to the rescue with something better. It'll be IE vs. Firefox all over again. Ultimately, the consumer will still win out.

  8. No. No, we won't. by Southpaw018 · · Score: 4, Informative

    Symantec's and McAffee's respective antivirus products are some of the buggiest software I've ever seen. The latest versions of both are awful memory hogs with questionable reliability and average detection rates. McAffee installs are widely known to 'go bad', resulting in cryptic error messages, failed updates, and vulnerable systems. There are threads upon threads in the Dell forums of users trying to ununstall McAffee off a brand new computer and failing.

    As for Symantec, , I had a computer at work with a copy of Symantec Corporate AV 10.1 (the latest version) still installed after we chose to migrate away from it due to ever rising costs and poor support. I tried to uninstall it. The uninstaller crashed. Then, every time I tried to right click, it tried to reinstall itself. Yes, you read that right - Symantec's antivirus installs a handler that traps every right click within Explorer that runs a check to see if files are missing. After two hours on the phone with a Symantec rep who didn't know what they were talking about, I finally had it cleaned off the system.

    What I'm trying to say, I suppose, is that the original Netscape, while not perfect software, had the right vision behind it. Symantec and McAffee don't. Both companies have gone downhill, and I'm absolutely sure it's for reasons completely unrelated to Vista's new kernel.

    --
    ACs are modded -6. I don't read you, I don't mod you, I don't see you. Don't like it? Don't be a coward.
  9. First of all by mpapet · · Score: 2

    As a sysadmin supporting the usual symantec products, reverently is never a term I would use to speak of their products.

    Second, Symantec and others are doomed partially because of their products.

    Finally, they are doomed anyway because it fulfills so many objectives at Microsoft. The potential for revenue is too great to turn away and the only path to desktop revenue growth for the OS is to tighten the DRM noose until it is the equivalent of your cable/satellite set top box. Any other path is too risky/difficult.

    --
    http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
    1. Re:First of all by westlake · · Score: 3, Insightful
      the only path to desktop revenue growth for the OS is to tighten the DRM noose until it is the equivalent of your cable/satellite set top box. Any other path is too risky/difficult.

      There is no consumer market for an OS distribution that doesn't support DRM'd media play out of the box.

      Apple understands this. Microsoft understands this. Linspire -- which has a modest presence in big box retail -- understands this.

      The only one with his head still stuck in the sand is the Geek.

  10. Market forces will speak clearly by Chairboy · · Score: 4, Insightful

    It's fashionable to bash Symantec and McAfee and make ridiculous comparisons between them and viruses, but they're just companies meeting a demand for specific software. They are no more leaching off of microsoft than car-washes 'leech' off the auto-industry.

    The OS is changing, and the nature of threats are changing. These companies started by writing software to protect against disk-to-disk threats, then file infectors, then worms, and so on. Each has changed their business model as the needs of the market have changed, and I'd be hesitant to casually write them off just yet.

    The market will decide things in the end. Either the companies change and continue to meet customer demand, or they won't, and they'll fade away. My money is on smart people staying fresh and changing based on their past history.

    The alternative is to essentially say "Netcraft confirms that security software companies are dead!", with just as much legitamacy.

  11. Microsoft shooting itself in the foot by Salvance · · Score: 2, Insightful

    If Microsoft were to succeed in shutting out security vendors (which I don't think they really want), they'd be digging their own grave. Many of Microsoft's security problems now stem from their dominance in the browser market - had Netscape won the browser wars, Microsoft would likely not be vilified to the extent it is today since security would not be as big of an issue.

    The one thing that has made Microsoft's products at least somewhat secure are the third party security products. If Microsoft shut out these security products, it is unlikely they could provide the same level of security that users expect from their O/S's. Take away McAfee, Norton, and the other security vendors and Microsoft's profit and revenues would be impressive until users became tired of the constant security breaches and holes.

    If Microsoft moves forward with shutting out 3rd party security companies, Linux vendors and Apple will be the big winners, not Microsoft

    --
    Crack - Free with every butt and set of boobs
  12. What is Microsoft's alternative? by maynard · · Score: 2, Insightful

    The market for anti-virus software is a response to poor software design. So Microsoft claim they will fix it, and in the process are bundling tools similar to their competitors'. But the ultimate solution will will require not a reactive solution - which is why anti-virus software does - but a proactive solution, similar to just about every other professional OS. That is, pervasive use of filesystem ACLs, low privilege user accounts, etc etc etc. That is, enough security such that if a virus does run - it wouldn't do much damage.

    Wouldn't a Windows system with proper security be just as damaging to these anti-virus makers as Microsoft bundling anti-virus software? And isn't the OS maker the proper responsible party for system security?

    I'd say a comparison with Netscape is a bit off.

  13. The writing was on the wall... by bogaboga · · Score: 3, Interesting
    These security companies should have seen this. I mean...the writing was on the wall.

    Next victim? Adobe: with its PDF and Flash.

    Open sourcing these products, and creating decent interfaces for their PDF reader are the only feasible things [for Adobe] to do in my opinion. QT would be better than using GTK. You might wonder why: I cannot type or paste a link in the file selector dialogue of Adobe's PDF reader, in this day and age!! Think of it.

    1. Re:The writing was on the wall... by 16K+Ram+Pack · · Score: 3, Insightful
      The formats of both are already fully documented.

