Slashdot Mirror


Tasmanian Dept. of Education Wants Anti-Virus for Linux, OS X

An anonymous reader writes "One of Australia's largest government technology buyers, the Tasmanian Department of Education, has gone to market for a security vendor to supply anti-virus software for its 40,000-odd desktop PCs and laptops, as well as servers. But the department's not just running Windows — it runs Mac OS X and Linux as well, and has requested that whatever solution it buys must be able to run on those platforms as well. But have we reached the stage were Mac OS X and Linux even need third-party security software? It seems like most Mac and Linux users don't run it."

282 of 396 comments (clear)

  1. no by Anonymous Coward · · Score: 3, Insightful

    no.

    1. Re:no by rwa2 · · Score: 5, Informative

      Counterpoint: yes

      The US DoD requires it too. Fortunately, it is available from commercial suppliers (ClamAV is not compliant with something or other), so you just install it and maintain it and pass the bill on to the taxpayers.

      I think it's just standard CYA, so you have someone external to blame if something slips through (which possibly explains why effective roll-your-own measures are deemed insufficient by the policymakers).

    2. Re:no by DrgnDancer · · Score: 5, Insightful

      The DoD's reasoning is pretty straightforward. There are few to no "in the wild" viruses or trojans for Linux/Mac (several worms though), but data rarely stays in one platform in an interconnected world. We put virus protection on every platform so that whenever a document or program is introduced on the network it gets scanned. That way if it has malware in it, even Windows malware on a Linux/Mac system, it's caught early. Just because I first put the document on a Linux system doesn't mean it's going to stay on a Linux system.

      --
      I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
    3. Re:no by ironjaw33 · · Score: 4, Insightful

      We put virus protection on every platform so that whenever a document or program is introduced on the network it gets scanned. That way if it has malware in it, even Windows malware on a Linux/Mac system, it's caught early. Just because I first put the document on a Linux system doesn't mean it's going to stay on a Linux system.

      It's like getting a flu shot -- you're not only protecting yourself from the flu, but others as well.

    4. Re:no by ShadowFoxx · · Score: 1

      no.

      if you believe no, your a not very intelligent and I want that coolaid your drinking.

    5. Re:no by SkimTony · · Score: 1

      Yes. And subjecting yourself to wasted time and a drain on resources by doing so. So, exactly like a flu shot.

    6. Re:no by 0xdeadbeef · · Score: 1

      > There are few to no "in the wild" viruses or trojans for Linux/Mac

      Is that so? Then why did I just read this in Google News:

      http://technolog.msnbc.msn.com/_news/2011/05/02/6570126-malware-attack-specifically-targets-mac-users

    7. Re:no by theeddie55 · · Score: 2

      no viruses or trojans is a bit of an exaggeration but the fact that one piece of mac malware is considered news worthy proves that there are very few out there.

    8. Re:no by meerling · · Score: 1

      They exists, especially on the Mac. Due to the historically higher level of security of linux users and the lack of worthwhile targets, few malware writers ever wrote any infectors for Linux. Mac has had thousands written for it. but that pales in comparison to the vast quantity that have been written for windows boxes simply because of small market share combined with version incompatabilities.
      As windows is by far the biggest juiciest target, it's what most malware writers target. They want to get as many machines as possible, and when one OS has 70-90% of the market (depending on when and how you measure), it's what 99% is going to be targeted.

      By the way, contrary to popular opinion, the most common symptom of being infected is having no symptoms at all. The reason why so many people start having issues, and then find an infector is because they had an infector they couldn't detect without the right tools, and never bothered until something else went wrong on the machine. Which is why the removal of the infector doesn't 'fix' their issue that caused them to finally check in the first place. (You have no idea how many times a corrupted word or excel file made them finally get an updated antivirus...)

      Yes, there are exceptions to all of this, but the ONLY computer you can say isn't infected is the one that doesn't work. The closest second place goes to the one with a good antivirus with current defs that gets regularly scanned. Anything else is a nomans land of possible-probably infections. (Yeah, Linux is still unlikely to be infected, but there are infectors for it, don't be a moron.)

      Now waiting for the inevitable flaming morons who haven't studied and worked with viruses, worms, trojans, and many other types of malware on various platforms for over 8 years to start yelling how wrong I am. Idiots. They are PART of the reason there's so much malware around.

    9. Re:no by CharlyFoxtrot · · Score: 1

      These stories pop up about one a year. Infection rates are always nearly zero. This was the last "OMG mac virus" story, OSX.HellRTS :

      Threat Assessment
      Wild
      Wild Level: Low
      Number of Infections: 0 - 49
      Number of Sites: 0 - 2
      Geographical Distribution: Low
      Threat Containment: Easy
      Removal: Easy

      Until evidence to the contrary I'll be treating the one you mentioned the same.

      --
      If all else fails, immortality can always be assured by spectacular error.
    10. Re:no by dwightk · · Score: 1

      yeah, I stopped using clamxav a while back to free up RAM. I also never get flu shots.

      --
      Like anyone can even know that
    11. Re:no by wiedzmin · · Score: 1

      I think this entire article is just trolling for posts in the comments. Making statements/questions like that on Slashdot is a little obvious...

      --
      Bow before me, for I am root.
    12. Re:no by cbiltcliffe · · Score: 1

      Symantec security response is very good for technical details about malware. For infection rates, though, it's virtually useless.

      For example, this is the same section from Symantec's site about the Stuxnet worm:

              * Wild Level: Low
              * Number of Infections: 0 - 49
              * Number of Sites: 0 - 2
              * Geographical Distribution: Low
              * Threat Containment: Easy
              * Removal: Easy

      It matches your OSX worm example exactly. So according to Symantec, your OSX worm is just as damaging and widespread as Stuxnet.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    13. Re:no by nobodie · · Score: 1

      While I have run Linux since Core5 and never had a single virus INFECTION, I have caught quite a few that were passing through my machines: windows viruses in the browser, in email or (especially now) on USB sticks. I generally find about 50% of my student's USB sticks have a virus or other malware on them, most visible in Linux to simple inspection, but then I run Avast for a quick double-check. As well I run Avast for Linux once a month whether I need it or not. Finally, I run it on my virtual Windows machines that I use in case the IT monkeys start to circle my office looking for that damn "linux virus" they know I have.

      --
      Subversion of spatial scale luxury decoration ideas.
  2. Passing on Viruses by Anonymous Coward · · Score: 4, Insightful

    A computer can still pass on a virus even if it cannot directly infect you. It might not be your responsibility but will a child know this? If he forwards an attachment unwittingly or something?

    Linux users and Mac users could accidentally infect a Windows user.

    1. Re:Passing on Viruses by Mouldy · · Score: 5, Informative

      This is exactly why antivirus software for Linux already exists, they probably catch a couple of Linux viruses too, but the majority of their definitions are Windows viruses.

      I've set up ClamAV on my Linux mail server to catch most dodgy stuff before it reaches my Windows PC. I also recently installed it onto my Linux Netbook to scan a friend's external hard drive for a Windows virus. I haven't been following the latest security news, so didn't particularly want to risk plugging it into my friend's or my Windows machine to scan it.

      So I agree, there definitely is a use for Linux-based anti virus software...even if my own uses are mainly concerned with protecting Windows machines.

    2. Re:Passing on Viruses by somersault · · Score: 2

      Or antivirus on the email server, pretty sure there are Linux solutions for that.

      --
      which is totally what she said
    3. Re:Passing on Viruses by Compaqt · · Score: 2

      Do have it set up to receive mail from Postfix, and then pass it on to Dovecot for distribution?

      Or does ClamAV get a crack at mail first before Postfix?

      Is there a way to scan an email as you're receiving it, and then stop in the middle of the process, making it look like you have a bad SMTP server, which hopefully spammers won't bother with again?

      Oh, and, are you running Amavis, and SpamAssasin, too?

      --
      I'm not a lawyer, but I play one on the Internet. Blog
    4. Re:Passing on Viruses by willy_me · · Score: 1, Interesting

      I have also used ClamAV - but it is horrible for finding most viruses. It is probably great for scanning email but it simply is not reliable enough for detecting viruses in downloaded files. I use Windows in a VM and have found numerous occasions when ClamAV would not detect a virus (scanned by the host machine). Scanning the file with most other free Windows anti-virus products results in the virus being found. So while I would love it if ClamAV did the job, it just doesn't.

    5. Re:Passing on Viruses by Ailure · · Score: 4, Insightful

      You're probably thinking of ClamAV http://www.clamav.net/

    6. Re:Passing on Viruses by Bert64 · · Score: 1

      There are a number of AV products for linux and mac, and they pretty much exclusively work as you describe... They are typically designed for servers with windows clients.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    7. Re:Passing on Viruses by Bert64 · · Score: 5

      I have found the same thing happen with most other AV engines too...

      I have done a number of incident response jobs whereby a machine has become infected and its my job to work out what happened...

      All machines were windows...
      All machines were running some kind of AV (multiple different vendors).
      Every machine had a persistent piece of malware present on it.
      The AV actually installed failed to detect the malware.
      Testing the malware with other AV engines found that some would find it, i never encountered anything totally new that wasn't detected by anything.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    8. Re:Passing on Viruses by Eggplant62 · · Score: 1

      How so? I've run Linux here for well over a decade and there's no way that I'm passing viruses around. What this request for quote from Tasmania demonstrates is how unaware of the technology benefits the requestors really are. With OSX or Linux, viruses can be disregarded. If you want to filter viruses from a mailserver, sure, I can see that. But there are no viruses for Linux. It's like needing an umbrella on a sunny day.

    9. Re:Passing on Viruses by Lennie · · Score: 2

      As many have already figured out, AV is pretty useless.

      It is nowhere near fullproof.

      --
      New things are always on the horizon
    10. Re:Passing on Viruses by mjwx · · Score: 4, Interesting

      A computer can still pass on a virus even if it cannot directly infect you. It might not be your responsibility but will a child know this? If he forwards an attachment unwittingly or something?

      Linux users and Mac users could accidentally infect a Windows user.

      In my experience, Mac users are even more irresponsible then clueless Windows users. They think they are magically protected, which means they will ignore obvious signs of infection till the very end.

      As we all know, malware is less about doing damage and more about making money these days. Keyloggers, trojans and spambots exist for OSX these days (as well as Linux) but they focus on staying hidden as their job is to make money, not make people annoyed which means they need to stay where they are to collect CC numbers or send spam.

      Linux users should not have a problem with AV. Even if they are smart enough not to need it. Linux users already think with a security focused mind, as an effect using Linux in lieu of a AV client is laziness on our part (granted, we can recognise an infected machine, so we can afford a bit of laziness).

      To use a Zombie virus analogy, Windows users are the ones running about in a mad panic as the Zombie hoard approaches, blocking highways and running to get away. Mac users walk towards them saying, "Zombies dont exist on Mac, I could never get infected". Linux users fled to the hills six months ago with as much fuel, food and porn as they could carry.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    11. Re:Passing on Viruses by Lennie · · Score: 1

      Maybe I should add why.

      There are more viruses created every hour (automated) than any anti-virus company can handle.

      I actually doubt that if they all worked together really well they would be able to have an up to date list.

      I'm surprised the botnet operators haven't yet used the botnet to create the new variants every few emails/HTML-form-posts/whatever they do.

      --
      New things are always on the horizon
    12. Re:Passing on Viruses by MattBD · · Score: 1

      As far as I'm aware ClamAV would only get to the mail after Postfix in such a setup. However, it's possible that the sort of thing you're looking for could be achieved using Postfix's greylisting capability. If you're not familiar with it, I understand that with greylisting, when an email is received from an unknown mail server, it's automatically rejected with a "try again later" message. When it's received a second time, it's accepted. After a certain number of successful deliveries, the sending mail server is whitelisted. The idea is that most spammers use MTA's that aren't exactly RFC-compliant so they won't bother trying to resend it. You can also manually whitelist addresses if you want.

    13. Re:Passing on Viruses by Yaa+101 · · Score: 1

      Most of the big brands have a virus scanner/remover running on a Linux powered live CD, I used several to disinfect a friends laptop.

      I think they will make them like that for Linux oriented viruses too...

    14. Re:Passing on Viruses by memzer · · Score: 4, Informative

      I'm guessing this was meant to be a troll but really things aren't as bad as you make them out to be these days...

      If you're setting up a mail server there are packages available which integrate all of the things you mentioned above into easier to manage / maintain systems. For example one popular one is iRedMail http://www.iredmail.org/features.html which can be set up by an intermediate user in around 1 Minute [Video: http://www.youtube.com/watch?v=wi8CF3RKRm4%5D.

      If you are implying it's much more complicated for the end user then you're kidding yourself as well. These days there are guides for most popular distributions and usually it's not much more difficult than installing the software and/or configuring an addon. For example, the Ubuntu community guide has easy to follow instructions for configuring Thunderbird with ClamAV. The process is by no means difficut (install, set ports, install addon) and takes less than a minute to complete for a novice user capable of following some instructions.

      There are of course users who would find following such a guide too difficult but really these users simply lack the experience, confidence, patience or time to do so anway. They're likely the same users who pay somebody else (or come to you, their friend / relative) to install the software for them ;)

      Point I'm trying to make for people thinking of giving it a try is that it is a lot easier to do than the parent implies - even for novice-intermediate users.

    15. Re:Passing on Viruses by V+for+Vendetta · · Score: 1

      Seems like Kaspersky is also supporting Linux machines (WS + servers).

    16. Re:Passing on Viruses by memzer · · Score: 4, Informative

      Link to the Ubuntu Community Guide for scanning email using Thunderbird and ClamAV for those interested:

      https://help.ubuntu.com/community/ScanningEmail

    17. Re:Passing on Viruses by petman · · Score: 1

      It's like needing an umbrella on a sunny day.

      From http://en.wikipedia.org/wiki/Umbrella
      An umbrella or parasol (also called a brolly, rainshade, sunshade, gamp or bumbershoot) is a canopy designed to protect against rain or sunlight .

    18. Re:Passing on Viruses by Robert+Zenz · · Score: 2

      To use a Zombie virus analogy, Windows users are the ones running about in a mad panic as the Zombie hoard approaches, blocking highways and running to get away. Mac users walk towards them saying, "Zombies dont exist on Mac, I could never get infected". Linux users fled to the hills six months ago with as much fuel, food and porn as they could carry.

      Here, take this imaginary +1 vote...it's all I have at the moment...but that awesome analogy deserves more!

    19. Re:Passing on Viruses by flam3boy · · Score: 1

      I use BitDefender on my Ubuntu.... it's pretty good for scanning windows machines and external drives. There are a couple AV that run on Linux, not sure about OSX. http://www.makeuseof.com/tag/free-linux-antivirus-programs/

    20. Re:Passing on Viruses by click2005 · · Score: 1

      AVG used to do Linux AV products.

      --
      I am a free slashdotter. I will not be modded, blogged, DRM'd, patented, podcasted or RFID'd. My life is my own.
    21. Re:Passing on Viruses by click2005 · · Score: 1

      You can set Postfix to pass incoming mail through something like Amavis before its sorted that will do spam/AV checks allowing Postfix to reject/bounce it.

      --
      I am a free slashdotter. I will not be modded, blogged, DRM'd, patented, podcasted or RFID'd. My life is my own.
    22. Re:Passing on Viruses by Midnight+Thunder · · Score: 1

      Do antivirus software only deal with viruses or do they also deal with other sort of malware such as Trojans and worms? While Linux hasn't experienced any viruses, I don't think it is immune to the other two. There are also other malware to watch out for, such as macro viruses in word documents.

      --
      Jumpstart the tartan drive.
    23. Re:Passing on Viruses by HungryHobo · · Score: 5, Informative

      Pretty much hit the nail on the head.

