Slashdot Mirror


User: Holmwood

Holmwood's activity in the archive.

Stories
0
Comments
163
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 163

  1. Signature Scanning remains key on The Netscaping of Symantec and McAfee · · Score: 2, Insightful

    Actually, every major AV product still relies on signature scanning for detection on client machines. You're right that observation on a honeypot or even VM sandbox is often used to characterize the behavior initially, but this is distinct from a roll-out of detection to the client, which is what I believe everyone's talking about here.

    As for signature scanning going the way of the dodo, there are really only 3 choices at present: signature scanning, run in a VM sandbox, or try to detect heuristically without resorting to a VM. The last two are similar, but not identical.

    There's already malware that won't run when inside a VM, so 'running in a virtual sandbox' provides no real solution. (And if someone suggests that we solve that by making it impossible to tell whether or not you're running in a VM -- which likely means processor changes -- think about what that will do to being able to detect a rootkit that loads your whole environment into a VM.)

    If you take a look at AV-comparatives.org, heuristic scanners don't seem to do very well vs. signature based detection. The very best proactive (heuristic) detection of 'unknown' malware (viruses, trojans, worms, etc.) seems to run about 60%. The very best signature based detection seems to run around 99.9%. (Moreover, the rate of false positives with heuristic detection tends to be much higher.)

    60% vs 99.9%? That's a big, big difference. Signature-based detection isn't going away anytime soon.

    Warning, URLS lead to PDF's: See: http://www.av-comparatives.org/seiten/ergebnisse/r eport10.pdf and http://www.av-comparatives.org/seiten/ergebnisse/r eport11.pdf
    Finally, I'm reasonably persuaded by Eugene Kaspersky's comments on this at http://www.kaspersky.com/eugenearticle

    Let's imagine that Company X has developed a behavioral antivirus AVX, which detects 100% of current malicious programs. So what will the hackers do? Of course, they will invent new types of malicious programs. And then of course it will be necessary to update the behavioral rules. And then update them again, because the hackers and virus writers aren't going to give up that easily. And then update them again and again and again. At the end of the day, we arrive at a signature scanner, except the signatures will be behavioral, and not pieces of code.

    This conclusion also applies to the heuristic analyser, another proactive protection method. As soon as hackers perceive that antivirus technologies are preventing them from reaching their victims, they invent new virus technologies which will be used to evade proactive detection. As soon as a product with advanced heuristics and/ or behavior blocking is widely used, the 'advanced' technologies employed will cease working.

    This means that 'reinvented' proactive technologies are only effective for a relatively short length of time. Where junior hackers need a few weeks or a couple of months to get round proactive protection, professional hackers will need one or two days, or, in the worst case, a few minutes or hours.

    Of course, he's slightly biased, his heuristic engine is weak compared to some, though still reasonably strong, and his company is fastest in the world at rolling out signature updates. But I think there's a lot to his argument, and I just don't see heuristic scanning closing the gap anytime soon. Holmwood
  2. Re:Was it these guys that... on Logitech Buys Slim Devices · · Score: 2, Insightful

    Version 3 of of Slim Devices Squeezebox is quite polished. I agree, V2 looked a bit clunky.

    Moreover, the informal tech support on their boards is amazingly good, IMHO. I posted about a problem in the evening one holiday weekend, and their CTO posted back with a suggested solution later that night. Now a fan of their products, sure, but the CTO? Great.

    In the short term, this is great news for the employees (assuming they have options/stock in the company) and founders. Shareholders can cash out and get a return on the equity (sweat and cash) they've put into the business. I'm very happy for them.

    In the longer term? They'll probably lose some good people, and I doubt that in five years time senior company officers will be answering a new users questions late at night on the boards on a holiday.

    Also, unless I'm really missing something, I don't see where a product like the Transporter (http://www.slimdevices.com/pi_transporter.html) fits in. I mean circa $2000? For something from Logitech!?

    Thinking about it that way, for me, this is a little like a decent, but unexceptional fast-food chain purchasing the local bistro.

    So it's kind of mixed news for consumers, I think. More backing, deeper pockets is good, but I do worry about what will happen to their customer service. I also worry about a junky cost-reduced product killing them.