      I've done document generation for companies. PDF is extremely flexible, gives guaranteed layout and because it's open, you aren't using tools that have reverse engineered the format. You know the files are going to be readable. There are huge numbers of 3rd party tools for generating and processing PDFs.

      The reason they don't want to open source is that Adobe Professional is how they make their money out of the open format. Give the format, encourage people to use it. They can write it, even with their own tools. Adobe make money because even though they've created a market, they make the best tools in that market.

  14. Cry more by daeg · · Score: 4, Interesting

    When your company makes a single product, you cannot complain when that product is no longer relevant. They should have diversified when they had the capital to do so.

    Also, Symantec and every other virus scanner makes use of non-approved APIs in win32. They were not documented, and not approved for the use that security companies gave them. Vista is finally removing deprecated APIs and replacing them with documented, hopefully bug-free versions. They have said numerous times in their blogs and elsewhere that they will help existing companies convert existing API calls into standard calls. Symantec et all are complaining because they make such liberal use of these APIs that they are facing a huge challenge to get their product on the market quickly, if at all.

    Note that one-time file scanners will still work, e.g., what your e-mail client does with received messages. That can all run just fine in user space. The pervasiveness of anti virus clients, though, would require complete administrator access, something Microsoft has been trying to get rid of for every day use (as they should!). If you allow Anti virus software to run in administrator mode while in user mode, you also open the door to viruses easily being able to do the same.

  15. Progress!? by headkase · · Score: 4, Interesting

    Human activity and especially software in particular seem to follow a cycle of exploration and compaction phases. I remember when a disk defragmenter was an extra piece of software you bought (Blitzdisk on the Amiga). As time goes by, what used to be peripheral functions become part of the core operating system. This is a good thing. I expect a web browser, media player, word processors (even Notepad counts), and so on to be available immediately upon a fresh install. Microsoft is legitimately trying to improve their Windows product. They are improving their customer experience by folding new functions into the operating system such as anti-malware (or other nasties), and security (firewalls and such). This represents the compaction phase of the cycle preparing the way for the next exploration phase.

    --
    Shh.
  16. But they are already unusable monsters... by AmazingRuss · · Score: 4, Informative

    ...symantec in particular brings a system to its knees. Realtime scanning is a great idea IF it doesn't render your computer unusable. For obvious reasons you are forced to used the latest version, which just gets bigger and bigger and bigger. I've started dumping Symantec in favor of a daily clamwin scan. Not as good...but at least the computer is usable.

    1. Re:But they are already unusable monsters... by krell · · Score: 4, Funny

      "symantec in particular brings a system to its knees"

      But that is security! Studies have shown that a system brought to a complete 100% standstill is impervious to malware and virus infection.

      --
      Where were you when the voynix came?
    2. Re:But they are already unusable monsters... by mongoose(!no) · · Score: 2, Interesting

      That's why I've stopped using the free version of McAfee that my university provides me with in favor of AVGFree. It used to take my fairly modern system an extra minute between booting and being usable because of McAfee. Security is a great thing as long as it isn't an inconvenience.

    3. Re:But they are already unusable monsters... by Dr.+Spork · · Score: 2, Insightful
      As I say to everyone who asks me to fix their computer:

      I've never encountered a virus as terrible as Norton Antivirus.

      Sure, Microsoft might kill Symantec with shady monopolism, but I think we should me more angry with the free market, which has kept these leeches alive for this long.

    4. Re:But they are already unusable monsters... by Shawn+is+an+Asshole · · Score: 2, Informative

      Try a daily BitDefender scan. It works well and the on demand scanner is free:

      http://www.bitdefender.com/site/view/Download-Free -Products.html

      ClamAV is great for scanning email, but when scanning for system viruses it's really not that good. I've seen it miss dozens of viruses that BitDefender, AVG, and F-Prot picked up.

      --
      "It ain't a war against drugs.it's a war against personal freedom" --Bill Hicks
  17. No danger in the near future by Noonian+Soong · · Score: 3, Insightful

    I don't think Symantec and McAfee will have a problem in the near future. It think it's the same thing as with personal firewalls. Even though Windows XP has a built-in firewall (which covers only incoming connections, I know), people feel the need for additional security. I won't write about the pros and cons of personal firewalls and the use of Symantec's and McAfee's products, but I believe that the average user will simply keep buying security products. They come in nice boxes and as we all know, Windows isn't safe if you use it as it is.
    I don't think Microsoft's marketing will change this perception in the next few years, so many computer users will still believe what the traditional security software vendors tell them.

    --
    The strength of a civilization is not measured by its ability to fight wars, but rather by its ability to prevent them.
  18. Re:symantec by Shawn+is+an+Asshole · · Score: 3, Insightful

    So does Microsoft. And it's on by default and "good enough".

    --
    "It ain't a war against drugs.it's a war against personal freedom" --Bill Hicks
  19. MS Vista by PCWizardsinc · · Score: 4, Insightful

    You do know that it is Microsoft's VISTA OS right? Can't they build in what they want? No One is FORCING anyone to buy Vista, the can buy MacOS or Download any version of Linux they want, Microsoft wrote the code, its theirs, if they want to lock out vendors, or increase or decrease security on a whim, they can, its theirs... doesn't anyone get this? If you don't like MS, choose some other vendors OS...

    1. Re:MS Vista by WhodoVoodoo · · Score: 2, Insightful

      I believe you may have a misconception about the issue at hand here, sir.