      Polymorphic and Metamorphic viruses already exist and it's been proven mathematically that detecting such code is NP-complete.
      (Spinellis, Diomidis; Reliable identification of bounded-length viruses is NP-complete, IEEE Transactions on Information Theory, 49(1):280â"284, January 2003. doi:10.1109/TIT.2002.806137)

      http://en.wikipedia.org/wiki/Polymorphic_code
      http://en.wikipedia.org/wiki/Metamorphic_code

      The scanners are so bad at detecting viruses because it's an example of Enumerating Badness which is one of the 6 dumbest ideas in security which just won't die.

      http://www.ranum.com/security/computer_security/editorials/dumb/

      Rather than trying to keep track of the few thousand or tens of thousands of things that should be running on your own network and white-listing those you either try to keep track of everything bad in the world or pay someone else to. Then you try to blacklist those.
      Thus you get an antivirus scanner.

    24. Re:Passing on Viruses by DarkXale · · Score: 1

      They're used to mainly deal with Trojans, and on rare occasion worms and other malware of similar type. Actual viruses are practically extinct.

    25. Re:Passing on Viruses by Anonymous Coward · · Score: 2, Insightful

      I take exception to:

      Linux users and Mac users could accidentally infect a Windows user.

      More accurately: "Linux users and Mac users could accidentally pass on a file that infects an ill-prepared Windows user."

      Mac and Linux users don't infect Windows users. Windows users let themselves become compromised.

    26. Re:Passing on Viruses by PhunkySchtuff · · Score: 1

      A computer can still pass on a virus even if it cannot directly infect you. It might not be your responsibility but will a child know this? If he forwards an attachment unwittingly or something?

      Linux users and Mac users could accidentally infect a Windows user.

      Exacty. This is when I deploy mail servers on Macs, for Mac clients, they all have anti-virus enabled.
      The good ol' macro viruses have also reared their head on Macs as well...

      Whether or not Macs and Linux machines can or can not get viruses, it's a policy decision - it's easier to mandate that ALL computers MUST have antivirus, not just some of them.

    27. Re:Passing on Viruses by guruevi · · Score: 2

      Mac OS X has a built-in antivirus for the few Mac OS X virusses that actually exist and work, proof is in a patch a little while ago where the signatures got updated. This keeps the overhead to a minimum. Linux has the same thing going on - if a virus exploits the kernel, the kernel gets patched quickly and the virus is no longer a threat.

      --
      Custom electronics and digital signage for your business: www.evcircuits.com
    28. Re:Passing on Viruses by Compaqt · · Score: 1

      No, this was most certainly not a troll. I'm setting up email, and I'm amazed at the complexity. I'm certainly learning a lot, including about A records, MX records, Postfix, etc.

      Thanks for the mention of iRedMail; I hadn't known about it previously.

      One thing I'm antsy about is: SQL injection.

      Larger Postfix installations have their users in MySQL, accessed via configurable SQL query. So what if some smart-aleck sends mail to some version of:

      RCPT TO:

      Anybody know if Postfix does proper SQL quoting?

      --
      I'm not a lawyer, but I play one on the Internet. Blog
    29. Re:Passing on Viruses by Svartalf · · Score: 1

      Anti-Virus is like trying to close the barn door after the horses have left the same...

      It's a reactive answer to the real problem- which is more that Windows is insecure by design than anything else. Security takes a big back seat to "ease of use" amongst other things.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    30. Re:Passing on Viruses by Svartalf · · Score: 1

      Heh... And it'll never catch ANY of the new stuff...by definition. They're not doing proactive security in the normal sense- they're looking for signature sets within the files being scanned. And, since it's not like the Tripwire stuff which monitors inappropriate changes to the system, it doesn't do nearly as much as you're attributing to it.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    31. Re:Passing on Viruses by Eggplant62 · · Score: 1

      Tell me, how does that macro virus get run? Word macros in documents opened in LibreOffice don't autorun. If anyone is stupid enough to enable this ability out of the box, they get what they asked for, right?

    32. Re:Passing on Viruses by Compaqt · · Score: 2

      Well, I'm not up-to-date on the latest in Windows malware, but let's say you get a custom-crafted PDF that does "blah" in Acrobat on Windows. You read the PDF. You're unaffected in Linux. You forward it to your Windows colleague.

      He is now affected.

      --
      I'm not a lawyer, but I play one on the Internet. Blog
    33. Re:Passing on Viruses by Straterra · · Score: 1

      Except that most servers should be running an LTS release of their favorite distro. Sometimes, it can take a while for the fix to be backported. Just because the problem is fixed in the latest kernel doesn't mean it's no longer a threat, as very few people run the latest kernel as soon as its released. Finally, kernel level threats happen from time to time but the bread and butter of compromising Linux are the applications running on it. Surely people remember the old sendmail fiasco, or have heard of someone who hasn't configured their file system permissions properly and get rooted via a badly written PHP app...

    34. Re:Passing on Viruses by Anonymous Coward · · Score: 3, Funny

      Linux users fled to the hills six months ago with as much fuel, food and porn as they could carry.

      Not only that, but in that six months, they've managed to find 6 completely different methods to cure the zombie virus, all of which are tied up in arguments over:
      1) how stupid the name sounds
      or
      2) how "free" the license is.

    35. Re:Passing on Viruses by wed128 · · Score: 1

      I used to in the dark ages, when i was using windows 98....

      since moving to linux I've only reformatted once in about 9 years, when i moved from Slackware to Ubuntu...

    36. Re:Passing on Viruses by cavreader · · Score: 1

      I doubt that Windows is "insecure by design". People making this claim have the ability look at security issues in hindsight not foresight. As fast as people work to build secure software systems there are those who work just as hard to break them and breaking something is always easier than building something. There are compromises made every day by the people building software just as there are compromises being made for all types of product development. "ease of use" is not a small consideration. Cost and time to market are also significant factors. Software design and imlementation takes place on top of a rapidly changing landscape. Things that were considered good last year can be considered obsolete today. If you want a totally 100% secure software system be prepared to wait about 20+ years before the first release. That is how long MS, Apple, and even open software developers have been working on this problem and I have yet to see any OS that can be considered 100% secure.

    37. Re:Passing on Viruses by DrgnDancer · · Score: 1

      Wouldn't it make more sense to catch it early on a platform that can't be infected?

      --
      I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
    38. Re:Passing on Viruses by Penguinisto · · Score: 1

      Barracuda sells that, packaged as a separate appliance (among lots of other folks...)

      --
      Quo usque tandem abutere, Nimbus, patientia nostra?
    39. Re:Passing on Viruses by BlortHorc · · Score: 1

      Do have it set up to receive mail from Postfix, and then pass it on to Dovecot for distribution?

      Or does ClamAV get a crack at mail first before Postfix?

      Is there a way to scan an email as you're receiving it, and then stop in the middle of the process, making it look like you have a bad SMTP server, which hopefully spammers won't bother with again?

      Oh, and, are you running Amavis, and SpamAssasin, too?

      Short answer: Postfix is awesome

      Long answer: You can (and I have) set up postfix with clamav so any emails with virus laden payload is rejected at initial delivery time, and no, this is not having a bad SMTP server, a "550 - rejecting email containing a virus" is a perfectly cromulent response. And FWIW, you will get much better results using postgrey, clamav and DSPAM than you will ever get with amavis and spamassassin. Plus you can hook clamav in to the DSPAM queue, keeps your postfix configuration clean.

    40. Re:Passing on Viruses by Smurf · · Score: 1

      [...] i never encountered anything totally new that wasn't detected by anything.

      That's quite a tautology (in the Mathematical sense). If you had encountered something, then it would have been because one of the AV's detected it. That is, no antivirus will find a virus that it can't find.

    41. Re:Passing on Viruses by Mouldy · · Score: 2

      Wikipedia lists more than a couple linux viruses.

      I don't know where you got the notion of me being on the "*nix is just as vulnerable as Windows" bandwagon, at no point did I say anything along those lines. Anybody who assumes that *nix platforms have no native viruses aside from rootkits is utterly naive. Yes, *nix viruses aren't as widespread as their Windows counterparts, but they do exist, they can cause significant damage and *nix platforms are not inherently immune.

      It would be relatively simple to write a script that would send itself to everybody in a user's address book and then execute "rm -fr /" with root permissions without even having to exploit some hole in the kernel or whatever. Never underestimate the end user's stupidity. A lot of Ubuntu (for example) newbies don't really understand why many operations prompt them for a password and a malicious script could abuse this by posing as something harmless but ask for root permissions. Many desktop Linux newbies are the same people that turn of Windows' UAC prompts because they're annoying.

      An OS can be as secure as you want on paper, but no OS is 100% secure if it's got any human interaction.

    42. Re:Passing on Viruses by rrohbeck · · Score: 1

      So the solution is simple: Run *all* AV packages on every Windows machine.

    43. Re:Passing on Viruses by lee1 · · Score: 1

      "Our products just aren't engineered for security."
      -- Brian Valentine, senior vice-president in charge of Microsoft's Windows development.

    44. Re:Passing on Viruses by Gumbercules!! · · Score: 1

      Yes there is.

      As you mention, you can us Amavis & SpamAssassin, etc to scan it and then use postfix to tarpit anything that "fails" the check. This is better than a bad SMTP - it hangs on the connection at the other end, taking up a thread. So it actually slows them down, if they try you.

      You can do this using the smtpd_error_sleep_time settings for Postfix.

    45. Re:Passing on Viruses by UnknowingFool · · Score: 1

      The reason most geeks consider Windows insecure by design has to do with the history of Windows. Windows from the beginning was never designed with security in mind. It was bolted on as PCs were designed mostly to be single user computers. Networking and multiple users came later as MS added them. However, MS maintained some semblance of backwards compatibility. Over the years, MS has hardened Windows but the traces of the original design come through. When Vista was first launched, a good deal of complaints came from the hyperactive UAC asking the user to allow programs to run with administrative permissions. Many of those programs in a Unix/Linux environment would have been designed to run under user and not admin rights. MS however has to redesign the base of Windows to do this. They are doing it but they can't do it overnight without breaking a lot of older programs.

      --
      Well, there's spam egg sausage and spam, that's not got much spam in it.
    46. Re:Passing on Viruses by ePhil_One · · Score: 1

      As many have already figured out, AV is pretty useless.

      It is nowhere near fullproof.

      Not Foolproof != useless

      If you want foolproof, disconnect from the internet, power down, and encase your PC in concrete.

      --
      You are in a maze of twisted little posts, all alike.
    47. Re:Passing on Viruses by mlts · · Score: 1

      Don't forget the AIX admins -- the zombie hordes just ignore them, or moan, "one of us, one of us".

    48. Re:Passing on Viruses by Hatta · · Score: 1

      Huh? I haven't reformatted since around 2004. Just keep moving the same LVM onto bigger media. Honestly, there's no reason to reformat a Linux system, ever. Unless you did something really stupid and got owned.

      --
      Give me Classic Slashdot or give me death!
    49. Re:Passing on Viruses by mspohr · · Score: 2
      I have to admit that I have done this...

      I work in Africa a lot and Windows viruses are everywhere. I always end up with at least one on my memory stick used to pass around documents.

      Since I run Linux, I don't worry about these on my machine and I usually check the memory stick when I get it back and delete the virus files to prevent passing them on. However, it did happen at least once (that I know) where I didn't check the memory stick and another Windows machine did pop up a virus warning.

      I guess it is my responsibility to clean up Windows viruses but I'm not sure. I'm beginning to think that people who run Windows should take responsibility for their own computer health (the easiest way is to just don't run Windows).

      --
      I don't read your sig. Why are you reading mine?
    50. Re:Passing on Viruses by brainfsck · · Score: 2

      "In my experience, Mac users are even more irresponsible then clueless Windows users. They think they are magically protected, which means they will ignore obvious signs of infection till the very end."

      Considering I could count the number of Mac "viruses" (Trojan horses) in the wild on one hand, I must wonder: how many data points does your "experience" consist of?

    51. Re:Passing on Viruses by andywebsdale · · Score: 1

      That is how long MS, Apple, and even open software developers have been working on this problem and I have yet to see any OS that can be considered 100% secure.

      VMS is very close, if not 100%, I believe

    52. Re:Passing on Viruses by sexconker · · Score: 1

      You can set Postfix to pass incoming mail through something like Amavis before its sorted that will do spam/AV checks allowing Postfix to reject/bounce it.

      Bouncing spam/infected shit helps nothing.
      Just silently drop it and nullroute the source IP if it's not a known major mail server.

      It's the only way to handle spam.
      When someone complains that granny didn't get those photos of the kids, tell them to fucking clean out the shit on their PC and deal with it.

    53. Re:Passing on Viruses by s73v3r · · Score: 1

      Why would you want to wait until the data hits the Windows box to scan for it? Catch it early, and dispose of it on a machine that isn't susceptible to it.

    54. Re:Passing on Viruses by HiThere · · Score: 1

      I don't know if MSWind is still insecure by design, but it certainly was a decade ago. (Well, a bit over that now.)

      OTOH, Linux has adopted some features which decrease it's security. The main one that I'm aware of is allowing extracted files from tarballs to be automatically marked executable at the time of extraction. Just think for a bit about the can of worms that opens up. It's true that in a secure system the files would only be able to infect the user unpacking the tarball, but for most users it's their own data that they are worried about, and most users only use one user.

      Add to this the problems inherent in the installation of software. And I think nearly everyone installs some software that isn't from a repository. That's an intractably hard problem in and of itself.

      Linux, Unix, etc., however, do act to limit the spread of viruses. But this isn't any real security when the viruses are being spread by e-mail.

      MSWind is (was?) a soft target, but it's sure not the only possible target.

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    55. Re:Passing on Viruses by guruevi · · Score: 1

      But those are hacks, not virusses and usually require quite a bit of intervention and targetting by the perpetrator. If you open a service and don't update your system, you can expect to be hacked by a script kiddie but that's still not a virus. LTS'es are (or should be - I'm looking at you Ubuntu) hardened for server usage and sometimes even run old versions of kernels that have been proven and certain patches are backported and don't even require restarts. Red Hat has by default in their server systems SELinux and other defense mechanisms so that even if your system is exploited the damage remains limited.

      Virusses are self-replicating pieces of software and usually target the core of Operating Systems or other monocultures.

      --
      Custom electronics and digital signage for your business: www.evcircuits.com
    56. Re:Passing on Viruses by Khan+Fused · · Score: 1

      There's always one of those uber prepared 'I'll lead you out of this' guys in every zombie movie.

      Doesn't he usually get killed at the last moment, either because he valiantly sacrifices himself so the hero & heroine can get to safety -- or he lets his guard down just once and the zombies bust out through the wall and go *MUNCH!!* ?

      --
      This mind intentionally left blank.
    57. Re:Passing on Viruses by stewbacca · · Score: 1

      But it is insecure by design. By letting anyone/everyone write software for your platform, you are creating an insecure platform by design. The tradeoff being you garner a 90% market share because you have the most developers.

    58. Re:Passing on Viruses by Bucky24 · · Score: 1

      Anybody know if Postfix does proper SQL quoting?

      I don' t know for sure, but I would certainly hope something as widely used as Postfix would properly sanitize database input.

      --
      All the world's a CPU, and all the men and women merely AI agents
    59. Re:Passing on Viruses by Compaqt · · Score: 1

      An example from the config file:

      query = SELECT forw_addr FROM mxaliases WHERE alias='%s' AND status='paid'

      http://www.postfix.org/MYSQL_README.html

      --
      I'm not a lawyer, but I play one on the Internet. Blog
    60. Re:Passing on Viruses by mr_mischief · · Score: 1

      It should, but you don't have to use MySQL. You can use OpenLDAP just as easily. Hell, you can use OpenLDAP with Perdition, too, so that's a great setup.

    61. Re:Passing on Viruses by oldmac31310 · · Score: 2

      except he doesn't know how to spell 'horde'.

      --
      http://www.acetonestudio.com
    62. Re:Passing on Viruses by cavreader · · Score: 1

      So you should limit the number of people who are authorized or allowed to write programs for your particular OS? Maybe you can create a really secure OS if you disallow all applications except for the ones delivered with the OS. I'm sure we could all get by using notepad or vi for all our text editing needs.

    63. Re:Passing on Viruses by drsmithy · · Score: 1

      It's a reactive answer to the real problem- which is more that Windows is insecure by design than anything else.