    -Holmwood

  3. Re:Careful on Firefly Marathon on SciFi, September 18th · · Score: 5, Insightful

    That's because they're not smart enough to realize you can't wage war against something just because it's a bloody noun.

    Like a war on piracy?
    Or a war on slavery?

    The Royal Navy conducted both rather successfully (along with other countries). I admit, neither Fox News nor MSNBC nor CNN recently covered them.

    Back to the topic, Firefly is unusual, politically. It's hard to think of an SF show that's that libertarian. Most are either Utopian quasi-socialist/progressive (e.g. Star Trek), or have a strong military background coupled with a government ranging from progressive to conservative, but almost never libertarian (BSG, Stargate, B5...). Many feature a rebellion against a totalitarian regime, (Star Wars) but all the rebels typically want to set up a conventional big (though nicer) government of their own ("The New Republic") rather than just fly free ("You can't take the sky from me")

    Firefly suggests, almost heretically, that excessively centralized government itself is part of the problem, despite the good intentions of same.

    Holmwood.

  4. Re:Honestly weird on Johnny Cache Breaks Silence On Wi-Fi Exploit · · Score: 1

    As the coverage has said, the primary reason not to release details of an exploit that Apple hasn't yet patched is that it would be irresponsible to do so.

    I'm sure Apple's attorneys are not invisible in the process either. They'd have to be, whether or not the problem is real.

    In a few months time, it will either be evident that these guys are telling the truth, and that Apple was at best spinning, or it will be evident that the security researchers were initially spinning, and then lied about the vulnerability being also present in a Macbook with no USB wireless card.

    My own impressions, having looked at their work, (and other things they've published) is that the problem is real, but that both Apple and its supplier are having some serious trouble not just finding it, but even replicating it. Race timing problems in driver/OS code are notoriously hard to replicate, and often even harder to solve.

    These researchers appear to have behaved in a reasonable, responsible manner. I'm a little stunned at the level of anger and hate that's come spewing out. Either we have two guys willing to self-immolate just to momentarily make Apple look bad, or we've got people who've done solid research in the past who've done some more.

    Holmwood.

  5. Re:Not only that... on Microsoft To Release 'iPod Killer' at Christmas? · · Score: 1

    Actually, the elegant integration of the iTunes music store with macs/pc's and iPods was probably one of the driving factors. Microsoft offering to repurchase your music (and infect it with WM DRM instead of Apple DRM) would be a very clever move. "Nobody really thinks a Microsoft portable media player will go anywhere, do they? Did you already forget about "Ultra-Mobile PCs?" Yeah, me too." No one ever buys version 1.00 of Microsoft anything. Windows went through 3 -- or 4 or even 6 versions before it became a passable OS. Internet explorer went through at least 4 versions before it could match, let alone surpass, Netscape. UMPC's are definitely going somewhere, as are tablets. Ask any user of a Nokia 770. That said, the MS version is too big, too slow, too expensive, too short battery life. I suspect it will take quite a few iterations for MS to be even remotely successful at the UMPC or mobile music markets. Not clear that they'll have the willingness to waste billions here.

  6. Re:How do you identify graphics modes? on Microsoft Unveils 'Vista Premium' Requirements · · Score: 1

    Bill,

    To identify the version of DirectX that you're running (and determine all sorts of other things like Direct3d acceleration status), for Windows XP:
    - Click START
    - Click Run
    - type 'dxdiag' (without the quotes obviously)
    - Hit enter
    - Wait for the 'DirectX Diagnostic Tool' to load and go through some brief setup. (Might take 5-10s, or even more on a very slow machine).

    The first tab, labelled System has a list of information. Down near the bottom is "DirectX Version: ".
    This may well be something like "DirectX 9.0c (4.09.0000.0904)" (for example).

    Clicking on the other tabs gives you more information than you could possibly want (even if you were a gamer!).

    Now, as for your other point on your business system not needing digital video out to run business apps; sure you're technically correct, but here is what will happen if you don't have it:
    - You'll be running large monitors via an analog connector that dates to 1987. There's a reasonable argument to be made that the digital connections are crisper and sharper.
    - If your system gets upgraded with a Blue-ray or HD-DVD drive (this will be a simple cheap upgrade in ~4 years unless both standards fail), and the Image Constraint Token gets enabled by Hollywood, your no-digital-video-out system will downscale and reduce the display resolution of your shiny high-res next-gen DVD. Similarly, new machines without the digital output (and protected code path that MS is mandating) won't be able to display next gen DVD's in high resolution.