      The issue is not whether or not they are locking out vendors. (actually it is, but there's more to it.) See, Microsoft is a monopoly (Yes, it is. There is not an argument here anymore. They've been legally classified as a monopoly by the US and the EU.) and being a monopoly they are subject to a number of restrictions. One of those being it is illegal for microsoft to use their Desktop OS monopoly (which is recognized legally as such) to manipulate another market. It is LEGAL for them to enter any market, but they cannot use their existing monopoly to tilt the playingfield to their own benefit.

      Ergo, locking out vendors in the antivirus/antispyware market while simultaniously creating a product in that market very clearly falls under that catagory. Microsoft may not use it's desktop operating system monopoly to manipulate another market. It only adds to the case that they are charging for some of these services.

      Sure you can jump ship. But it's still illegal for them to lock everyone but microsoft out of a market, even if it's just witholding APIs for a period of time (which happens to be part of the issue at hand) because this would give them a distinct advantage in the AV/AS market, temporarily at least being the only game in town. Assuming they even open it up to outsiders.

      And no, it doesn't matter that they created this market in the first place. That does not magically make it okay; they COULD have just been open about things and worked with AS/AV vendors to include them in the process in some way. Doing anything but could create another dangerous situation for Microsoft.

  20. This IS the same thing by backwardMechanic · · Score: 5, Insightful

    Symantec and McAfee are only in business because of Microsofts mistakes, true. I'd love to see them go out of business because MS had finally made a secure product. But that's not what MS are doing. Rather than making Windows secure, MS are making it difficult for the AV companies to operate. Sure, they're plugging Windows, but the wrong bits. It's not security, it's monopoly. We've seen this before.

  21. This isn't really competition... by Ritz_Just_Ritz · · Score: 4, Insightful

    In my opinion, the major "anti-virus" vendors are precisely the type of parasitical hanger-on that you DO NOT want on your computer in the first place. They use an unGodly amount of resources and greatly slow down the machine they're "protecting." They live merely because Microsoft has been unwilling/unable to write secure code. So now Microsoft is trying to fix that (rolling eyes) and these parasites are crying about unfair competition. Do you propose that the EU forces Microsoft to write less secure code in order to allow these companies to maintain their relevance? That seems rather foolish.

    Let's use an analogy. Let's say I build an automobile and it's famous for having fuel injectors that clog up. People begin getting annoyed as the engine runs worse and worse until they get stuck on the side of the road. Along comes WidgetX. They invent a device that attaches to the engine end somehow "prevents" the problem. The downside is that the efficiency of the engine drops and you burn a LOT more gas, but your odds of getting stuck on the side of the road are greatly reduced. The next model year, the car company redesigns the engine so that the injectors no longer get clogged. WidgetX cries foul because now their product has become both unecessary and it has become obvious how wasteful of resources it was. So WidgetX demands the EU authorities to force the car company to go back to selling failure prone injectors instead of coming up with another innovation that actually helps consumers.

    Call me crazy, but I don't see Microsoft as the "bad guy" here at all.....

    1. Re:This isn't really competition... by PygmySurfer · · Score: 2, Insightful

      That's not it. Symantec and McAfee are whining because MS is preventing them from installing all the nasty hooks into the kernel their crappy programs use. Several other AV vendors already have products that are working fine with Vista. Symantec and McAfee would rather bitch and moan than fix their broken software, however. It actually has nothing to do with MS providing their own AV solution, or MS having the only solution that works, even though that's what Symantec and McAfee wants us to believe.

      Another thing Symantec is whining about is the Windows Security Center, which is basically a control panel applet that monitors your AV solution, firewall, etc. It displays a little notification if something is wrong, like say your virus definitions are out of date. These vendors want to be able to disable the Security Center, and replace it with their own version (Symantec kind of does this already, though the Windows Security Center remains active, therefore the user gets several notifications from different applets, causing confusion - Symantec says the only way to eliminate this confusion is to disable the MS Security Center so they can use their own applet. Not sure how that's supposed to work with products from several vendors, I don't see Symantec opening up their applet to McAfee et al, however). What's next, instead of the Start Menu, every vendor will offer up their own little application launcher? Maybe Microsoft can bring back the Office toolbar, and Adobe can make a nifty little flash app that floats along the bottom of your desktop.

  22. good by radarsat1 · · Score: 3, Insightful

    riddance.

    Both of these products, and Norton too, piss me off to no end when trying to debug problems on my friends' computers. I would never install them on my own computer, and haven't needed anything like it in ages on any other operating system. Since I end up having to reinstall Windows ANYWAYS, I always just tell people not to worry so much about viruses. I just tell them, don't click something stupid, don't use IE, you'll be fine. It's just one more "fear factor" that is so abundant in people's lives these days. Viruses are the last thing anyone should be afraid of.

    Anti-virus software is nothing but leeches on CPU time, memory, and network speed.

  23. News Flash! by Anonymous Coward · · Score: 2, Funny

    This Just In: Symantec sues Linux for creating a secure product, denying the company a potential revenue stream.

    I'm no fan of Windows, you'll never see me use an OS that requires fifteen free gigs just to install, but if they're finally getting their security right then I guess the security vendors are S.O.L.