      Which parts of the design ? What features and capabilities are lacking ?

    64. Re:Passing on Viruses by drsmithy · · Score: 1

      Windows from the beginning was never designed with security in mind. It was bolted on as PCs were designed mostly to be single user computers. Networking and multiple users came later as MS added them.

      Windows NT (that is to say, every version of Windows released since Me) was designed from the ground up to be a networked, multiuser OS.

      Many of those programs in a Unix/Linux environment would have been designed to run under user and not admin rights. MS however has to redesign the base of Windows to do this.

      No, they don't. Incompetent application developers need to fix their applications. There's no OS-level problem to fix, and in the case of Windows NT, never has been.

      The only thing Microsoft is doing is building layers of redirection and shims to make broken applications work properly.

    65. Re:Passing on Viruses by stewbacca · · Score: 1

      If you want a more secure system, then yes. If you want profit, I'd say no. The thing about that is there are tradeoffs. Somewhere between the Apple walled-garden model and the Microsoft anything goes, devs devs devs, model is a happy medium where maximum profits meet acceptable levels of vulnerability.

      And yes, a really secure OS would be one like you suggest, like the NSA did in the 90s, but has since sold out to corporate interests and gone "commercial off the shelf". The benefit is lower costs and more stuff available, but at (IMHO) an unacceptable risk.

    66. Re:Passing on Viruses by Yunzil · · Score: 1

      "Our products just aren't engineered for security."
      -- Brian Valentine, senior vice-president in charge of Microsoft's Windows development.

      ...in 2002.

    67. Re:Passing on Viruses by lennier · · Score: 1

      It's a reactive answer to the real problem- which is more that Windows is insecure by design than anything else.

      Which parts of the design ? What features and capabilities are lacking ?

      A good question. Windows has a very nice security capability model at the WinNT kernel level, but this model isn't always used at higher-level APIs, rendering it partially useless.

      COM and ActiveX primarily are the worst security culprits, I think, allowing "documents" you'd think would be passive data (like Word Docs or HTML pages) to embed arbitrary executable services, but also the Win32 subsystem takes a lot of hits by basing things on the old DOS filesystem model and then trying to add security over the top. A culture of write-access required to root of C:\ for installers, going back to the DOS era (restricted now in Win 7, but the legacy remains). A windowing model where any running process can (I think) access any open window and insert keystrokes or mouseclicks if it merely knows the window name.

      Any others?

      --
      You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
    68. Re:Passing on Viruses by cstacy · · Score: 1

      In my experience, Mac users are even more irresponsible then clueless Windows users. They think they are magically protected, which means they will ignore obvious signs of infection till the very end.

      Can you please elaborate and share your experience of Mac users who were infected by a virus, but ignored it until the "very end"? What was the virus, and what were the symptoms they ignored, and what happened in "the very end"?

    69. Re:Passing on Viruses by Lennie · · Score: 1

      The problem is, many people act like it is a fullproof solution.

      And the other reason why I mentioned it, because the problem is getting worse.

      --
      New things are always on the horizon
    70. Re:Passing on Viruses by cavreader · · Score: 1

      All I want is useful tools and I dont really give a shit where they come from. One of MIcorsoft's greatest products was VB. I know it was a poor development platform but it did help them expand the number of Windows developers. This in turn resulted in more people using other Microsoft products such as the OS, Exchange, SQL Server, and a whole host of others. They still provide developers with good tools today. If you want a secure OS just unplug from the internet, do not allow access to any network resources outside the company intranet, disable thumb drives and any other portable sources of data, disable attachments from incoming e-mail, and run extensive background checks on everyone who will be using this system.

    71. Re:Passing on Viruses by dwightk · · Score: 1

      It's not that great an analogy.

      Zombies indiscriminately target humans and are able to infect them all, at least in all the zombie stories I've heard of.

      --
      Like anyone can even know that
    72. Re:Passing on Viruses by mjwx · · Score: 1

      "In my experience, Mac users are even more irresponsible then clueless Windows users. They think they are magically protected, which means they will ignore obvious signs of infection till the very end."

      Considering I could count the number of Mac "viruses" (Trojan horses) in the wild on one hand, I must wonder: how many data points does your "experience" consist of?

      Considering there's over 30 on Trend Micro's site alone, you must have some freakishly mishapen hand.

      Secondly, Mac's are vunlerable to the same kind of threats as Windows (and Linux) as well as using the same infection vector, the user.

      Now when presented with a trojan hidden within free porn or screensavers et al. both the Mac user and Windows user will install it. The critical difference is that the Windows user, when told they are infected believes it and takes action. The Mac user does not. This makes them more irresponsible, not to mention that they are more likely to ignore potentially infected programs because they beleive they are magically protected.

      And my experience comes from almost 4 years of Mac OS X support. Even outnumbered 10 to 1 by Windows XP machines I spent more time fixing PEBKAC issues with Mac users and this was before the days of OS X crimeware kits. Not to mention the pain of trying to get it to use a network printer. Glad I'm out of that company.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    73. Re:Passing on Viruses by mjwx · · Score: 1

      Zombies indiscriminately target humans and are able to infect them all, at least in all the zombie stories I've heard of.

      Congratulations you got the point. Malware writers don't care about the ol' Mac v Windows flame war, they just want malware on as many machines as possible.

      With the new Crimeware kit for OS X, the cost v returns ratio for Mac's just got a lot lower.

      The user is the most common cause on infection, any sysadmin or half retarded tech support flunkie could tell you that or to carry on with my Zombie analogy, you don't just get infected by accident, you let the Zombie bite you.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    74. Re:Passing on Viruses by mjwx · · Score: 1

      In my experience, Mac users are even more irresponsible then clueless Windows users. They think they are magically protected, which means they will ignore obvious signs of infection till the very end.

      Can you please elaborate and share your experience of Mac users who were infected by a virus, but ignored it until the "very end"? What was the virus, and what were the symptoms they ignored, and what happened in "the very end"?

      Yep, the infected pirated iLife that was around a few years back. The user abjectly refused to admit there was any problem with his Mac. Not that he should have been installing pirated software on a work machine (he didn't get iLife because he didn't need it to do his job) and this wasn't the only problem. He still refused to admit there was an issue when it Kernel Paniced in front of the two of us (this is how I knew the trojan wasn't the only issue, it didn't cause a KP).

      As I was the tech and charged with fixing those infernal machines (I was the most junior tech, no-one wanted the job so I got "volunteered"), I simply re-imaged it, anything else would have taken too long to do. Even installing a Firey driver was a 3 hour ordeal to get it working properly, even then the users complained. In 12 months the Mac count went from 8 to 3 because we were spending too much money (read: my time isn't free) fixing Mac's.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    75. Re:Passing on Viruses by dwightk · · Score: 1

      It isn't that great an analogy.

      Zombies are able to infect anyone they can bite.

      The analogy would be more apt if only albino zombies could infect the mac users.

      --
      Like anyone can even know that
    76. Re:Passing on Viruses by virg_mattes · · Score: 1

      Are you really having difficulty seeing what you did there? You said, "They think they are magically protected, which means they will ignore obvious signs of infection till the very end." Then, when called on it you described one guy who installed infected software and refused to admit it caused a problem. Do you truly believe that your leading statement can be extended reasonably from this one guy to every Mac user (or even a good portion of them)? Do you really think that this guy would be any better if he'd been a Windows or Linux user?

      On top of that, you yourself say that the Mac users got the most junior tech because nobody higher up the chain wanted the job, and then assumed that because you had a difficult time supporting the machines, that another tech who was more familiar (and might actually have enjoyed working with Macs) would have had the same problems. It sounds a lot like your Mac users got crap support and bailed on the platform because of it. I'd have given up too if the only support I could get was a bottom-tier tech who didn't even like the machine.

      Point of note: the only Apple computer I ever owned (A Powerbook that was given to me) ran Linux. I'm definitely not an Apple fanboi by any stretch.

      Virg

    77. Re:Passing on Viruses by ToasterMonkey · · Score: 1

      Linux users should not have a problem with AV. Even if they are smart enough not to need it. Linux users already think with a security focused mind, as an effect using Linux in lieu of a AV client is laziness on our part (granted, we can recognise an infected machine, so we can afford a bit of laziness).

      I'm sorry, but you have absolutely nothing to back this up with. A lot of geeks use Linux, and most geeks can avoid infection by being careful. That doesn't make automatic binary blacklist/filtering useless, it's just generally not worth it considering the risk. It also doesn't make Linux users more safe than anyone else unless you pretend _ONLY_ geeks will ever be Linux users.

      How can you categorically claim Mac users are irresponsible, then spout this. Which computer safety school do new Linux users go to?

      Lets play a game! Here, have a thousand new Linux users from the education sector. OK, I'll play bad guy, GO!

      Click here for free math worksheet printer for Linux
      1000 low cost science experiments.pdf
      This document may not open automatically under Linux, in that event you will have to change the association by running chmod a+x *, then double clicking the file.
      Free icon pack for Linux
      Microsoft Office for Linux
      Make your Linux computer look like your old Windows one.pl
      Porn

    78. Re:Passing on Viruses by Eggplant62 · · Score: 1

      That's my problem how? He should be running his own antivirus software on his easily-infected Windows system, right? I'll simply carry on and live without the fear of viruses and without paying the antivirus protection cartel.

    79. Re:Passing on Viruses by Compaqt · · Score: 1

      >That's my problem how?

      If you're part of a company, the company pays for the computing resources. It will ensure that an antivirus is running on your machine.

      If you're an independent contractor (graphic artist, consultant, whatever), you definitely don't want to pass on a virus to a client--Business 101.

      I wouldn't pass a virus on to a vendor if you want your work done on time, or if you don't want every address in your vendor's addressbook (including yours) to be spammed.

      --
      I'm not a lawyer, but I play one on the Internet. Blog
  3. Last Resort by iYk6 · · Score: 3, Insightful

    Anti-virus is a security last resort. If you've already downloaded or executed malware, then anti-virus might prevent it from running, or might be able to remove it if it already has. But it can't detect everything. It can only detect common malware. Linux doesn't have any common malware, and I'm not sure about Mac. There is clamav, but that's mostly detecting Windows viruses across platforms.

    1. Re:Last Resort by atomicstrawberry · · Score: 1

      There's more OSX and Linux malware out there than you might think. Especially OSX. When it comes to Linux I'd imagine that that is mainly for servers, where being able to e.g. natively run a sweep over all those shared directories that your staff are using to cache their files, or scanning incoming mail on your mail server or the like would be advantageous.

    2. Re:Last Resort by ozmanjusri · · Score: 1

      There's more OSX and Linux malware out there than you might think.

      Examples?

      --
      "I've got more toys than Teruhisa Kitahara."
    3. Re:Last Resort by Compaqt · · Score: 1

      Even though that might be true, I think they want to scan all email to prevent viruses being passed around to Windows users, say from a Linux user whom it doesn't affect.

      --
      I'm not a lawyer, but I play one on the Internet. Blog
    4. Re:Last Resort by Ihmhi · · Score: 3, Funny

      Linux was created by the finest minds of the last thousand years - truly, men among men. They jacked their brains into the cyberspace, navigating neon green 3-D cities and running their own virtual construction company for ten years to build the Linux kernel. Only after it was finished did they convert it to more mundane code so that the lesser men of the world may bask in its glory.

      I don't know what's more disheartening, the fact that someone believes they can create a virus that can melt cyberspace steel, or the fact that there are companies that are scamming their customers with unnecessary products~!

    5. Re:Last Resort by timholman · · Score: 2, Insightful

      There's more OSX and Linux malware out there than you might think. Especially OSX.

      One of the Windows users I work with says the same thing. Like you, he can't provide any examples either.

      And if you're talking about those instances of trojans that rely on social engineering, what anti-virus program can defend against a user who willingly types in an administrative password and installs the malware on his own?

    6. Re:Last Resort by Bert64 · · Score: 4, Informative

      Traditional rootkits exist for most unix systems, although they typically do not spread on their own - someone has to manually root your system and install them. There are even tools dedicated to finding/removing unix rootkits, eg http://www.rootkit.nl/projects/rootkit_hunter.html has a long list of rootkits it knows about.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    7. Re:Last Resort by michelcolman · · Score: 2

      Exactly. I bet the same user, if he had an anti-virus app running, would disable it to be able to run the malware.

    8. Re:Last Resort by mjwx · · Score: 2

      There's more OSX and Linux malware out there than you might think.

      Examples?

      Here you go.

      As always, the most common infection vector is the user. This gets worse when a user refuses to recognise they can be infected.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    9. Re:Last Resort by mjwx · · Score: 2, Insightful

      There's more OSX and Linux malware out there than you might think. Especially OSX.

      One of the Windows users I work with says the same thing. Like you, he can't provide any examples either.

      And if you're talking about those instances of trojans that rely on social engineering, what anti-virus program can defend against a user who willingly types in an administrative password and installs the malware on his own?

      Well if we are excluding those...

      There's 90% of Windows malware wiped out. The user is, always has been and will always be the biggest source of infection. Even in the Windows world and especially today when a patched Win 7 and Office suite aren't vulnerable to drive by infections.

      I love how Mac fanboys need to move the goal posts to justify their positions. But here you go anyway.

      http://about-threats.trendmicro.com/Search.aspx?language=us&p=OSX

      No doubt you have some wonderfully convenient excuse to ignore this.

      Have fun.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    10. Re:Last Resort by jimicus · · Score: 1

      If you look at the latest threats for Windows, probably 70% of them are trojans of some sort.

      Looking at Symantec's website, the remainder are all variants on the exact same application - VirusDoctor. So the true percentage of trojans (as opposed to viruses) is probably much higher than 70%.

    11. Re:Last Resort by fuzzyfuzzyfungus · · Score: 5, Interesting

      Anti-virus is a security last resort. If you've already downloaded or executed malware, then anti-virus might prevent it from running, or might be able to remove it if it already has. But it can't detect everything. It can only detect common malware. Linux doesn't have any common malware, and I'm not sure about Mac. There is clamav, but that's mostly detecting Windows viruses across platforms.

      One additional advantage(in institutional setups, home users are screwed) is that the presence of AV requires the designers of viruses to make a choice: Either you attempt to lay low, and take the risk that a future update of the AV package will detect your virus, or you go all cyber-AIDS on the system and attempt to throw a spanner in the AV system or its update mechanism. In the latter case, the client generally stops responding to the AV management server, which throws up a major red flag. At that point, you either pull the system aside for a more detailed chat, or nuke it, depending on your priorities.

      It's like trying to scare off ninjas by deploying mall cops. The mall cops are hopelessly outmatched; but they will, on occasion, stumble across a ninja, which forces the ninjas to either passively risk detection or actively start killing the mall cops, which alerts you to their presence.

    12. Re:Last Resort by AtomicJake · · Score: 4, Informative

      Anti-virus is a security last resort. If you've already downloaded or executed malware, then anti-virus might prevent it from running, or might be able to remove it if it already has. But it can't detect everything. It can only detect common malware.

      This is too true. On our Windows machines is a self-updating AV installed. From time to time it deletes an email with a virus (or suspicious) attachment - we would never opened it in any case (you know those lame emails, where you can smell the virus already in the subject line). Nevertheless, over ten years in corporation, we had two outbreaks: one was the slammer worm brought in from an executive with a laptop and a bad firewall config (in the Windows 2000 days), the other was a very well crafted social engineered email with a PDF attachment that was not yet known by the AV. So, in both cases, the AV did not help and I assume that all the other viruses would not have the chance to run either, since the humans would not execute them (opening rotten attachments).

      On the other hand the AV got multiple times in the way of the business by disabling remote login software, network analyzers, etc.

      I think that it make sense to have an AV software on the email server to filter all those typical attacks, but I am not convinced about the need of an AV on each desktop, laptop etc. It makes sense to have AN AV to test each downloaded file or USB stick when connected, but to have it always running might be overkill.

      And, btw: we also had Linux machines, which were successfully attacked. However, those were network attacks against security holes in Internet servers. Maybe an intrusion detection system would have helped, but clearly not a typical anti-virus.