    Microsoft's requirements on most of these issues actually are generally quite sensible and should help push down prices for everyone.

    Now... their speed and RAM requirements, yeah that's a silly marketing game.

  7. Re:Plutocracy on Canadian Record Industry's Secret Lobby Campaign · · Score: 1

    Yes, bribery is illegal in Canada. How many of the people I cited were caught? How many charged? How many convicted?
    0, 0, 0.

    To suggest that Canada is purer, is, sadly, to live in a dream world.

    You point out that the public "chose" to punish elected officials. Fair enough. Thing is, the public did that to the Trudeaucrats in 1984, and to the Mulroneyites in 1993. The Chretien/Martin team was tossed out in '06.

    In the first two cases what impact has that had? Zero. How many top people were charged/convicted? Zero. An occasional (literally one or two, and that only if hundreds of millions were stolen) low-level unelected flunky went to Club Fed for a brief term.

    In the final case, you're pinning your hopes on a man who may well be good and decent, but who is far right compared to most Canadians. He may deliver, but at the moment it's not looking good. (See abandonment of ethics officer, etc).

  8. Re:Plutocracy on Canadian Record Industry's Secret Lobby Campaign · · Score: 1

    OK, I screwed up formatting. Sorry. Please don't kill my Karma. Reposted, readable:

    With respect, where have you been for the last 40 years? (Teaching at Harvard? (sorry, inside Canadian joke)). First, Canada's campaign finance reform is quite new. It might have the effect you hope for, but certainly the first dividends could be argued to have been the theft of hundreds of millions of dollars in the sponsorship scandal.

    A look at past PM's of Canada:
    Pierre Elliot Trudeau, very wealthy multimillionaire, PM 1968-79, 1980-1984, Remember his bribe of a swimming pool from lobbyists? The stench of Liberal corruption and appointments was bad by '79 and so reeking by '84 that Mulroney could appear to be a man of total integrity.

    Joe Clark, PM 1979 -- not notably wealthy. not notably corrupt!

    John Turner, PM 1984 -- very wealthy Bay Street (=Wall Street for USians) money man 200+ patronage appointments in 1 day, not otherwise corrupt

    Brian Mulroney, PM 1984-1993 -- multimillionaire businessman and lawyer. Embroiled in massive lobby scandal, investigated for years by the RCMP, nothing proven.

    Kim Campbell, PM 1993 -- not notably wealthy, not notably corrupt!

    Jean Chretien, PM 1993-2003 -- multimillionaire, daughter married into billionaire's family with ties to oil-for-food scandal, mysterious fires, strange lobby-scandal loans, ties to criminal donors, sponsorship scandal -- like Mulroney, no one's ever pinned anything on the man himself, but there's a definite odor of sulfur about both of them.

    Paul Martin, PM 2003-2006 -- worth 100+m, sponsorship scandal happened while he was Finance Minister (from Quebec!), some very mysterious financial dealings at Earnscliffe, especially re lobbyists, his private strategy/consulting firm.

    Stephen Harper, PM 2006 -- Reptilian Kitten Eater, according to some, but not notably wealthy, and not notably corrupt. Yet.

    So, yes, there is the exception of a bunch of Conservative Prime Ministers who were poor (well, if worth less than $1m is "poor") and who's collective tenure as PM was about long enough to change a lightbulb, and Liberal John Turner who was wealthy, but apart from an orgy of patronage appointments didn't seem corrupt.

    But for 39 of the last 40 budgets passed, 38 of the last 40 years, Canada's had a steady stream of PM's from both major parties who were a) multimillionaires, and b) seemingly quite corrupt, or at the very least, highly flexible in their ethics.

    Doesn't mean some of them weren't good men. Trudeau had an admirable vision for Canada (and was probably one of the least personally corrupt of the lot).

    But to say Canada is different? Have you looked at how the country has fallen in corruption indicies over the last decade?