  24. Yes, well... by zecg · · Score: 3, Insightful

    ...tough luck. This time it is not a function unrelated to the OS that Microsoft is bullying the competition out of, but security of the OS itself. Security companies were spawned by MS' mistakes and they simply failed to grow healthy diverse business offering value other than compensating for MS' mistakes. Nobody is investing in them, some are histerically dabbling in spyware (or so I seem to remember reading somewhere sometime) and are generally about to crash and burn.

    --
    .i lu doi ringos.star. xu do puku'aroroi dunli dopecaku leni virnu li'u
  25. The Netscaping of Symantec and McAfee by thethibs · · Score: 5, Insightful

    Symantec and McAfee will find new lines of business or fade away because they are selling products that shouldn't exist at all.

    These products are based on identifying any of hundreds of thousands of programs and stopping them from executing—in an environment containing a few dozen programs the user actually wants to run. It's far easier to allow the few dozen and deny access to anything that isn't on this short list than to check everything against a very long and growing longer list of signatures and behaviours.

    In the fullness of time, MS operating systems will fully implement Default Deny security, a path they have already started down; PatchGuard is part of it. When this is done, there will be nothing for anti-virus software to do.

    I run my systems using just this part of F-Secure (Application Control enabled, everything else disabled) and the occasional scan. Same approach to browsers: all is forbidden unless expressly allowed. Scan results are always zero hits.

    I look forward to the day when this is written into the OS code. Vista security is a good start.

    --
    I'm a Programmer. That's one level above Software Engineer and one level below Engineer.
  26. No they'll always be virus scanners by Sycraft-fu · · Score: 2, Insightful

    Unless we move to a trusted computing model where MS (or someone else) decides what can and can't run we'll need virus scanners. Why? Because an OS isn't broken when it does what you ask it to. If you are the system administrator and you order your computer to execute something, it can't second guess you. It's job is to run the software. If that software happens to be evil, well then that's your business. I mean I can send you a shell script that does "rm -rf ~" and if you are gullible enough to run it, well you just lost all your data. The OS can't defend against that.

    Virus scanners, however, try to. A virus scanner is like a bouncer. It's got a list of know bad guys, and the good ones can tell if it's the same guy in a wig (heuristic scanning). A virus scanner will go and say "Hey boss, this file is probably bad, you should let me delete it."

    Mcaffee and Symantec's problem isn't that viruses will go away. Unless we get an Orwellian TCPA/Palladium type setup they won't. The problem is their software sucks, is over priced, causes problems, and has much better alternatives. AVG is faster, does a better job scanning and costs less money. Why would I want to buy from Symantec?

    1. Re:No they'll always be virus scanners by Sycraft-fu · · Score: 4, Insightful

      Well a couple things you miss:

      1) I can do the rm -rf / on Linux, I just need to get the user to give it admin access. When dealing with a clueless user, this is easy. Most viruses get in via stealth or social engineering. They either infect another file you want, or they pretend to be something you want. So the user goes to install the infected software and the system asks for root. Well they give it root, since they want it to install and don't take the time to consider if it should really need it. Virus gets on as root and does as it pleases. Watch the average user use a computer, they just answer yes to everything. They just want the computer to shut up and give them what they want, they never consider that these security warnings mean something.

      Also FYI Vista does just as you suggest. You run dopriviledged and have to escalate.

      2) Data is WAAAAY more important than system and apps to just about everyone. Whenever I get called in to do data recovery at $100/hour do you know what it is that the client wants? It's not their OS or their apps, no it's their data. That's all that matters. They won't pay that kind of money to get their OS back, a system restore disk does that. It's the data that despite being so valuable was never backed up that they want. Deleting a user's data is in every way as bad as blasting their whole system to them.

      I mean think about it. Your data is what's unique and it's what really takes time. Right now if you were to hose my OS install completely I could be back up and fully running, apps and all in 3-4 hours. Inconvenient, but no big deal. However if you were to blast the big project I'm working on and all its backup copies. Shit, I'd be out at least 200 hours of work so far. My concern isn't that a disk might drop and I'd lose my system. Big deal I'll fix that. My concern is that my data might get corrupted/lost.

      The idea that a computer is more important than the data is only true in a limited capacity on multi-user systems or servers or the like. Yes, if I run a webserver with 50 users I'd much rather 1 user lose their data than the server get waxed. However on a home computer that's used by 1 person the data and the computer are essentially synonymous. The computer's reason to be is to hold that person's data and let them use it. If the data goes, the computer is damn near worthless.

    2. Re:No they'll always be virus scanners by Sycraft-fu · · Score: 2, Informative

      Windows Server 2003 and Windows Vista support what you talk about. In Server 2003 I believe it has to be turned on, in Vista it's on by default. It saves previous versions of everything, up to the limit of free drive space (as space is needed oldest copies are overwritten).

  27. Re:Huh? by VGPowerlord · · Score: 2, Informative
    Early builds of Netscape suck. I'm trying to get 4.08...

    By early, I'm assuming they meant before 4.x, where Netscape started sucking horribly.
    --
    GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
  28. And the amazing thing by Sycraft-fu · · Score: 4, Informative

    IF you can get realtime scanning that doesn't slow you down. Try out AVG sometime. When I first got it, there was so little impact I was sure it wasn't doing anything. So I went and grabbed a virus to test it. Immediately, AVG threw up a red flag.