    13. Re:Last Resort by blackchiney · · Score: 1

      If this is the future of debate I'm really really disappointed.

      Hey when someone asks you to back your argument with citations the answer isn't, "do your own fucking research!"

    14. Re:Last Resort by John+Betonschaar · · Score: 2

      Wow, no less then *FOURTY-EIGHT* OS X 'threats', some of which are 'proof of concept' malware and almost all others are simply Trojans or scripts that do absolutely nothing unless you start and authorize them yourself.

      I guess I can still sleep at night without a virus scanner...

    15. Re:Last Resort by John+Betonschaar · · Score: 4, Insightful

      There's 90% of Windows malware wiped out. The user is, always has been and will always be the biggest source of infection. Even in the Windows world and especially today when a patched Win 7 and Office suite aren't vulnerable to drive by infections.

      What does Windows have to do with anything, the statement was that there's "more OS X and Linux malware around then you might expect", which (at least to me) implies that this amount of malware is substantial enough to care about.

      I love how Mac fanboys need to move the goal posts to justify their positions. But here you go anyway

      Great, ram your point across by throwing stereotypes around, that's really going to help your argument /s

      No doubt you have some wonderfully convenient excuse to ignore this.

      No wonderfully convenient "excuse" is necessary here, because your 'list of OS X threats' is laughable and does nothing but disproving your own argument. In 10 years of OS X history, apparently only 43 pieces of malware have been identified, most of which are Trojans, which -in your own words- depend on the user as 'the biggest source of infection', and for which antivirus software completely unnecessary. If anything, that list proves that OS X is more or less immune to viruses and malware, and that a fully patched OS X install does not need antivirus, just common sense.

      From your own signature:

      Calling someone a "hater" only means you can not rationally rebut their argument.

      And what does calling someone a 'Mac fanboy' make you?

    16. Re:Last Resort by kolicha · · Score: 2

      I know it is a marking post, but it does include some examples of Mac malware:

      http://nakedsecurity.sophos.com/2010/11/02/anti-virus-mac-free/

      – Websites that pose as legitimate-looking software vendor's sites, but whose downloads are really Mac malicious code.
      – Malware disguised as pirated software available for download from P2P file-sharing networks.
      – Sexy online video links that urge you to install a plug-in to view the content, but really infect your computer with a Mac Trojan horse.
      – Popular Twitter accounts, such as that belonging to former Apple evangelist Guy Kawasaki, who have tweeted out links to websites designed to infect Mac computers.

      It doesn't prove it is common, but it does prove it is out there.

    17. Re:Last Resort by LoganDzwon · · Score: 2

      Ok, I'll bite. Of the 43 listed, 11 are for Windows, leaving 32 for mac. (13 unique.) I broke then up into groups. phishing; *OSX_JAHLAV.A-M is a tojen that requies a user to download a DMG, install it with an admin password. It then changes the DNS to send to you phishing sites. It is listed 15 times as TM's list puts a seporate entry for each minor variation of the same malware. *OSX_DNSCHAN.A is also malware masqurating as a video codec. It changes your DNS settings to hosts which are quickly shutdown. It is the same virus as OSX_RSPLUG.A and UNIX_DNSCHAN.A . It is listed 6 times on the list because TM counts each slight variant as a new virus. backdoors; *OSX_MUSMINIM.A is a backoriface type backdoor. It requries the user to type in their admin password to install. a simple firewall renderes it ineffective. *OSX_LAMZEV.A is a backdoor that arrives via trojen. A firewall negates any ability. *OSX_KROWI.A is a backdoor that was built into pirated version of iWork09. dead; *OSX_LEAP.A only infects non-up-to-date 10.4 (current is 10.6, 10.7 is due out soon.) *OSX_INQTANA.A only infects non-up-to-date 10.4 (current is 10.6, 10.7 is due out soon.) *OSX_MACARENA.A is a non-propagating proof-of-concept. does not work on any version OS X with all pathces applied. junkware; *OSX_IMUNIZATOR.A is a varient of OSX_MACSWEEP.A . It is an application the user must run. It tells the user it found malware and offers to sell them junk to remove it. Concidering a simple banner pop-up is just as dangerous I don't really think it's fair to count this. worms; *OSX_TORED.D a true worm, speads via e-mails. Only infects non-up-to-date systems. games; *OSX_LOSEGAM.A a game that has to be downloaded and ran by the user. It is a game where wrong moves delete random files on the system.

    18. Re:Last Resort by science_gone_bad · · Score: 2

      There's more OSX and Linux malware out there than you might think. Especially OSX.

      One of the Windows users I work with says the same thing. Like you, he can't provide any examples either.

      And if you're talking about those instances of trojans that rely on social engineering, what anti-virus program can defend against a user who willingly types in an administrative password and installs the malware on his own?

      I've installed/used various commercial AV products on both OSX and Linux. The last was Symantec AV. While I was wondering why my OSX machine ground to a halt (72hrs to scan 100,000 files???), I looked at the signature file for the product. Out of 190,000 definitions, only 3 were Mac related. All or them were pre 1995 (The CD Worm, ABv, etc.). Absolutely none of the things being scanned for would run on anything later than Mac OS8, and I haven't run MS Office or other MS products for 10 years. Needless to say, that product was ripped out real fast.

      The Linux version of Symantec was loading as a kernel level java process, and we were developing in java. Within 2 seconds of launching another java process, the kernel would hard-lock. The only way around that was to power off the machine. Nothing else would respond.

      So, the results are:
      No protection
      No usage of the machine while it runs (I guess that means it's protected since NOBODY can use it)
      No satisfaction
      No longer used!!

      --
      "I never get lost because everybody tells me where to go"
    19. Re:Last Resort by RogerWilco · · Score: 2

      This is more insightful then one would think a post about ninjas could be.

      --
      RogerWilco the Adventurous Janitor
    20. Re:Last Resort by SanityInAnarchy · · Score: 3, Interesting

      It's like trying to scare off ninjas by deploying mall cops. The mall cops are hopelessly outmatched; but they will, on occasion, stumble across a ninja, which forces the ninjas to either passively risk detection or actively start killing the mall cops, which alerts you to their presence.

      That is a beautiful analogy, and you deserve a +5 for that alone.

      Still...

      Wouldn't a ninja be able to take the mall cops out one at a time, hide the body, steal the uniform, and pretend to be a mall cop, thus avoiding alerting anyone to their presence? That seems like the obvious solution -- completely take over the AV system, continue receiving updates, but rather than implement them, send them back to your botnet's command-and-control so the botnet operator can stay one step ahead.

      --
      Don't thank God, thank a doctor!
    21. Re:Last Resort by Tom · · Score: 2

      but I am not convinced about the need of an AV on each desktop, laptop etc.

      There are several papers out there describing malware spreading in corporate networks (full disclaimer: I wrote one of them). I'll give you a hint towards why you want AV on each and every machine: Because once your perimeter has been penetrated, the worst-case scenario for a well-crafted malware to infect your entire corporate network is measured in seconds. Give it the usual caveats because the worst-case scenario rarely happens in the real world, but even if you give it two orders of magnitude - can you contain an actively spreading infection in a few minutes?

      So, what's going to be cheaper (in a corporate context, everything boils down to money in the end)? The moderate cost of keeping AV installed and updated on all machines, or the cost of rebuilding the entire windows network - servers, clients, notebooks, everything? Oh, after taking down everything and putting the network into quarantine to make sure no infected devices remain? Do you even know how to do that or will you have to figure it out while doing it? How much downtime are we talking about here? Days or weeks? If you said anything with "hours", you are kidding yourself big time.

      Do the usual math: Sum up the best-, worst- and likely-scenario costs, multiply by a rough guess of chance of it happening per year and compare that to doing the usual AV routine. Oh, and don't forget to ask the CTO, CIO or CEO if he's willign to sign off on that risk. I'm very sure you'll have a signature on your AV purchase form long before you're halfway through the list of direct impacts for the other scenario.

      Because that's the other ugly truth about corporations: Someone has to make the decision, and the bigger your company is, the more risk-averse it usually is. Most importantly, human and also manager (for those of you who don't include PHBs in the "human" category) minds are famously bad at estimating unlikely, but dramatic risks, especially in regards to more probable but smaller risks.(*)
      So you will almost always get a moderate expense to prevent an unlikely, but catastrophic signed off easier than getting someone to sign off on the risk. If you have formal sign-off procedures. Just ignoring the risk by not doing something about it happens frequently and is a lot easier than accepting the risk, and totally not the same thing.

      (*) Which is one reason why many more people are afraid of flying than of driving, even though the chance to die in a car crash is about 1:6000 while the chance to die in a plane crash is about 1:1000000 (both per year, source).

      --
      Assorted stuff I do sometimes: Lemuria.org
    22. Re:Last Resort by darkgrayknight · · Score: 1

      +1 ninja analogy

    23. Re:Last Resort by chargersfan420 · · Score: 1

      +1 to Best Analogy Ever!

    24. Re:Last Resort by ShadowFoxx · · Score: 1

      So your saying because it's less targeted, I shouldn't use it? That's like saying because I have a lower sperm cell count I don't have to use condems. By your reasoning I shouldn't have to use NIDS HIDS either if I'm running off of a linux server... oh wait most things run on the net off of a unix based system( I'm lumping OSX and Linux together as they are a branch off of unix). But you won't find 1 company that has ANY IT security NOT running these things. Your internet servers... not running windows... still using security... and thier security people would be fired if they weren't as they should be. Yes, less targeted because lower home user market share... but still targeted and thus still require protection for a smart user. Think of it like this. Soft targets are the targets that get hit. If you don't protect yourself... you stand a higher risk of being exploited. OSX, Linux, Unix, Windows all need 3rd party detection, signature, hueristics, anomoly/behavior based... it's all needed. I know YOUR specifically talking signature based but there are many forms of AV out there ( I just pointed them out). Sorry I'm a security guy by proffession and I think you as a user should be informed.

    25. Re:Last Resort by andywebsdale · · Score: 1

      Most home users(& many small business users) of Windows run as an Admin level user ALL the time probably because "normal user" permissions are too strict by default(& too fiddly to overcome for them), so most users become Admin. This magnifies any security issue hugely

    26. Re:Last Resort by 99BottlesOfBeerInMyF · · Score: 1

      If you look at the latest threats for Windows, probably 70% of them are trojans of some sort.

      It is also less than useful to assess threats based upon the number of malware titles of different types, rather than the number of infections caused by different types. For example, self propagating worms have fewer unique names than trojans do, but account for a much larger number of infections per name. When last I looked, self propagating worms still accounted for about half of all infections.

    27. Re:Last Resort by Angostura · · Score: 1

      FWIW, I run the free Sophos product on my Mac, partly because I have rather high regard for Sophos, partly because it adhere's to the hypocratic oath and 'does no harm' in that it appears to soak up very few system resources.

      And you never know - one day it may find something.

    28. Re:Last Resort by penguinchris · · Score: 1

      Your scenario is absurd, because ninjas are small and fit, and mall cops aren't. Mall cops might not have tailor-made uniforms, but they are usually not baggy and it would still be noticeable if a ninja wore the uniform of someone twice his size.

    29. Re:Last Resort by ItsJustAPseudonym · · Score: 1

      I think you would find that the "uniform" (AKA the authentication to the server) is complicated, and hard to steal or fake. Otherwise, I love this analogy.

    30. Re:Last Resort by http · · Score: 1

      I followed over 30 of those 43 links before I admitted to myself that there was a pattern that wasn't breaking. Every one is either a trojan requiring user action, or was dowloaded and installed by an already running trojan. Oh, and two of them (inqtana.b, dmgdos.) are not actually for OS X.
      So that wipes out pretty close to 101% of OS X malware.
      Mac fanbois aren't moving the goalposts, they're playing a different game.

      --
      If opportunity came disguised as temptation, one knock would be enough.
      3^2 * 67^1 * 977^1
    31. Re:Last Resort by drsmithy · · Score: 2

      And if you're talking about those instances of trojans that rely on social engineering, what anti-virus program can defend against a user who willingly types in an administrative password and installs the malware on his own?

      Er, that's pretty much the whole *point* of AV software - the last ditch effort to protect the user trying to shoot himself in the foot.

      A massive proportion of malware uses the trojan horse model. The reason we have AV software at all, is because OS-level security can't defend against ignorant users with administrative privileges.

    32. Re:Last Resort by mjwx · · Score: 1

      No wonderfully convenient "excuse" is necessary here, because your 'list of OS X threats' is laughable

      Like I said, Mac users find wonderful excuses not to take threats seriously, but other people are.

      http://apple.slashdot.org/story/11/05/02/2120203/OS-X-Crimeware-Kit-Emerges

      Cant wait for you to tell me this isn't real.

      Have fun.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    33. Re:Last Resort by mjwx · · Score: 1

      Wow, no less then *FOURTY-EIGHT* OS X 'threats', some of which are 'proof of concept' malware and almost all others are simply Trojans or scripts that do absolutely nothing unless you start and authorize them yourself.

      I guess I can still sleep at night without a virus scanner...

      If you look at the cross section of modern Windows Malware you'll find the same thing, user installed keyloggers and spambots.

      The user is the, has always been and will always be the biggest infection vector. Mac users are worse because like you, they refuse to take the risk of infection seriously.

      http://apple.slashdot.org/story/11/05/02/2120203/OS-X-Crimeware-Kit-Emerges

      At least someone is taking the threat of malware on OS X seriously. Unfortunately for you it's the wrong someone.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    34. Re:Last Resort by AtomicJake · · Score: 1

      There are several papers out there describing malware spreading in corporate networks (full disclaimer: I wrote one of them). I'll give you a hint towards why you want AV on each and every machine: Because once your perimeter has been penetrated, the worst-case scenario for a well-crafted malware to infect your entire corporate network is measured in seconds.

      I agree with you in principle. But as I said in my original posting: A full outbreak happened in our corporate environment despite the existence of AV on all desktops. I doubt that it would had happened multiple more times, if we had no AV at all (but who knows for sure?). So, AV on all machines cannot prevent outbreaks of well crafted worms and viruses. My math: AV costs money and might not stop outbreaks. Your math: AV costs money and may stop outbreaks.

      Which math do you apply for non Windows machines? Which one is the more economic model over time?

    35. Re:Last Resort by Tom · · Score: 1

      Correct: AV is not 100% safe

      Our math is not different. "might not stop outbreaks" and "may stop outbreaks" is really the same thing - the realization that the probability of stopping an outbreak is somewhere between 0.0 and 1.0

      So the math is the same. Multiply cost of bad things happening times probability of it happening. Compare with cost of bad things happening times probability of it happening with countermeasures plus cost of countermeasures.

      There is no seperate math for non-windows machines. You don't do risk analysis per machine, you do it for the entire company.

      The more economic model depends on your input data. If, for example, your cost of rebuilding a machine is negliegable, then AV might not be economical. Or it could simply be that you have more important threats to cover and your limited budget goes entirely towards those.

      --
      Assorted stuff I do sometimes: Lemuria.org
  4. AV software is not only for your own safety... by Mattsson · · Score: 4, Insightful

    If you exchange documents and files with other users, having anti-virus and anti-malware software or not is not only an issue for your own protection.
    Even if you run on a system that you believe to be safe from those kinds of infections, you might spread it to other users if you ever pass on files that you get from others.
    This might not be of any importance to you personally, but in a large organization it might be of vital importance that malicious software can't "hide" in unprotected systems of other flavours that it was designed for.

    --
    /.Mattsson - My native language is not English, so please don't whine over linguistic errors. (That's lame anyway...)
    1. Re:AV software is not only for your own safety... by Anonymous Coward · · Score: 1

      Antivirus is like a condom. Even if you would be the rare and lucky prostitute having HIV resistance (a non-Windows user) you might pass the little fucker to the next customer (Windows user) with passing fluids. Even the dynamics of an std infection is probably similar to a computer virus infection; the most popular and well connected people and computers get and pass most infections.