    The threat to Symantec isn't MS making Windows unvirusable, that's not possible (barring trusted computing), the threat is that there are new AV companies that make good, fast, cheap products that beat the crap out of symantec's offerings. AVG and Kaspersky are two excellent choices. Also I hear lots of good things about Bitdefender though it leads to bluescreens on my (and other's) system.

  29. That's gratitude for ya by Dracos · · Score: 2, Informative

    Virii, worms, and malware all exist because MS makes famously insecure products. Symantec and McAfee exist because virii, worms, and malware exist.

    Symantec and McAfee need to at least acknowledge that their business models are based on design flaws, poor implemetation, and bad coding practices within MS. They should thank Bill and crew for the ability to complain when a fraction of these inadequacies are fixed after many years.

    I'm not defending MS and their monopolistic procatices, but this isn't simply another Netscape crushing. Netscape was a user space product. This is about fundamental flaws at the core of the Windows OS: about as faw away from user space as you can get. That these flaws permeate into the userspace is beside the fact.

    Symantec and McAfee (and many others) have spent the past decade or more cleaning up after MS in terms of security. Now they want to bitch when their lazy benefactor decides to take some responsibility? But, the issue isn't the mere taking of the responsibility, it's more about the monopolizing of that responsibility. No one has any reason to believe that MS' anti-crapware will be more effective than any third party solution. MS allowed security to become a third party market, now they want to be that market.

    MS is wrong for closing out vendors from providing a complete third party security solution. However, MS is more wrong for not writing secure products in the first place, and certainly for not understanding what comprises an operating system.

    • Web Browser: critical OS component.
    • Security: third party solutions are OK until we get around to it.

    Windows security vendors only have something to worry about if MS actually produces a secure operating system. I don't believe they think this is possible, which is why they haven't broadened their product lines. Until hell freezes over, Symantec and McAfee should all but shut up and enjoy what MS has given them.

  30. Any monopoly isn't "good enough" by kf6auf · · Score: 4, Insightful

    If there is a monopoly (or even an oligopoly) on antivirus software you can bet on virus writers will test their software to make sure that it is undetected. Having a wide range of antivirus programs is essential or else pretty soon and the major AV software sucks compared to anything else. While people with Vista Home Edition will likely run the Windows AV Software, IT departments at corporations will most likely stick with Symantec and McAfee or whatever else they have.

    1. Re:Any monopoly isn't "good enough" by Logiksan · · Score: 2, Interesting

      I'd like to know which companies still use solutions from Symantec or McAfee. Both companies are jokes. As someone who works in PC repair, I can't tell you how many systems have come in my shop as a result of programs by those developers/publishers behaving badly.

      In a lot of cases, normal internet usage is locked out entirely if NIS becomes damaged. And you can't uninstall NIS through the normal add/remove dialog if it's corrupted. So what do you have to do to strip it out of the system? Why, log onto Symantec's site and run their online SymNRT, of course. It used to be easy, download and store the app somewhere, run it when needed. Now it's a complete mess. Which IT department wants to deal with that?

      ...and don't even get me started on McAfee. It's been bloatware since day one, and so many questionable items pass right through it's "protection" unaffected that it should just be called "Federal Anti-Virus: We give you the illusion of protection, and you'll pay us well for it."

  31. And interesting enough by Sycraft-fu · · Score: 4, Informative

    Many companies don't seem to be bitching. Sophos announced they'll have a Vista compatible version out a couple weeks before Vista (their current version even works with realtime scanning, it just can't update or interact with the desktop). AVG has apparently been working with Vista since Beta 2 (I haven't tried it) and the 7.5 version is listed as Vista ready. Kaspersky Labs says "From what we have seen of Vista, we cannot tell that Microsoft is blocking access to the core."

    So it seems that whatever the problem that Symantec and Mcafee are having, it's not universal to virus scanners. Seems more like they are lazy and don't want to do any rewriting whereas their competitors are on the stick.

    1. Re:And interesting enough by Jarnis · · Score: 3, Insightful

      Apples and oranges.

      McAfee and Symantec are whining about 64Bit Vista. Kaspersky & co are talking about the 32bit version, which has no PatchGuard.

      Of course this is all mostly academic. PatchGuard will ensure that 64bit Vista will be marginalized. Numerous apps will fail because of it - you only need a thing like DaemonTools not working, and big portion of MS home target market will drop the 64 bit version like a rotten fruit.

      Control freaks running corporate envinroments will use 64bit, as will users that specifically need more than 4 gigs of ram. Rest won't. Major system builders won't put 64bit Vista as preinstalled, as it would generate a big pile of extra support calls for no tangible benefit.

      Symantec and McAfee are pissed if they have to release their security products with 'wont work on 64bit vista' stickers. Especially if at the same time OneCare will work fine. It will imply inferiority, even if in the real world there is no difference, because home users won't adopt the 64bit version, at least not until major home apps start asking for more than 4 gigs of ram (and we're still at least 4-5 years away from that)

  32. Re:symantec by rbochan · · Score: 3, Informative

    Do they? I thought they just bought out Atguard and bloated it all to hell and back like they did with Norton Utilities.

    --
    ...Rob
    The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
  33. Everyone is forgetting something... by PixieDust · · Score: 5, Insightful
    WHY does the AV program NEED to hook into the OS kernel?

    When you think about it, this ITSELF introduces another vulnerability. Another point of failure. Why bother exploiting the OS, when you can use the nice convenient path provided to you by the AV software? Everyone seems to forget this.

    Microsoft gets bashed for their 'insecurity' and the moment they try and IMPROVE that, they get flamed, and people cry foul and start throwing around such words as 'monopoly', 'abuse', 'lock-out', and the tin-foil hatters come out of the woodwork and start bashing MS security, while somehow totally missing the absurdity in what they're saying!

    Other AV companies have managed to adapt to the kernel lockouts, why can't Symantec and McAfee do the same? Instead, they'd rather keep their grubby paws hooked into the OS as deep as they can be, so that they can effectively hose a user's installation, then charge them $80 for phone support to resolve the issue.

    People can't have it both ways. You have to give credit where credit is due. Windows One Care is not installed by default, it's a FOR PAY product (which totally differentiates it from IE vs All) that you have to buy IN ADDITION to the OS. Windows Defender is free, and protects against spyware, and comes pre-installed. While I don't particularly like that, it doesn't really bother me either. People install Yahoo Messenger, and it wants to install a Toolbar with Yahoo Anti-Spy. The same goes for Google, AIM, MSN(yes I know that's redundant), and a plethora of other IM options, and even just generic toolbars. Most ISPs now days 'give' you AV/AS to use. So Windows Defender doesn't bother me, there's already another 50 billion people trying to give me spyware protection (none of which I use, the standard Windows Firewall is quite sufficient for me thank you), so why not MS too?

    I had the opportunity to participate in the beta for OneCare (wasn't hard, they offered it free, and I liked that idea, since people were inevitably going to ask me about it). I found it to have a rather large footprint, and be fairly slow. Given it's competition in the form of Symantec NIS, and McAfee's Internet Security Suite, and Trend Micro's Internet Security Suite, it's performance was roughly average. It wasn't as fast as TM, but was quicker than NIS and MIS in most cases. What struck me was only TM had a better detection scheme, and even then it was marginal (though I know a single thing getting through can mean the difference between being completely hosed, and being OK, never knowing how close you came to Virtual Armaggedon). MS One Care did a MUCH better job of catching/stopping spyware then all of them (Windows Defender gets lumped into One Care installs generally).

    Think of these things from the USER'S perspective. NOT from YOUR perspective. For people who are WAAAAY non-tech savvy, One Care offers a one-stop-shop for performance tuning (uncomplicated), AV, and AS and Firewall protection. It's easier to use than NIS, WAAAY easier than MIS, and TM rounds out the list of being the least user friendly. Bottom line is this is just one more cool way to bash Microsoft for trying to improve things. Do you think they're using kernel hacks for One Care? Probably not right now, as people would LOVE to find a way to exploit One Care to compromise a machine. Will it remain that way? Probably not, because I see things getting into the kernel eventually, and requiring that the kernel be accessible, at least to be scanned and locked so that it can be replaced. But still, NO AV/AS program should EVER be hacked into the kernel. Period.
    It opens up the doors for too many things. OneCare also doesn't bombard the user with useless popups and notifications like the others often do, which aids in hosing the system as they USER tells it to do something bad.

    One Care is a LEGITIMATE software release by Microsoft, and not at all a surprise. What is surprising to me, is that it took THIS long for it to resurface.

    That is all. Please return to your normal dailty activity.

  34. What's truly maddening about this is... by AmazingRuss · · Score: 2, Funny

    ...I spent years getting people to buy antivirus software...and now as you say, the antivirus software has grown into a problem of its own.

    People look at me like I'm crazy when I tell them their paid antivirus software is causing their computer to suck, and I need to replace it with free antivirus software. Their poor little heads just spin as they smile, nod, and slowly back towards the exit.

  35. The _very_ early builds? by smchris · · Score: 2, Insightful

    people may one day speak of them in the way that we now speak reverently of the early builds of Netscape."

    Probably because I was dual-booting Coherent unix the first half of the 90s, OS/2 the 2nd half of the '90s and linux now, I often feel like I'm the only person left in the world who can still feel a pure warm feeling for the 80s garage software that was the original McAffee.

    Everybody else invariably seems to echo, "Die McAffee, Die! Die! Die!" Which I guess is OK with me since it's just been a corporate brand name for ages anyway.

  36. Windows _____ - now with more security! by DonChron · · Score: 3, Funny

    How often have you heard that the new version of Windows is "more secure" than the last version? A quick recap:

    Windows 3.1 - no real security, but it's prettier than DOS!

    Windows for Workgroups 3.1.1 - now with a login screen (but still no real security)!

    Windows NT 3.51 - now with ACL's (and mostly not compatible with Win3.1 apps)!

    Windows 95 - also has a login screen! no real security, but prettier than WfW!

    Windows NT 4.0 - now with shared ACL's (domains) - the most secure Windows ever!

    Windows 98 - Slightly less likely to crash than Win95! No NT security features!

    Windows ME - Now with some system-software protection, but still no ACL's!

    Windows 2000 - An improved interface and kernel! Active Directory 1.0! Now, the most secure Windows ever!

    Windows XP - The successor to the Win2k and Win9x kernel products - super duper secure! Home users still run as the super-user, but it's less likely to crash! ACL's for Professional users and a very limited firewall make this, yes, the most secure Windows ever!

    Windows 2003 (server) - The XP kernel in a server! Hardly anything runs by default! The Most Secure Windows Ever!

    Windows Vista - Still with ACLs! New ways to limit access! Everyone's running as superuser, but with more warnings!