  5. Whassa problem? by macraig · · Score: 2

    I run Windows and I still don't use that stuff... I'm totally open source - err, open-minded - and I don't mind sharing my computer with a botnet and my credit card with poor Russkis, Nigerians, and Chinamen. All for one and one for all, I say!

    1. Re:Whassa problem? by J.J.+Dane · · Score: 4, Funny

      Well, if some friendly Russian kindly allows me to download an Adobe suite or a new game from his website it's only polite that I let him use my box to send a few e-mails or whatever when I'm not using it

  6. Pretty standard, really. by ThoughtMonster · · Score: 1

    There already exist both commercial and non-commercial anti-virus applications that run on Linux (Wikipedia has a list) which mainly target Windows viruses passing through corporate networks. Some anti-virus solutions target native viruses (virii?), but most are quickly obsoleted via updates anyways. I suspect this is what the Dept. of Education is asking for, and it's not unreasonable.

    1. Re:Pretty standard, really. by Hognoxious · · Score: 2

      I suspect this is what the Dept. of Education is asking for, and it's not unreasonable.

      They want the same solution to run on all platforms. That's as reasonable as wanting the same tyre to fit a bike and a bus.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    2. Re:Pretty standard, really. by Sique · · Score: 1

      Some anti-virus solutions target native viruses (virii?), but most are quickly obsoleted via updates anyways.

      There is no latin plural of virus (it's a singularitantum meaning slime or poison), so you can make up your own.

      --
      .sig: Sique *sigh*
    3. Re:Pretty standard, really. by Black+Parrot · · Score: 1

      I suspect this is what the Dept. of Education is asking for, and it's not unreasonable.

      They want the same solution to run on all platforms. That's as reasonable as wanting the same tyre to fit a bike and a bus.

      Shouldn't be any more a problem than other cross-platform software.

      The biggest issue is whether this solicitation motivates anyone to develop it.

      --
      Sheesh, evil *and* a jerk. -- Jade
    4. Re:Pretty standard, really. by st0nes · · Score: 1

      There is no latin plural of virus (it's a singularitantum meaning slime or poison), so you can make up your own.

      Since we're writing in English, follow the English convention of adding an 's' to the end of the word (or, since virus already ends in 's', add 'es'). Viruses. Simple.

      --
      Tempora mutantur, nos et mutamur in illis
  7. Clam AV by BoogeyOfTheMan · · Score: 2

    I use clamav. I'm currently running a dual boot setup with Win7, but its only used for gaming (once a month or so) and for a few programs that I've only gotten to run without a hiccup in windows. Since I dont use it all that often, I also dont update it all that often, so having an AV run from outside the OS seems like its not a bad idea.

    1. Re:Clam AV by pixline · · Score: 2

      MS Security Essentials won't install on a non-genuine machine, take it into account :-) Seriously: what's wrong with Clam AV and some decent network setup? It just works for everyone with no budget at all, will work for them too....

  8. cross platform virus scanner for linux and mac by Gunstick · · Score: 5, Funny

    #!/bin/sh
    echo "stating scan..."
    n=`find / -type f | wc -l`
    echo "scan completed of $n files"
    exit 0

    --
    Atari rules... ermm... ruled.
    1. Re:cross platform virus scanner for linux and mac by O'Nazareth · · Score: 5, Informative

      I wish to file a bug report: you count multiple times files with several hard links.

    2. Re:cross platform virus scanner for linux and mac by ControlFreal · · Score: 1

      As stated: it artificially embiggens the number of scanned files by counting hard links multiple times, but that is perfectly cromulent.

      --
      Support a Europe-related section on Slashdot!
    3. Re:cross platform virus scanner for linux and mac by Anonymous Coward · · Score: 2, Informative

      # ./antivirus.exe
      Segmentation fault

      "Your honor, I ran the required anti-virus program, and it didn't detect any viruses."

    4. Re:cross platform virus scanner for linux and mac by Delgul · · Score: 5, Funny

      For manager types you need to include "Your computer is safe" somewhere along the line ;-)

    5. Re:cross platform virus scanner for linux and mac by martin-boundary · · Score: 5, Funny

      That's normal behaviour, sir. Those are harder files to scan, which is why they must be scanned multiple times. Have a good day.

    6. Re:cross platform virus scanner for linux and mac by michelcolman · · Score: 1

      No, "stating" is better: malware authors always leave some intentional typos to tip off the intelligent users (those who might cause trouble for them later, and in any case would not be running the malware for a long time). They only want to attack dumb people, which makes sense.

      At least, that's my theory to explain the staggering amount of errors in pretty much all malware e-mails and websites I have seen so far.

    7. Re:cross platform virus scanner for linux and mac by AnonymousDot · · Score: 2

      What, there is no [Like] button on Slashdot?

    8. Re:cross platform virus scanner for linux and mac by internettoughguy · · Score: 1

      Why is there no dislike button on facebook?

    9. Re:cross platform virus scanner for linux and mac by internettoughguy · · Score: 1

      Maybe a less elaborate theory would be that English is often a second language for malware authors? Or woosh for me?

    10. Re:cross platform virus scanner for linux and mac by michelcolman · · Score: 1

      I'm not sure myself ;-)

      I have many similar theories about other things, reaching a conclusion as the only possible explanation because otherwise too much stupidity/uneducatedness would be involved. But I'm fully aware that that doesn't make those theories true. I'm sort of between kind and sarcastic :-)

      It's beyond me how someone could go through the trouble of trying to impersonate a company, copying its letterhead, logo and visual style (which takes a decent amount of intelligent effort), but then make several accidental typos in the actual e-mail that even a Microsoft spelling checker would have caught. Surely, if you were about to commit this kind of crime, you would try to make sure you got it right?

    11. Re:cross platform virus scanner for linux and mac by sgt+scrub · · Score: 1

      echo `echo "$(date) Your computer is safe."` >> /etc/bash.bashrc

      --
      Having to work for a living is the root of all evil.
  9. Users need security software more than OS. by Barryke · · Score: 1

    But have we reached the stage were Mac OS X and Linux even need third-party security software? It seems like most Mac and Linux users don't run it.

    In todays world it is not a matter of whether the OS requires it, its more and more a matter whether the User/Admin requires it.

    --
    Hivemind harvest in progress..
  10. prophecy by greenfruitsalad · · Score: 5, Insightful

    1 group will claim GNU/Linux doesn't need anti virus software.
    2nd group will claim they use antivirus on their GNU/Linux already, but only to clean emails destined for MS Windows machines or to look after their Samba exported storage.
    3rd group will say GNU/Linux needs AV software because it's only a matter of time before viruses (virii?) appear.
    4th group will say viruses for GNU/Linux already exist and provide links to some sensationalist articles on the interwebs where researchers published some concepts.
    5th group (partially composed of group 1 and 2) will claim they're not real viruses, but worms/snakes/butterflies/etc...
    6th group will claim the threat aren't viruses but PPAs in ubuntu.
    3rd/4th group will return saying it's all about users and not the OS. And because they're careful users, they've never in their life needed AV on their MS Windows.
    Does that about cover that? Let the holy war begin...

    1. Re:prophecy by slackbheep · · Score: 1

      What about those of us who decide not to use Windows AV for their recreation boxes and accept getting cornholed every five to ten years as a learning experience? (Last time for me was Sasser unless rage has blocked out a more recent experience)

    2. Re:prophecy by mwvdlee · · Score: 1

      Stages 4 and beyond will never be reached as stage 3 will re-ignite the flamewar about the plural form of "virus" (I vote for "viren").

      --
      Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
    3. Re:prophecy by luther349 · · Score: 1

      and dispite your list av softwhere is avable for linux. so if they whant it they can have it the story is dumb. and most anyone in the linux world will agree on a server system av is nedded not so mutch to protect linux but the windows machines that connect to it.

    4. Re:prophecy by Archangel+Michael · · Score: 1

      but worms/snakes/butterflies/etc..

      I knew it. Emacs is a virus!

      http://xkcd.com/378/

      --
      Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
    5. Re:prophecy by zvar · · Score: 1

      I vote for "viren"

      You just like that one as it's almost a vixen. :)

    6. Re:prophecy by Phrogman · · Score: 1

      I have to speak up in support of resurrecting old forms of the English language plural, "Viren" sounds good to me as well. :P

      --
      "The first time I got drunk, I got married. The second time I bought a chimpanzee, after that I stayed sober" Arian Seid
  11. Of Course by batwingTM · · Score: 1

    Well, does a Mac or Linux require Anti Virus?

    Let me ask you a question, do you hand out your credit card number to anyone who asks? Of course you don't because you have some common sense and realise that some people would take that information and use it for malicious purposes. Mac's and Linux can be compromised, of course, there are not as often targeted as if you are going to write a virus/malware you will pick the most popular platform, but if you are a Mac/Linux user and you don't run AV or expect that your OS is 'immune' then you are part of the problem.

    ALL users should run AntiVirus, or at the very least, be aware of the security of their systems, regardless of what platform they are running as their OS. If putting a AV package on Mac/Linux educates users that you should ensure that your system is secure, then absolutely.

    --
    Leg Godt!
    1. Re:Of Course by sydneyfong · · Score: 1, Insightful

      You must work in IT support.

      My personal experience is:

      #1. For a technically sane, and security aware user, most antivirus software only exists to make the system hog slow.

      #2. Antivirus software is used as a placebo to make users feel they are safer. If anything, I suspect it would make users feel less responsible for their own actions because some AV software is supposedly protecting them.

      #3. How is a Linux user supposed to run AV? With WINE? I know there is clamav, but it's not intended for those "active monitoring/scanning" things you have on Windows. Maybe the "shell script" placebo* will work equally well at "educating users" if that's what you want. No point in making a system slow.

      * http://apple.slashdot.org/comments.pl?sid=2119134&cid=35997968

      --
      Don't quote me on this.
    2. Re:Of Course by mjwx · · Score: 4, Informative

      You must work in IT support.

      My personal experience is:

      #1. For a technically sane, and security aware user, most antivirus software only exists to make the system hog slow.

      #2. Antivirus software is used as a placebo to make users feel they are safer. If anything, I suspect it would make users feel less responsible for their own actions because some AV software is supposedly protecting them.

      #3. How is a Linux user supposed to run AV? With WINE? I know there is clamav, but it's not intended for those "active monitoring/scanning" things you have on Windows. Maybe the "shell script" placebo* will work equally well at "educating users" if that's what you want. No point in making a system slow.

      * http://apple.slashdot.org/comments.pl?sid=2119134&cid=35997968

      You must work in sales, because you have no experience in the real world.

      #1. Actual, technical users understand that AV is important, they just recognise the signs of infection as well as any AV does and will take steps when they detect them. For us, AV clients are just a way to be lazy.

      #2. Just because AV will not protect against some 0-days does not make it useless. It's a method of protecting against old threats which are still quite prevalent thanks to people who dont use or ignore AV. Not to mention that many viruses are simply minor variations of old ones, the W32.Foo.F virus looks quite similar to W32.Foo.E.

      #3. Umm... You do know that there are a variety of Linux clients out there. Clam AV, Trend Micro, AVG, Kaspersky and others have clients. Any AV vendor in the Enterprise space has a client as Enterprises use Linux servers quite a bit. Do a google search for "Linux Anti Virus" before launching on an ill informed rant.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    3. Re:Of Course by batwingTM · · Score: 1

      hehe, well spotted. I used to work in IT support, moved into IT education... Sadly the technical knowledge of the users doesn't change that much between the two.

      Linux, I don't really know, I don't have a lot of experience with it. Mac and Windows, I have a LOT of experience with, and let's be honest, the way Mac/Linux deal with programs running is a lot more secure than the way Windows does, but when the core of your system is a tried and true mature system, you will get that.

      But in my experience I know a lot of people with Mac's who don't have any AV or idea about security because "it's immune" 6 months later when they have bogged their system down with crap I like to remind them of that.

      Yes, AV is a band-aid approach, but it is not an invalid approach in any way, shape or form. Sure there are products out there that are WOEFUL and bog the system down for no perceivable benefit, but there are some that simply provide the ability to check files for viruses, scan email attachments and the like and can be taken out of the system when they are not required.

      You shouldn't require a AV package to run all the time, and I fully agree with point #1. but sadly, they are a very small percentage of the computer using populace. Linux is an interesting case because to use the system effectively you have to have some idea of such things, Mac on the other hand does not have the same hurdle to overcome, and there are some real idiots out there, and with the advent of visualisation the lines between OSes are crossable (that is files can be passed between OSes and two layers of protection are better than one) but there will always be a price to pay, and system performance is sometimes that price.

      And let me say this, I work with in the Victorian education sector in Australia, and I cannot imagine that the Tasmanian department is that different from us, given that, then damn straight they will need AV protection across all platforms.

      --
      Leg Godt!
    4. Re:Of Course by Svartalf · · Score: 2

      Just because AV will not protect against ALL 0-days does make it nearly useless.

      Fixed that for you. If it's a 0-day exploit, typically nobody knows about the virus that uses it execpt the jokers that wrote it. Seriously. That's why it's called a 0-day in the first place. That means it won't find the thing for you- ever.

      It's a method of protecting against old threats which are still quite prevalent thanks to people who dont use or ignore AV. Not to mention that many viruses are simply minor variations of old ones, the W32.Foo.F virus looks quite similar to W32.Foo.E.

      Considering that patching for the holes is a better answer than relying on a signature scan for things...simply put, no. It's less useful than you're making it out to be. It's like closing the barn door after all your horses have went on a walkabout on you. The virus writers have gotten clever, by the way- they don't make easy to flag out a Foo.F from the Foo.E anymore. If you've gotten zapped by an "old" virus like that would get caught out this way, it means you either haven't updated the system or your OS vendor didn't fix the hole like they claimed they did.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    5. Re:Of Course by batwingTM · · Score: 2

      #1. Actual, technical users understand that AV is important, they just recognise the signs of infection as well as any AV does and will take steps when they detect them. For us, AV clients are just a way to be lazy.

      You know, in relation to that point, back in 1999 the most effective Virus detection software I had was "Need For Speed 3: Hot Pursuit". Back in the days of the rapidly spreading Win.CIH virus as soon as that got into my system it would end up in that executable (because I used it so often I guess) and that would cause the game to hang. When that occurred it was time to break out the trusty command line removal tool.

      --
      Leg Godt!
    6. Re:Of Course by BSsci.Daemonology · · Score: 1

      Frisk software's F-prot AV runs on BSD/Linux/Windows.

    7. Re:Of Course by the_one(2) · · Score: 1

      Just because AV will not protect against ANY 0-days does make it nearly useless.

      Fixed that for you. If it's a 0-day exploit, typically nobody knows about the virus that uses it execpt the jokers that wrote it.

      Fixed that for you:)

  12. Probably just a policy problem by Blade · · Score: 4, Insightful

    This is probably just a policy issue. "We've put your AIX / HP-UX / Solaris server in". "What AV does it run?" "Er, it's running AIX / HP-UX / Solaris , we've not installed AV". "But our policy says we have to use product X or product Y to AV protect all our servers". "Yes, but you're not understan....." "Just install AV".

    1. Re:Probably just a policy problem by thegarbz · · Score: 1

      Policy or just good design?

      So your HP-UX server acts as a Samba file server, wouldn't it be nice to be able to catch windows viruses that one rogue computer may pass onto the network? Given how many viruses spread via file sharing inside a corporate network it could isolate an otherwise crippling breakout. Stuxnet for instance spread this way at our work. Turns out by the time they shut down all file servers some 30 people had managed to locally infect their PCs by opening files from the file server which was not infected, but merely carrying the infection.

      Also claiming that Linux / Unix doesn't need antivirus is security by obscurity. Just because your system is obscure doesn't mean someone won't try and exploit it. Just because your operating system is secure doesn't mean someone won't exploit its biggest weakness ... the user.

    2. Re:Probably just a policy problem by Blade · · Score: 1

      Policy.

      In corporate environments (of the ones I have experience) people don't pay for UNIX hardware and run files-ervers on it with SAMBA. That's why I picked AIX / HP-UX and Solaris, not Linux.