    Windows Longhorn (server) - Not fully designed, but looks a little less secure than Win2003 - possibly *not* the most secure Windows ever!

  37. Weird Business Model by gilgongo · · Score: 2, Interesting

    Anyone who builds a business that is dependent on the failure of a single software vendor to produce secure code is, well, asking for it aren't they?

    The irony here though is that the single software vendor is a monpolist. So, what do we do? Allow Microsoft to continue to produce broken, sloppy-designed software, and thereby prop up an oligopoly of anti-virus vendors, or let them "fix" their software by incorporating anti-virus measure that they should have had in there all along?

    I sure as hell wouln't like to be the judge on this one!

    --
    "And the meaning of words; when they cease to function; when will it start worrying you?"
  38. Don't revere Netscape. by kendor · · Score: 2, Interesting
    Netscape does not deserve your reverence, people. Don't believe me? Download any old build of NN and try using and/or coding for the thing. In the first couple of versions, they had a modestly interesting product. Beyond the era of, I dunno, IE3, Netscape was an also-ran.


    I don't even know where to begin with the suckage:

    1) nested tables didn't work
    2) css didn't work
    3) netscape, inc. tried repeatedly to make proprietary flavors of markup
    4) you had all of these bizarre spacing artifacts
    5) Netscape was bloated, and you could watch the app leak memory
    6) It was slow
    7) It set Ajax-like functionality back literally years. Microsoft had demo code of Ajax-ey stuff for production releases of IE in, what, 1999?
    8) Netscape got slower and suckier with each successive release, rather than better
    9) In the late days Netscape, Inc. couldn't ship on time to within a ~years time.

    Since Netscape stopped being a player -- thank God -- you've seen the emergence of much more agile development efforts (Safari, Flock, extensions) and the resurgence of technologies that were invented, oh, last century or so.

    Netscape was a poor competitor with a poor product that drove itself into the ground. Microsoft put out a modestly competant browser with IE5,6,7, made few substantive improvements over the course of years, and was still able to eat Netscape's lunch because of the galactic suckiness of what Netscape was coding and releases.

    Revere Flock, revere Flickr, revere Microsoft's better developer stuff, revere Apple. But please don't revere Netscape, because for most of its corporate life, their core product sucked. I'm glad they're gone.

    -KF

  39. Yes by Sycraft-fu · · Score: 2, Informative

    Apparently it started working during Beta 2 and AVG 7.0. AVG 7.5 is explicitly Vista compatible with RC2.

  40. Like Nutscrape in another way. by zerofoo · · Score: 3, Insightful

    Netscape lost the browser war partially due to Microsoft's tactics, and partially due to the quality (or lack of) in the product.

    Symantec and McAfee have been releasing low-quality products for years. Even Symantec's corporate offerings have been questionable. Release after release gets buggier, slower, and less reliable. If Microsoft's offerings are even a little bit better, Microsoft should have no problem burying these two companies.

    Frankly, Trend, Grisoft, Sophos, and Avast have been doing more damage to Symantec and McAfee than Microsoft has in the last few years.

    -ted

  41. Symantec got Netscaped a long time ago by Animats · · Score: 3, Interesting

    Symantec used to sell compilers, developer tools, and even some user applications like ThinkTank, an early outliner. Microsoft pushed them out of the tools field on Windows; Symantec had a more portable alternative to MFC, and Microsoft didn't like that. Outliners disappeared as a standalone product category; Word now does that. All that's left is the anti-virus business. Now that, too, looks like it's toast.

    Actually, the OS vendor should be doing the security system. The primary function of an operating system is security and resource management; everything else could potentially be an application. Only because of Microsoft's appallingly bad security does the anti-virus industry even exist.

  42. Re:Microsoft will go after Adobe next. by mabhatter654 · · Score: 2, Insightful

    MS has all those things in the works for Office 2007. They have a beta photo editing program...it's not photoshop, but it's getting good reviews comparable to "elements".... Not a good time to be Adobe after they hung those mac users out to dry with CS2 not showing up for intel macs yet.

  43. Speaking of alternative... by DrYak · · Score: 2, Insightful

    Speaking of alternative solutions, there's another big difference between this and the netscape/explorer incident :

    Several years passed between when the Netscape browser became b0rked beyond usefullness, and before new partical opensource solutions started to rise from the ashes like FireFox/IceWeasel.
    This gave plenty of time for the "bundled with and good enough" explorer to gain market share.

    In the current situation not only are there already several player with enterprise-wide contracts with big corps, but free-as-in-speech alternatives have already emerged, and those are already good for a lot of utilisation similar as Mozilla and FireFox were at their dawn (ClamAV is routinely used in mail servers), plus solutions to make them really great are being actively developped (built-in mail plugin, available browser plugin, embeding in opensource watchdogs, nice windows suite, etc)

    In article similar to this one, Microsoft is praised with the way in which it managed to catchup in the internet field even if it was a late commer. But we all know how microsoft usually catches up : it's solution are often completly botched, bugged, under-performing. Explorer was getting used by a lot of people, but it mostly was a joke in term of security, stability and standarts.
    For sure, Microsoft will try to get a similar monopoly on security. But we can be certain that their solution will, this time too, not be very effective or usefull, probably buggy, full of exploits itself, often circumvented by malware writer, and propably turned of by "wanna-be-power-users" because it slows down their computers (which are already falling under the load of viruses and spambots).