      My point was that policy makers don't understand the underlying OS and simply say 'we must have AV' without considering the applications running on those machines.

      When my Oracle DB or DB2 instance gets infected with HappySmilieFacev02 I'll change my mind. Policy should be appropriate and not simply blanket coverage, because that leads to as many problems as it solves.

    3. Re:Probably just a policy problem by Stray7Xi · · Score: 1

      Just use chkrootkit or rkhunter as "AV" for servers.

    4. Re:Probably just a policy problem by MarkTina · · Score: 1

      And you are letting him down majorly because of your lack of a spine / balls.

      ... says the "Anonymous coward" ;-)

  13. Re:Of course it's not needed. by Anonymous Coward · · Score: 2, Informative

    Just don't do stupid things.

    The average user doesn't know what's stupid and what is not.

    To some extent, AV software is good for inexperienced users. Unfortunately most of these AV pograms have "evolved" to a point where they've become more of a burden than help. That's a real problem if you have to churn out a new-and-improved version every year.

  14. What's the news? by Anonymous Coward · · Score: 1
    I work in big IT company and the company policy requires all workstations to have antivirus software. For me it means having symantec running on my linux installation. I've been lucky and not having much of problems with it. It's just there consuming CPU time and every now and then doing a full scan of my HD.

    Useful? No, but it looks good in IT policy.

    1. Re:What's the news? by cHALiTO · · Score: 1

      You work at IBM? we had Symantec AV running on the ubuntu image when I worked there. I guess that could be a good solution for these people, they seem to be looking for that kind of corporate 'I-feel-safer-and-dont-mind-to-pay" av solution.

      --
      "Luck is my middle name," said Rincewind, indistinctly. "Mind you, my first name is Bad." -- Terry Pratchett
  15. Stupid things involve surfing the net by Anonymous Coward · · Score: 1

    I surf the net and some of the pages aren't exactly the most innocent of pages. I experienced some times that viruses were able to exploit back-doors into my system. It's not often, but it happens. Even with firewalls, system and anti-virus updated there are things that sneak past the defenses. Needless to say, I run Windows. If I were to not surf the web and only be connected to the web for a brief amount of time I would not need anti-virus. But, as I said. I do need it. I actually ran without anti-virus software for a long time, but I stopped after my broadband-computer with 10 Mbit went into zombie-mode.

  16. ClamAV/Immunet by mendred · · Score: 1

    http://www.clamav.net/ Used this around 5 years back when I was in Uni. I recommended it for the university mail server whch was running linux. Worked pretty well..the number of malware on email dropped to zero in a day..not sure about its effectiveness in the modern day but it is a cross platform with the windows equivalent being immunet (runs the same engine)

  17. No problem - can stop MS malware via linux by dbIII · · Score: 1

    F-prot and a long list of others have linux versions. It's useful for email gateways and I've got a spare licence to use the antivirus with knoppix to do malware removal on the laptops that come in with various infections (although a full wipe and reinstall is the only way to be sure).
    It really depends upon whether they want software which CAN run on the platform or whether they actually want it deployed on every desktop. There is actual merit in one or two per site - if nothing else they can scan incoming material or network disks for Microsoft compatible malware even if there is no need to actually protect the computers doing the scanning against such incompatible malware.
    Deploying it to the entire lot would be the same old story of somebody out of their depth making the choices before anybody with a clue working for them can properly inform them. Tasmania is the lowest population state of Australia do I don't know where the "largest" bit in the summary came from.

  18. Re:Not quite by Chuq · · Score: 1

    How many other organisations in Australia have 40000 workstations or more? Probably the other state education departments (assuming they purchase centrally), a handful of large corporates... maybe a few more, but not a huge amount.

    --
    - Chuq
  19. linux systems have lots... by johnjones · · Score: 1

    every major vendor has a linux version for MTA's

    have a look at a mavisd.conf

  20. Re:Tasmanian Devil? by dbIII · · Score: 1

    The tasmanian devils have a strange communicable cancer that is spread by them biting each others faces. It's an appropriately surreal disease for such creatures that bite things a lot but unfortunately it is driving them towards extinction.
    So yes, maybe a virus is too scared of the things and it takes the big C to take them down.

  21. Re:Largest purchasers? by Chuq · · Score: 1

    State Education departments typically have large IT fleets due to all the computers in every classroom in every school. RTFA.

    --
    - Chuq
  22. You can't by bmo · · Score: 5, Informative

    http://technet.microsoft.com/en-us/library/cc512587.aspx

    >>You can't clean a compromised system by patching it.

    >>You can't clean a compromised system by removing the back doors.

    >>You can't clean a compromised system by using some "vulnerability remover."

    >>You can't clean a compromised system by using a virus scanner.

    >>You can't clean a compromised system by reinstalling the operating system over the existing installation.

    >>You can't trust any data copied from a compromised system.

    >>You can't trust the event logs on a compromised system.

    >>You may not be able to trust your latest backup.

    >>>>>The only way to clean a compromised system is to flatten and rebuild.

    Jesper M. Johansson, Ph.D. [YES, HE'S A DOCTOR], CISSP, MCSE, MCP+I

    Security Program Manager
    Microsoft Corporation

    1. Re:You can't by freedumb2000 · · Score: 2

      The only thing a positive scan tells me, is that it is time to rebuild which is a pain in the ass and I have skimped on it before.

    2. Re:You can't by Pascal+Sartoretti · · Score: 1
      A very brilliant article, however :

      You can't clean a compromised system by using a virus scanner.

      Theoretically, it should be possible to boot the system from an other OS (say, a rescue Linux on an USB media) and then clean the system.

      The only way to clean a compromised system is to flatten and rebuild.

      And if the system was compromised at BIOS level ? Any possibility that even a rebuild could be fooled ?

    3. Re:You can't by jimicus · · Score: 2

      Which is why you don't run AV on a compromised machine. You boot from a rescue CD such as that provided by Avira or F-Secure.

      Even that's not a perfect solution, of course, because it assumes your scanner can detect secondary vulnerabilities injected by the infection itself - or that no such vulnerability exists. Both of which seem rather optimistic assumptions. Ideally you'd have some sort of boot CD that can run checksums against every file on the system - but by the time you get to this point, it's probably several times quicker to rebuild the system.

    4. Re:You can't by internettoughguy · · Score: 2

      >Jesper M. Johansson, Ph.D. [YES, HE'S A DOCTOR], CISSP, MCSE, MCP+I

      Even more impressively, he's A MICROSOFT CERTIFIED PROFESSIONAL ;).

    5. Re:You can't by noesckey · · Score: 1

      >You can't trust any data copied from a compromised system.

      >You may not be able to trust your latest backup.

      If compromised machine's data is no longer trustworthy, and backups of that machine may not be trustworthy, then what happens when a server in the cloud gets compromised?

    6. Re:You can't by Gumbercules!! · · Score: 1

      I've met Jesper on 3 occassions and he is brilliant. In fact, I first met him back a few years before this article but I met him again on his 2004 road show with MS and he single handedly changed the way I view IT security, through his compelling arguments and his charisma. Before that time, I was pretty much a "default permit" mindset kind of guy, using AV and the like and not thinking about it - only a few years into IT.

      Now I think about security first, when I design anything and am more than happy to tell a client straight out what the result is going to be, if they want to play it the other way around.

      I really recommend listening to him talk about IT security any chance you get. He's passionate about the topic, interesting to listen to, quite funny and he knows his stuff.

      He also had some interesting tales about his time advising MS on the initial release of XP and how the security team got utterly bulldozed by the marketing team's instistance on meeting shipping deadlines. He was very open about the fact that they released it knowing that the firewall service started after the network service (i.e. allowing worms free access to the computer during boot up, as the firewall service started almost last and the network service very early) - but no one outside the security team seemed to care. Come XPSP2 and all the bad press - the security team got a veto on the release date and a seat at the decision table and things turned out differently.

    7. Re:You can't by cultiv8 · · Score: 1

      Gives insight into what Sony is up to these days.

      --
      sysadmins and parents of newborns get the same amount of sleep.
  23. anti virus for mac by Anonymous Coward · · Score: 1

    Since I started using mac os X I immediately purchased and anti virus solution.
    After some comparison I got Karspersky and I must admit that it has done a pretty good job till now.
    The possibility to detect and remove malware before it spreads further to my co-workers is an important factor in my decision to use an antivirus sw on a platform considered "secure" by default. (if it really is so, I amn't here to judge; although my personal opinion is that no system is really secure and that not using an antivirus due to advertisement from apple or linux opinion groups is worst than silly, it's dangerous).

  24. We must run antivirus software on linux and mac by elucido · · Score: 1

    To protect the Windows computers on the network. But also to protect the Linux computers from Linux specific malware and virus attacks.

  25. Every classroom? by dbIII · · Score: 2

    These are government schools. They don't have the money to waste putting computers on every desk when the students are not going to be using them in every lesson. They have rooms with computers in them and timetables to organise who can use them and when - there is no need to have one computer per student. That makes many large companies in Australia larger users of desktop computers than the education department of a low population state such as Tasmania. There would be more students in just about any city in the USA.

    1. Re:Every classroom? by Chuq · · Score: 1

      I used to work in Tasmanian Government schools. Every primary classroom had minimum 2-3 computers, and obviously high schools had a lot more with dedicated IT labs, etc. This was 10 years ago, obviously things have changed since then. Anyway, my experiences 10 years ago don't really matter when the article itself gives the number as 40000 desktops.

      Some other stats on employee numbers (from Wikipedia):

      Federal Government departments - The largest federal government agency is Centrelink with 27,312 employees, followed by the Australian Taxation Office (24,070) and the Department of Defence (21,458). http://www.apsc.gov.au/stateoftheservice/0910/statistics/bulletin.pdf

      Banks - NAB 39k, Westpac ~40k, CBA ~44k, ANZ ~40k

      Can't be bothered with any more at the moment, but if you want to make the claims, back them up!

      --
      - Chuq
    2. Re:Every classroom? by dbIII · · Score: 1

      OK then - you do know more about this than I do.
      40k still seems unrealistic though so I wonder where the journo got it from.

    3. Re:Every classroom? by thedarknite · · Score: 1

      Except there was an article last year about the DoD tendering for thin-clients for some of their 75,000 user base. Those are the staffing numbers of actual public servants, which don't include staff employed via external agencies or on a contractual basis.

      --
      A game has objectives and is competitive, anything else is just play
  26. Lets bash the sensible goverment! by djsmiley · · Score: 2, Insightful

    Wait, so we bash the govement for using windows, for using faulty antivirus software, for not using any antivirus software, for not using open source, for spending too much......

    Now we bash them for asking for something SENSIBLE? Just because most linux/os x users dont run it doesn't mean its s a good idea -> Most windows users don't run antivirus software and use I.E. 6......

    Now... if they want one. ClamAV does both linux and windows, not sure about OS X though.

    --
    - http://www.milkme.co.uk
    1. Re:Lets bash the sensible goverment! by jimicus · · Score: 1

      ClamAV is somewhat less than ideal on a number of levels:

      1. It doesn't do realtime scanning.
      2. It doesn't have any sort of centralised management. When you're dealing with this many systems, you want a central list of what systems are up-to-date with their definitions and a way to force systems that are out of date to get an update. This is something you get with commercial AV products aimed at businesses; it is invariably missing on free products.

    2. Re:Lets bash the sensible goverment! by antdude · · Score: 1

      ClamAV does have a Mac OS X port. I have used its GUI program before in 10.5.8.

      --
      Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
  27. Re:Of course it's not needed. by Bert64 · · Score: 2

    It's an extra layer to protect a user either from running vulnerable software, or from doing something stupid...

    I've seen many windows systems become infected when the users haven't done stupid things, they were browsing perfectly legitimate sites that just happened to have been hacked and got infected without having to do anything else.

    --
    http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  28. Not just viruses by Kanel · · Score: 1

    Linux and Mac users risk being victims of phishing attacks and foolishly handing out passwords, just like the rest of us. It's been a long time since corporate antivirus was just about stopping malicious software being installed on a computer.

  29. Most of the enterprise options already do this by A+Life+in+Hell · · Score: 1

    At least, both Symantec Antivirus and CA ETrust have honest to god linux and mac os x versions - they both use kernel modules/kexts to do realtime scanning, and actually catch linux threats. Sophos does at least linux too.

    --
    Commodore 64, Loading up the dance floor!
    1. Re:Most of the enterprise options already do this by datapharmer · · Score: 1

      Yes, Sophos has a decent OSX solution. It can catch threats and is the only solution I have found that can properly remove an imap virus from mail.app's folders (most like clamav just delete the message/attachment and then the server resyncs, rinse, repeat). Is it necessary for most OSX users, not really. Is it necessary in business/education - no push safe images instead. But is it available if that is their crazy requirement - yes, it is (and it won't hurt anything and might stop the spread of viruses via email to windows machines too)!

      --
      Get a web developer
  30. Tasmania, hmm ... by udippel · · Score: 1

    I seriously tried to contribute something useful to an earlier thread, no chance.
    Then I was looking for some politically incorrect snide remark about ex-convicts, no chance.

    Here comes my serious take, then: I read TFA, and what I can read into it, with only some interpretation, is that when you buy/install OSX or Linux, you can do so only, when there is a cross-platform AV. If your Windows Anti-Virus also finds the viruses in OSX/Linux.

    For Christ's sake, the question here isn't if OSX/Linux need AV or not. No, greenfruitsalad (http://apple.slashdot.org/comments.pl?sid=2119134&cid=35997984), your arguments all don't apply.
    The hare-brained part of the thing is that OSX/Linux - if they have or can have viruses - will have altogether other exploits than Windows. Where comes the 'cross-platform' into the perspective? I can't see it. The AV-definition for a MTA is cross-platform already (trying to stop any sorts of malware from entering users' mailboxes), to give an example. *-listing is platform-independent as well.

    So what was it, that these people are actually asking?? I don't get it.

  31. Other reasons as well... by mchawi · · Score: 1

    A lot of compliance audits have requirements that are not OS specific and one of them is having anti-virus (among other things). So a lot of large companies just find it easier to have something that supports all their systems so they don't have to get into an argument on every audit.

    Whether it is right or wrong, or a system needs it, isn't the point. Audits can be very expensive and sometimes having those boxes checked can be an easier route to go.

  32. More than just AV by CaptainPuff · · Score: 1

    TFA says they want a multiplatform security solution with more than just AV but also antimalware, URL scanning and probably stuff like page source scanning for malicious JavaScript and the like. A Linux or Mac is less prone to malicious executables for now, but what about later when more show up? Just because they're the minority in the OS market, they're growing in popularity and are beginning to come to the attention of the seedy side of the Internet. A general user with admin rights will blindly enter their username and password to confirm the installation of whatever flashy malware toolbar or cursor icon changer that catches their eye, regardless of what OS they're running.* Also, phishing email and websites are fairly OS agnostic and users will enter their bank or credit card info onto fakebank.com's website if given a chance. A URL scanner/blocker that is centrally managed can help minimise the impact of common known phishing sites and also help in targeted phishing attacks customized to the organisation - common ones like email from support@yourschool.blah saying something like "due to a failed mail server maintenance we require you to login and reset your mail credentials here at website blah". Just because you have Mac or Linux users doesn't mean they're immune to social hacking. Speaking of central management, having all your endpoints reporting security information back to one central product makes security easier to mange for you as an IT admin. If you can cleanup infections on Windows remotely, that's great. But now you get reporting of whether Macs and Linux computers are receiving infected files an clean them before they're passed on to Windows computers. Plus, these security suites may also include a host based firewall program so now you can control that in the same console as well regardless of OS. Additionally, due to laws or regulations such as privacy laws or PCI compliance or whatever, some computers might be handling personally identifiable information (student numbers, addresses, birthdates, grades, etc.) and Data Loss Prevention mechanisms must be in place and auditable. Plus do you really want to set a separate new central mangement and reporting solution for all this stuff for every OS? Having worked with several of industry leading solutions I'm not sure if any of them are really fully cross platform - that is to say, not all the functionality that is available on the Windows platform is available on other operating systems, but if you want vendors to sit up and take Mac and Linux on the desktop seriously then movements like these are needed; saying that for my organisation, Mac and Linux are just as important as Windows and if you want my business you, as a vendor, need to support them equally. We should be praising that the Tamanian Dept of Education is promoting minority operating systems to be taken seriously. *I know that the solution is not to give them admin access but Windows is very secure if locked down properly as well. Also since this is the education sector, the IT group probably isn't given the mandate to lock down computers anyways so users very likely have admin rights. Also being the education sector, there are probably multiple IT groups in lots of geographical areas and most are probably under resourced and underfunded.

    1. Re:More than just AV by luther349 · · Score: 1

      linux has full av softwhere like avast. that does many if not all the same things the windows counterpart does.

  33. For those outside of Australia... by andr00oo · · Score: 1

    The OP might have been stretching the truth:

    > One of Australia's largest government technology buyers, the Tasmanian Department of Education

    With a population of 507K (10% less than Wyoming), Tasmania is not quite top tier in the Government Departments department.

    Andrew

    1. Re:For those outside of Australia... by Chuq · · Score: 1

      RTFA. 40000 desktops, 1000 servers. See my other posts in this thread.

      I don't get the obsession with people running to point that "No, look, it's Tasmania! It can't be right.. because its Tasmania".

      --
      - Chuq
  34. Sad by magamiako1 · · Score: 1

    This scene on Slashdot is sad. It's funny how people on here say "Antiviruses are useless." and "Linux does't need an antivirus."

    Antiviruses are but one part of a defense-in-depth system and while aren't the be-all-end-all of security for a user, it is indeed a very useful item. Patching security vulnerabilities doesn't get rid of the trojans/viruses after the fact.

    And it's entirely possible a piece of malware could get on to your system through a zero-day, unless I assume you're running a fully managed SELinux distribution on your desktop, which I doubt.

    1. Re:Sad by ledow · · Score: 1

      Which part of "Patching security vulnerabilities doesn't get rid of the trojans/viruses after the fact" made *you* cringe? You don't get rid of trojans/viruses by using an antivirus (their "cleanup" tools are basically useless) - that's just asking for trouble. You wipe clean and restore from known-good image. If this means in any way that you lose data and/or have to have the machine in question down for more than an hour, you have pretty poor systems.

      Antivirus is a canary - an intrusion detection system for your hard disk. If it spots a known virus on there, it whoops, or dies. Now, some AV "suites" include actual defences, like firewalls etc. but almost all AV - even the heuristic-searching TSR-style read-intercept ones - can only see what's already been put onto your system and is either there or executing. By then it's too late and your machine is compromised and needs to be re-imaged. That's why people say AV are useless.

      When your AV spots something, or keels over and dies because it's been disabled (at least 50% of real-world viruses that I've detected have been because of AV not reporting back because their processes were killed as opposed to them actually DETECTING the virus before it killed them), then it's useful. But that's not a "security" item any more than an IDS. It doesn't STOP anything, it just tells you that it's happened and you need to freeze / analyse / destroy that filesystem image immediately.

      Of course there is nothing perfect in actual security, and that includes alternative operating systems, but AV is just the result of poor thinking - "I know - we'll go through our candidates for FBI/CIA/NSA only once a year and make sure they aren't already known spies / terrorists, that'll give us security!" Once a year, once a month, once a week, once a day - AV is just a checksum against known bad files gathered once-per-update (which isn't guaranteed to list viruses even decades old) and run once-per-scheduled-tasks and (if you can suffer the performance hit) on every file access to an already-written / executing file and a quick browse through the process list once-per-whatever.

      AV is the movie-prison-searchlight of the security world - so long as the virus ducks at the right times and keeps out of its light it can do anything it likes, including breaking the light entirely.

    2. Re:Sad by magamiako1 · · Score: 1

      can only see what's already been put onto your system and is either there or executing. By then it's too late and your machine is compromised and needs to be re-imaged.

      This is kind of the point. You wouldn't even know it was there unless you had some sort of antivirus detection in place.

      I fail to see how anything you've stated has contradicted me. And just because a virus gets on your system doesn't mean all is lost--it could be as simple as clearing out a website directory, or cleaning up a user profile. It vastly depends on the types of vulnerabilities used by that particular piece of malware and what their end goal is.

      I think you're mistakenly assuming that the goal of all trojan/malware authors is to root the system, which while is the case in a lot of instances, it doesn't have to be. I've seen plenty of trojans live within a user's download/temporary internet cache directory and do just that. The only time the viruses want root privileges is because they *can* get it relatively easily, or they want to have better hiding techniques.

      But in the world of "LOL ANTIVIRUSES ARE USELESS!", they really wouldn't need root access.

  35. worms and spam bots by mathfeel · · Score: 4, Interesting

    I was embarrassed recently when the IT department claim a Linux computer in my office was taken over by the Rustock BOT. After checking the ssh log, I realized it was a coworker who uses it for code repository and SOCK5 Proxy as he works abroad from China. He has a compromised Windows machine. To the best of my knowledge, AV doesn't really catch these stuff which are more and more common now a day. Anyone has recommendations?

    --
    The only possible interpretation of any research whatever in the 'social sciences' is: some do, some don't
  36. Any free except for BitDefender? by Mathinker · · Score: 2

    My impression was that BitDefender was the only free live-CD commercial scanner, the other commercial A/V live-CD's are available only for paying customers.

    If I were to upgrade from using only free A/V on my Windows boxes, I would consider paying BitDefender, if only because they are providing such a useful free service to everyone (disclosure: I've paid for Kaspersky in the past).

  37. Re:we have av what is this bs by Anonymous Coward · · Score: 1

    Hey there! I'm just stopping by to make sure you rediscover your drunken ramble in the morning :) Enjoy your hangover, Sir.

  38. Commercially available? by oDDmON+oUT · · Score: 1

    ESET would fill that bill, and in my experience is the only one with a small enough footprint to keep from pissing off Linux and OSX users *having* to use AV.
    http://www.eset.com/us/business/enterprise
    http://www.eset.com/us/business/why-eset

    I don't work them, and am using the product after trying McAfee, and Virus Barrier X on my Mac.

    --
    Some days it's just not worth
    chewing through my restraints.
  39. Re:Factual data on security (Win7 vs. Linux 2.6) by internettoughguy · · Score: 1
  40. Re:Of course it's not needed. by Bert64 · · Score: 1

    This "evolution" is largely down to the commercial development process... You need people to buy new versions, which means you have to add new fancy features to tempt people in, wether those features are needed or not... And then to deprecate the old versions and move people away from them, even if they were perfectly adequate.

    --
    http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  41. Linux malware is abundant by Kanel · · Score: 3

    Android smartphones run on linux.
    Android smartphones are used by office workers and integrated with the company IT system.
    Android smartphones are vulnerable to malicious apps

    Therefore, antivirus or 'anti-malware' for linux is badly needed

  42. Trojans? by Midnight+Thunder · · Score: 1

    OS X and Linux computers are most vulnerable from Trojans, so I am curious to know how well ClamAV deals with those.

    --
    Jumpstart the tartan drive.
    1. Re:Trojans? by Svartalf · · Score: 1

      Since the AV stuff looks for signatures, it won't, by definition, catch a new one until they know about it. The whole concept is pretty damn flawed, really. It's like closing the barn door once the horses have all run off.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    2. Re:Trojans? by BrokenHalo · · Score: 1

      OS X and Linux computers are most vulnerable from Trojans

      ALL computers are vulnerable to trojans, without exception. This is because the weakest link in any computer's security is (or can be) the user.

    3. Re:Trojans? by Midnight+Thunder · · Score: 1

      What I had meant is that Linux and OS X are most likely to be hit by a Trojan, than a virus. As you say the weakest is link is often the user, but also a bad admin.

      --
      Jumpstart the tartan drive.
    4. Re:Trojans? by Midnight+Thunder · · Score: 1

      Certainly, but that isn't any different than its biological counterpart. Sand-boxing can help, but it can't solve all cases.

      --
      Jumpstart the tartan drive.
  43. ClamAV by applematt84 · · Score: 1

    I don't know why they are complaining ... all they need to do to satisfy the bigwigs is to install ClamAV on Mac and GNU/Linux. It's free, reliable and works; unlike other third party anti-virus applications out there (namely, Windows apps).

    1. Re:ClamAV by applematt84 · · Score: 1

      And it's available on Windows. I see a solution right here ... Clam on mail servers, Linux Workstations, Mac Workstations, Windows Workstations ... but no. What it really boils down to is politics. I don't care what anyone has to say about policies or security ... Clam is simple and effective. It's not bloated like other anti-virus applications. It just works.

  44. BSD, obviously by Gothmolly · · Score: 1

    Why isn't Tasmania using BSD? Why go Penguin or Turtleneck when you can go Devil ?

    --
    I want to delete my account but Slashdot doesn't allow it.
  45. Solution by SJ2000 · · Score: 1

    ESET Windows, Mac OSX and Linux support for both desktops and servers.

  46. Doing it wrong by fibonacci8 · · Score: 1
    --
    Inheritance is the sincerest form of nepotism.
  47. M$ supporters are pushing this by mauriceh · · Score: 3, Insightful

    The best way to deflect the idea that it is only Windows that has the basic vulnerability is to ensure that Linux and OSX users are forced to run AV too.
    That way they can claim that the total cost of ownership on these platforms is ( artificially) higher.

    It is also likely a case of the person working that factor then adding support to the lie by persuading his/her colleagues with the classic FUD:
    "What if you omit this, and a virus that attacks these other OS infect us? Do you want the blame?"

    What is actually needed is some education to users about best practices, detection of infections and how to establish a safety and testing regimen.

    --
    Maurice W. Hilarius Voice: (778) 347-9907
  48. They should purchase support from WINE... by Lost+Penguin · · Score: 1

    First they can work on getting viruses to run correctly under WINE, then get WINE support for Windows AV software.

    --
    I am the unwilling control for my Origin.
  49. Not as silly as it sounds by wcrowe · · Score: 2

    We recently went through a PCI audit. The auditor wanted to make sure that we had antivirus software for our IBM System i. At first we thought he was crazy, but we discovered that such software DOES exist. However, it does not work quite the same way as on a Windows machine. The idea is that infected files, transferred from Windows PCs, can still reside on the System i, even though they cannot do any harm to that system. So they still need to be scanned. The same holds true for Linux and OS X machines. Those systems may not be subject to infection from viruses, but they can still store infected files, and these need to be scanned.

    --
    Proverbs 21:19
  50. Anti-virus is largely a scam by Omnifarious · · Score: 1

    I consider that sort of software to be, at best, of extremely dubious usefulness, and at worst, almost as much a negative as having a virus. Why anybody would want to run it is a triumph of marketing over substance.

    I think that things like ClamAV are pretty useful, largely because they do the scanning on something before it even gets close to the target computer. I think that they will still miss the most harmful stuff, but at least they are not operating in an environment that's basically already compromised and not slowing down the user's computer to do it.

    Which makes it all the more amusing (in a cynical, schadenfreude sort of way) that solutions like ClamAV are out of the running. *sigh*

  51. Sophos by acoustix · · Score: 1

    Sophos makes AV for Windows, Mac OS and Linux. AFAIK it's all able to be controlled from the enterprise console package too.

    --
    "A plan fiendishly clever in its intricacies"- Homer Simpson
  52. Keep the lawyers happy by joekrahn · · Score: 1

    Yes, we need anti-virus software, mainly to keep the lawyers happy. Actually, Linux does needs good security monitoring to protect from break-in exploits. The lawyers and businessmen just don't understand the difference between that and anti-virus, so they are sort of right.

  53. a waste of CPU cycles by Thud457 · · Score: 2

    Antivirus scanners provide a false sense of security with no real benefit. We've got pretty nice workstations at my work, but are saddled with McAfee by corporate IT mandate. Which regularly turns them into unresponsive pigs.

    Better to properly lock down user accounts and teach users proper data hygiene. So we can use those resources to accomplish work instead of not-work.

    --

    the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff

    1. Re:a waste of CPU cycles by h4rr4r · · Score: 3, Informative

      teach users proper data hygiene
      Totally impossible. They don't care and you can't make them care.

    2. Re:a waste of CPU cycles by sexconker · · Score: 1

      teach users proper data hygiene
      Totally impossible. They don't care and you can't make them care.

      Totally easy:
      1: Here's not how to be an idiot.
      2: If you're an idiot, you're fired without severance or health benefits.

    3. Re:a waste of CPU cycles by farrellj · · Score: 1

      WRONG!

      Most users are reasonably intelligent and can follow basic rules and procedures... if they are simple and have meaning to the person. Yes, you will always have some major *ssholes and clueless wonders too, but that is just life. We need to stop assuming that all users are totally clueless and can never learn a new thing.

      ttyl
                Farrell

      --
      CAN-CON 2019 - Ottawa's only book oriented Science Fiction Convention! October 18-20, Sheraton Hotel, Ottawa, Canada h
    4. Re:a waste of CPU cycles by stewbacca · · Score: 1

      Agree. The tradeoff is not worth it. The day I have to load my Mac up with a bunch of resource hogging bloated AV software is the day OSX loses its luster for me.

    5. Re:a waste of CPU cycles by stewbacca · · Score: 1

      The problem around these parts is most people on slashdot are so far removed from normal computer users, that they like to make fun of non-power-users and chalk up stuff as "easy" and blame the "totally clueless" user. Then when you look into it, they are expecting the users to do complicated things that aren't meant to be done at the user level. If you are asking your user to go into network settings, for example...stop right there, it's already too hard.

    6. Re:a waste of CPU cycles by mr_mischief · · Score: 2

      Here's the thing many geeks don't get or just forget... the non-geeks often don't WANT to learn about the computer. They want to put in their 40 doing THEIR job and go home. They think that since there's a whole overhead IT department full of people who think about the computers all day that those people should take care of the damn tools so the people earning the company money can continue to do so.

      Just because you like the computer and can teach them doesn't mean they want to learn.

    7. Re:a waste of CPU cycles by frank_adrian314159 · · Score: 1

      2: If you're an idiot, you're fired [a] without severance or [b] health benefits.

      Issue [a] is illegal in some jurisdictions, especially if union employees are involved, and not many Departments of Labor will back you up as firing for cause in this case. Issue [b] is illegal due to IRS finding 2009-27 which allows even people terminated for cause to continue under COBRA coverage. Please don't make HR proclamations without doing your research.

      --
      That is all.
    8. Re:a waste of CPU cycles by Coren22 · · Score: 1

      Virus scanners are pretty good at stopping "drive by" infections. These are so common now that even CNN had one a couple years ago.

      There have also been Mac and Linux Trojan Horse viruses, so it isn't out of the norm to think about security by protecting these machines too.

      I would recommend that you talk to your IT dept about getting a better AV though, McAfee and Norton are terrible and do cause the slowdown of any decent machine.

      --
      APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
    9. Re:a waste of CPU cycles by StikyPad · · Score: 1

      Antivirus scanners provide a false sense of security with no real benefit.

      You started off well, but if A/V didn't have any real benefit, then we wouldn't have immune systems. A/V provides the rather significant benefit of preventing future infections from known attackers. And simply limiting user permissions doesn't magically limit privilege escalation vulnerabilities. Sometimes (often) viruses/trojans/malware which exploit these vulnerabilities are identified before the actual vulnerabilities themselves can be patched, so without A/V, users would be vulnerable during the entire duration of this gap. Plus few people want viruses/malware lurking around on their machines even if the vulnerabilities have been fixed.

    10. Re:a waste of CPU cycles by budgenator · · Score: 1

      I honestly believe that the problem is we who are called computer geeks,are highly orientated toward machines and spacial relations type of cognition and we are highly systematizing. We have build our machines to suit our cognitive style and because of that the average person will never have our degree of computer fluency.

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
    11. Re:a waste of CPU cycles by stewbacca · · Score: 1

      Yeah, but no matter your computer literacy or cognitive preferences, you should always possess the skill of understanding other people outside the constraints of your own preferences and experiences.