    But this time, ClamAV, AVG, H+BDEV and Kaspersky will already be there to be promoted as a better solution by articles, just like now FireFox and Opera are promoted against IE's defects after years of IE dominance.

    --
    "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
  44. Well the thing is... by rubypossum · · Score: 2, Insightful

    Well the the thing is, I and most people in the I.T. industry can't sympathize with symantec or mcaffee. In fact, quite frankly, we'd probably key their car if given the chance. They both produce annoying bloatware that attempts to notify the users of it's presence on every occasion possible.

    That said, this is a stark reminder that Microsoft can bundle your company out of existence if you develop on their platform. They have done this in the past and they will do this again. I would be worried in several years if I was developing anything like OCR software (like TextBridge), speech recognition software (like ViaVoice) or other as-yet-unbundled mass market products. Because these will be bundled eventually.

    They bundled I.E. and killed Netscape, bundled WMP and reduced most other media players and they added the "thumbnails" feature in Explorer (as well as Windows Picture and Fax Viewer) and killed a significant portion of the market for picture browsing software. So Microsoft has a track record (more extensive that this) in doing this.

    But on the other hand the notion that Microsoft should never add anything to their O.S. if somebody already sells a product that has the feature is just crazy. I mean, their O.S. would never be able to add anything at all. By definition generally useful features would be prohibited from being added. Or Microsoft would have to come up with some kind of completely new software that was unimagined by any other software developer on earth. Furthermore, it would have to be solving a problem that no one ever perceived before - because those generally already have products out there (i.e. need to manage and view pictures, need to browse the Internet, need protection from viruses.)

    Furthermore, most other O.S.es have bundled the same products as Microsoft. My Slackware CD came with several bundled solutions, I sure as hell would have a problem competing with any of them commercially. In fact every Linux distro I've ever used came with a tightly bundled web browser (Konquerer, Epiphany etc.) Much less so than Windows but it would still be very hard to write a successful commercial browser. Same thing with picture browsing software and media players.

    Mac OSX bundles these features too. (i.e. Safari)

    I guess the final solution is - if you write a program that solves a very common need it's functionality will eventually be bundled into operating systems. So make money from it quickly - if you can. And have eternal fear of MS if you develop for their platform. Because they can release your product for free - pre-installed - at any time.

    You will still have a market, but it will be smaller and you'll have to keep on improving your product and you might even need to give it away free and find other ways to make money from it. For example FireFox, Picasa etc.

    And this is a good thing for all O.S. users.

    --
    I have a theory that the truth is never told during the nine-to-five hours. - Hunter S. Thompson
  45. Signature Scanning remains key by Holmwood · · Score: 2, Insightful

    Actually, every major AV product still relies on signature scanning for detection on client machines. You're right that observation on a honeypot or even VM sandbox is often used to characterize the behavior initially, but this is distinct from a roll-out of detection to the client, which is what I believe everyone's talking about here.

    As for signature scanning going the way of the dodo, there are really only 3 choices at present: signature scanning, run in a VM sandbox, or try to detect heuristically without resorting to a VM. The last two are similar, but not identical.

    There's already malware that won't run when inside a VM, so 'running in a virtual sandbox' provides no real solution. (And if someone suggests that we solve that by making it impossible to tell whether or not you're running in a VM -- which likely means processor changes -- think about what that will do to being able to detect a rootkit that loads your whole environment into a VM.)

    If you take a look at AV-comparatives.org, heuristic scanners don't seem to do very well vs. signature based detection. The very best proactive (heuristic) detection of 'unknown' malware (viruses, trojans, worms, etc.) seems to run about 60%. The very best signature based detection seems to run around 99.9%. (Moreover, the rate of false positives with heuristic detection tends to be much higher.)

    60% vs 99.9%? That's a big, big difference. Signature-based detection isn't going away anytime soon.

    Warning, URLS lead to PDF's: See: http://www.av-comparatives.org/seiten/ergebnisse/r eport10.pdf and http://www.av-comparatives.org/seiten/ergebnisse/r eport11.pdf
    Finally, I'm reasonably persuaded by Eugene Kaspersky's comments on this at http://www.kaspersky.com/eugenearticle

    Let's imagine that Company X has developed a behavioral antivirus AVX, which detects 100% of current malicious programs. So what will the hackers do? Of course, they will invent new types of malicious programs. And then of course it will be necessary to update the behavioral rules. And then update them again, because the hackers and virus writers aren't going to give up that easily. And then update them again and again and again. At the end of the day, we arrive at a signature scanner, except the signatures will be behavioral, and not pieces of code.

    This conclusion also applies to the heuristic analyser, another proactive protection method. As soon as hackers perceive that antivirus technologies are preventing them from reaching their victims, they invent new virus technologies which will be used to evade proactive detection. As soon as a product with advanced heuristics and/ or behavior blocking is widely used, the 'advanced' technologies employed will cease working.

    This means that 'reinvented' proactive technologies are only effective for a relatively short length of time. Where junior hackers need a few weeks or a couple of months to get round proactive protection, professional hackers will need one or two days, or, in the worst case, a few minutes or hours.

    Of course, he's slightly biased, his heuristic engine is weak compared to some, though still reasonably strong, and his company is fastest in the world at rolling out signature updates. But I think there's a lot to his argument, and I just don't see heuristic scanning closing the gap anytime soon. Holmwood