    12. Re:a waste of CPU cycles by badkarmadayaccount · · Score: 1

      My friend here, Yuri, with the metal pipe can be quite persuasive.

      --
      I know tobacco is bad for you, so I smoke weed with crack.
    13. Re:a waste of CPU cycles by sexconker · · Score: 1

      If you sign a contract agreeing to those terms, it's legal. That includes collective bargaining agreements unions sign with employers.
      Regardless of what the state says.
      Perhaps you had your head in the sand and didn't hear about a certain recent Supreme Court ruling.

      As long as the contract itself doesn't violate any federal laws, it's valid. States can no longer dictate what is legal/not legal with regards to terms of contracts.

      And COBRA? Did you just mention COBRA?
      LOL DUDE

      The Consolidated Omnibus Budget Reconciliation Act (COBRA) gives workers and their families who lose their health benefits the right to choose to continue group health benefits provided by their group health plan for limited periods of time under certain circumstances such as voluntary or involuntary job loss, reduction in the hours worked, transition between jobs, death, divorce, and other life events. Qualified individuals may be required to pay the entire premium for coverage up to 102 percent of the cost to the plan.

      And yes, that's the total cost of the plan - the amount taken out of your paycheck PLUS the amount your employer pays.

    14. Re:a waste of CPU cycles by budgenator · · Score: 1

      A few of us are more fluent with machines than with people, most are more fluent with people than machines, someone with a high degree of fluency with both is both rare and valuable.

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
  54. First We'll Have To Write A Virus For It by Greyfox · · Score: 1
    In the spirit of open source I suppose it should be open source, and you'd probably have to compile it yourself. Maybe 'printf("IM 0WNZ0R1NG UR K00MP00TER");' would work...

    Seriously though, it's far easier to spread malicious software by tricking someone into clicking on a link and installing malicious software themselves. Or giving up their passwords to online assets. You really can't automate defending against every one of those attacks -- at some point you're going to have to rely on the user to exhibit a healthy amount of skepticism. Ultimately that is your first line of defense.

    --

    I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

  55. herd immunity by Tom · · Score: 2

    Read up on immunology and specifically the term "herd immunity".

    It's not just whether or not you are resistant to a virus, it is also if you help or hinder the spread. It takes surprisingly few non-vaccinated people in a population for an epidemic to get started. Because the spread of viruses, both biologically and in IT, is a numbers game. If the virus finds > 1.0 victims in its lifetime, it will spread and the number of infected hosts will steadily increase. Only if you manage to push down the infection rate to not even on hosts that are immune.

    --
    Assorted stuff I do sometimes: Lemuria.org
  56. herd immunity by Tom · · Score: 2

    Read up on immunology and specifically the term "herd immunity".

    It's not just whether or not you are resistant to a virus, it is also if you help or hinder the spread. It takes surprisingly few non-vaccinated people in a population for an epidemic to get started. Because the spread of viruses, both biologically and in IT, is a numbers game. If the virus finds > 1.0 victims in its lifetime, it will spread and the number of infected hosts will steadily increase. Only if you manage to push down the infection rate to < 1.0 can you eliminate it.

    Anti-virus on a Mac or Linux system does not only protect the system itself, its purpose also is to protect other, for example windows, systems. You Linux may be immune to the Word macro virus, but if it can detect and kill it, that windows system you send it to doesn't get infected.

    If you know anything about how stuff spreads in a population, you positively don't want the stuff in your environment, not even on hosts that are immune.

    (edit: posting a 2nd time because /. stupid "plain old text" eats everything after the "lesser than" sign if you don't escape it...)

    --
    Assorted stuff I do sometimes: Lemuria.org
  57. Re:Yes by ePhil_One · · Score: 2

    The DoD's reasoning is pretty straightforward. There are few to no "in the wild" viruses or trojans for Linux/Mac (several worms though), but data rarely stays in one platform in an interconnected world. We put virus protection on every platform so that whenever a document or program is introduced on the network it gets scanned. That way if it has malware in it, even Windows malware on a Linux/Mac system, it's caught early. Just because I first put the document on a Linux system doesn't mean it's going to stay on a Linux system.

    Exactly. 99% of what my Linux boxes scan for are Windows malware (viruses, worms, trojans, etc). I prefer to scan for such things on a box that is not succeptible to most things. Since websites, USB keys, and portable media, bittorrent, etc., mean virus can come into almost any system on the network, all machines shoudl be scanning for all viruses, whatever the platform.

    Home users can do what they want, but in any larger networked environment where you don't have absolute control, this is absolutely neccessary.

    --
    You are in a maze of twisted little posts, all alike.
  58. Re:Fear not fact by Riceballsan · · Score: 2

    As far as protection from linux virus's you would be wasting your time. Not so much entirely because of a better security model, but because of a lack of virus's in the wild, and a lack of spreading capabilities within them. Odds are if you have a virus on a linux system, it was most likely crafted for your system and specifically targeted, and targeted/custom written virus's won't be stopped by traditional AVs.

  59. Need It? by TheNinjaroach · · Score: 1

    Probably. I don't run anti-virus, but considering the fact I have Flash Player installed, I probably should.

    My mind will warp a little bit the first time I have to rebuild my linux box from an infection, but it's only a matter of time.

    --
    I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
  60. ClamAV anyone? by Fallen+Kell · · Score: 1

    As the subject says. That is the only one I know of that has versions for Unix, Liunx, BSD, Mac OS X, and Windows.

    --
    We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
  61. ESET by soupforare · · Score: 1

    Has AV solutions for all platforms.

    --
    --- Do you believe in the day?
  62. Installing McAfee on HP-UX by Anonymous Coward · · Score: 1

    Our solution was to tape a floppy disk of McAfee inside our HP-UX server. The boss laughed, and checked the box "install AV".

  63. You always need antivirus software by yakatz · · Score: 1

    But have we reached the stage were Mac OS X and Linux even need third-party security software? It seems like most Mac and Linux users don't run it."

    No, you must have anti-virus software or assume your computer is compromised. The anti-virus software on my mac catches things all the time.
    I sometimes solder new contacts onto flash drives when a friend/client has broken the end off (usually by smashing the flash drive with a chair while it is plugged it).
    Sometimes when I insert flash drives in to my mac (just to get the stuff on to a new flash drive or CD) the anti virus warns that there is a (mac) virus on it. With out the anti-virus, I might have run the program to see if it is important to copy it.

  64. attention moderators by Anonymous Coward · · Score: 1

    Wouldn't a ninja be able to take the mall cops out one at a time, hide the body, steal the uniform, and pretend to be a mall cop, thus avoiding alerting anyone to their presence? That seems like the obvious solution -- completely take over the AV system, continue receiving updates, but rather than implement them, send them back to your botnet's command-and-control so the botnet operator can stay one step ahead.

    This is clever, but before you mod up SanityInAnarchy's post for its cleverness, please remember that describing Symantec's business model as though its your own idea, is more along the lines of plaigarism than insight.

    (Sorry, I couldn't resist. Nothing against you, SanityInAnarchy.)

  65. They need better IT management by trevelyon · · Score: 1

    They are most likely doing this because they believe it will simplify licensing and "save" money by buying in bulk. The problem is that Mac OS and Linux really don't need anti-virus on the desktop (and likely won't for the length of this contract) so their requirement for this will limit their selection of in-essence windows desktop anti-virus and server anti-virus selection (a market that has a lot more options than those with Linux and OSX desktop versions as well). I would prefer a better solutions in each area than settling for a single vendor just because they support some edge cases (Linux/Mac Desktop) the better ones don't. Additionally, free alternatives (clamav, etc) provide a fallback solution should Linux / Mac OS desktops need AV protection during the contract.

    A few posters have mentioned that having anti-virus on Linux and OSX workstations may help the Windows PCs avoid getting infected. This may be true but for the cost (in quality of vendor selection) you are getting very little return for that benefit. I suspect they have very few Mac and Linux desktops currently (this RFP screams of a Windows IT department). If they do have a large LInux / OSX desktop environment there are better ways to implement the virus scanning than adding it to all these desktops (server side real time scanning, etc).

    If I were a betting man I would place money on the decision makers being windows admins that feel they are overworked. This type of RFP is the easiest for the IT management to create (basically they delegate the entire problem to a single vendor). Having consulted for fortune 500s for over 20 years, that is the environment I have seen that typically produces RFPs like this. You rarely see these coming from true heterogeneous environments (a substantial mix of non-windows infrastructure). That said, I don't know their specific motives so this is just a hunch :)

  66. Of course you should... by ShadowFoxx · · Score: 1, Interesting

    As a system admin and Information Assurance officer I myself run windows, linux ( virtualized) , and OS X. I use 3rd party malware detection on all 3 systems that are signature based. They are very much needed. It's silly for average users to think that just because they are running OSX which is a less targeted operating system that they aren't targeted. In fact... safari the OSX default browser ( which I like just because it's GUI is intutive to me) is probably the least secure of all the major web browsers ( if you look at the stats at each pwn to own competetion it gets busted the fastest). There are known OSX exploits and many of the same things apply. Man in the middle attacks, SQL injections, sneak ack attacks, all forms of malware... still apply. Just because you are using a specific operating system don't get lulled into a false sense of security.

    1. Re:Of course you should... by ShadowFoxx · · Score: 1

      To caviet... let me ask you if you think RSA ( the major cyber security company) runs all windows on thier servers? Yet they got pwned. They were socialy enginered... then the user installed a root kit on the system which allowed access to their servers... root kit = malware. Now thier NIDS ( network based intrusion detection) caught what was happening when it was in progress... but by the time they were able to respond the damage had been done and a lot of information access and ripped. Many of you are forgetting there are many forms of AV out there. You are all talking about signature based which relies on after 0 day signatures of known virii. These ARE helpful... but yes its after it's on your system. There are other types of AV , heuristics/behavior/anomily/signature based systems. AV doesn't hurt you unless your allowing it to take up to many resources which a good sys admin or user shouldn't allow to happen. If I'm running a Unix / Lunix / OS X / Windows server farm for a company I should definately do what I can to protect it. Network based intrusion detection systems, Host based ( NIDS HIDS) firewalls, DMZ's for incomming traffic ( demiliterized zones) Honeypots ( places set up to lure hackers so you can watch thier activity) you think all these concepts were developed for "windows only machines" ?

  67. Ok, but that's not workable in the real world by name_already_taken · · Score: 3, Insightful

    teach users proper data hygiene Totally impossible. They don't care and you can't make them care.

    Totally easy: 1: Here's not how to be an idiot. 2: If you're an idiot, you're fired without severance or health benefits.

    Can you tell me how I can fire my boss? There's basically nobody above him in the organization, so I'm just wondering how you'd apply your totally easy method in this case?

    There are also the cases where an employee is main rain-maker for the company, but hasn't a clue how to keep from getting malware on their computer. A law firm is not going to fire an attorney who brings in $30 million a year just because they keep getting malware on their pc, for example.

    --
    Putting moderation advice in your .sig lowers your karma!
    1. Re:Ok, but that's not workable in the real world by gumbi+west · · Score: 1

      simpler algorithms would be:

      1. fire all employees

      OR

      1. unplug all computers from internet.

    2. Re:Ok, but that's not workable in the real world by Bucky24 · · Score: 1

      Agreed. The majority of corporations do not revolve around the whims of their technical support staff.

      --
      All the world's a CPU, and all the men and women merely AI agents
    3. Re:Ok, but that's not workable in the real world by badboy_tw2002 · · Score: 1

      Exactly. The GP's post is best read outloud muttering under your breath while walking away from a group of people you've helpfully deemed "lusers".

    4. Re:Ok, but that's not workable in the real world by sexconker · · Score: 1

      teach users proper data hygiene
      Totally impossible. They don't care and you can't make them care.

      Totally easy:
      1: Here's not how to be an idiot.
      2: If you're an idiot, you're fired without severance or health benefits.

      Can you tell me how I can fire my boss? There's basically nobody above him in the organization, so I'm just wondering how you'd apply your totally easy method in this case?

      There are also the cases where an employee is main rain-maker for the company, but hasn't a clue how to keep from getting malware on their computer. A law firm is not going to fire an attorney who brings in $30 million a year just because they keep getting malware on their pc, for example.

      Firing your boss is as easy as turning in a resignation letter.
      A law firm absolutely will can a "rain maker" if he leaks out data which gets them sued for more than he's worth. And remember, he's only worth as much as the DIFFERENCE between what he brings in and what the hot-to-trot, young and daring, junior associate WOULD bring in if in the same position with the same clients. Basically, everyone is replaceable. Only one company on the fucking planet has a messiah that's irreplaceable, and they totally don't get viruses or have any security problems, so it's not even an issue.

  68. Re:"Is there no one else? IS THERE NO ONE ELSE??" by hxnwix · · Score: 1

    APK

    P.S.=> Ah, I just GOTTA do it: as I stand before "all of Linuxdom" here on /. challenging you, immediately after BLOWING YOUR "champion" Agreus... apk

    It's amazing the humiliation that some people require in order to maintain a sense of normality. I'm hesitant to give you what you need as it might just encourage you to come back for more. Rather than searching for this sort of unhealthy, negative interaction, you ought to seek medical attention.

  69. Tasmanian D.E.V.I.L. by goombah99 · · Score: 1

    Tasmanian
    Department of
    Education
    Virus
    Identification on
    Linux

    --
    Some drink at the fountain of knowledge. Others just gargle.
  70. Monocluture by Larry_Dillon · · Score: 1

    Personally, If I were to put an anti-virus product on Linux servers, I'd choose a different vendor that what was running on the Windows desktops. The idea being that if the desktop AV fails to catch a virus, there's at least some that a different vendor's product might catch it.

    --
    Competition Good, Monopoly Bad.
  71. Linux users paying for Msdogs by slmdmd · · Score: 1

    So is it evolution or devolution in IT age(historical prespective)- Linux users have to pay for Windows users who ignorantly choose a stupid OS. I did quit one of the biggest city's IT department in disgust because they wanted to put antivirus on Linux servers. Call me biased - I immediately loose respect for a person who chooses to implement a solution based on Windows and also for the persons who put a proprietery app on Linux and give root privileges to it. For me it becomes a parasite infested Linux system.

  72. Re:Ummmmm... by mr_mischief · · Score: 1

    Since they are McAfee and Symantec they hardly count for one anti-virus package between them on any OS. Use Kaspersky, Trend, Eset NOD32, F-Prot, Comodo, or anything, please anything, other than those two bloated pieces of poultry dung.

  73. Why do you want AV running on Mac & Linux? by frank_adrian314159 · · Score: 1

    So you can detect (and potentially clean) Windows viruses that end up on your servers or are forwarded through your Mac's email before it needs to be detected and increases the load on your Windows boxes. Yes, this is a problem. And AV vendors have been offering this feature for years. Why is this a Slashdot story?

    --
    That is all.
  74. It seems [] most Mac and Linux users don't run it by MSTCrow5429 · · Score: 1

    And once upon a time, most people rode around in cars without seatbelts.

    --
    Slashdot: Playing Favorites Since 1997
  75. Linux gets viruses too by peawormsworth · · Score: 1

    I run linux and I have had viruses. ClamAV caught a lot of email attachment viruses and such. ClamAV quarantined them. I suspect that they really only run on windows, but at least I didnt forward them on. Also, if you use USB you can get viruses on those devices too. As I did at a community services center with free internet. I told the sysadmin about it... but a week later I went in and I got it again.

    Anyhow... I just wanted to point out that Linux does get viruses. Although the majority (all?) appear to target windoz.

    I don't think I had a virus actually run on Linux... although if I did, it was really good and didnt reveal itself.

  76. No Windows-AV here by DrSkwid · · Score: 1

    I've been using Windows since 2.0, never had a virus / malware.

    --
    There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
  77. OSSEC a better choice by peterthomas2009 · · Score: 1

    http://www.ossec.net/ with central management on locked down machines would be more helpful in detecting anomalous behavior and security issues on the systems. Its also free so no wasted tax payer money on unneeded software.