    Holmwood.

  9. Re:Plutocracy on Canadian Record Industry's Secret Lobby Campaign · · Score: 1

    With respect, where have you been for the last 40 years? (Teaching at Harvard? (sorry, inside Canadian joke)). First, Canada's campaign finance reform is quite new. It might have the effect you hope for, but certainly the first dividends could be argued to have been the theft of hundreds of millions of dollars in the sponsorship scandal. A look at past PM's of Canada: Pierre Elliot Trudeau, very wealthy multimillionaire, PM 1968-79, 1980-1984, Remember his bribe of a swimming pool from lobbyists? The stench of Liberal corruption and appointments was bad by '79 and so reeking by '84 that Mulroney could appear to be a man of total integrity. Joe Clark, PM 1979 -- not notably wealthy. not notably corrupt! John Turner, PM 1984 -- very wealthy Bay Street (=Wall Street for USians) money man 200+ patronage appointments in 1 day, not otherwise corrupt Brian Mulroney, PM 1984-1993 -- multimillionaire businessman and lawyer. Embroiled in massive lobby scandal, investigated for years by the RCMP, nothing proven. Kim Campbell, PM 1993 -- not notably wealthy, not notably corrupt! Jean Chretien, PM 1993-2003 -- multimillionaire, daughter married into billionaire's family with ties to oil-for-food scandal, mysterious fires, strange lobby-scandal loans, ties to criminal donors, sponsorship scandal -- like Mulroney, no one's ever pinned anything on the man himself, but there's a definite odor of sulfur about both of them. Paul Martin, PM 2003-2006 -- worth 100+m, sponsorship scandal happened while he was Finance Minister (from Quebec!), some very mysterious financial dealings at Earnscliffe, especially re lobbyists, his private strategy/consulting firm. Stephen Harper, PM 2006 -- Reptilian Kitten Eater, according to some, but not notably wealthy, and not notably corrupt. Yet. So, yes, there is the exception of a bunch of Conservative Prime Ministers who were poor (well, if worth less than $1m is "poor") and who's collective tenure as PM was about long enough to change a lightbulb, and Liberal John Turner who was wealthy, but apart from an orgy of patronage appointments didn't seem corrupt. But for 39 of the last 40 budgets passed, 38 of the last 40 years, Canada's had a steady stream of PM's from both major parties who were a) multimillionaires, and b) seemingly quite corrupt, or at the very least, highly flexible in their ethics. Doesn't mean some of them weren't good men. Trudeau had an admirable vision for Canada (and was probably one of the least personally corrupt of the lot). But to say Canada is different? Have you looked at how the country has fallen in corruption indicies over the last decade? Holmwood.

  10. Re:Deal with the devil... on More on Sony's "DRM Rootkit" · · Score: 1

    Microsoft is no fan of third party kernel patches, for the reasons you cite. Unfortunately for us (and them), enough existing software does this to make it impossible to change in Win32. But... the good news is this "feature" (unauthorized kernel patching/hacking) is generally not possible in the 64 bit versions of windows. http://www.microsoft.com/whdc/driver/kernel/64bitP atching.mspx [microsoft.com] outlines this. Will they get upset at Sony over this? Probably not since there's other (semi-legitimate) software that does this as well, and they made the deliberate decision to leave the "feature" in windows.

  11. It comes down to money. on Google DVRs and TV Advertising · · Score: 2, Interesting

    It costs money and time to create good content. Even brilliant stuff like IMPS took years of volunteer work to produce. In the network age, the question becomes, how do we pay for this content? People will still develop free content for the joy of creativity, but if they can't feed their families, they'll have to do it part time in addition to a day job. Suppose the revenues from google's targetted ads were so good that google could afford to provide the consumer with a free (basic) TV, a free digital media device, and a free basic video stream (with ads) of popular programs. Would there be people who'd gladly go for this? You bet. Would this be a huge benefit for the very poor (as long as they gave and were able to give informed consent and the tracking was no worse -- no more evil -- than the automated tracking of google mail)? I think yes. Would there be people who'd rightly be outraged at the violation of their privacy that this would entail? Yep. They'd obviously not be members of such a service.

  12. Clumsy way to protect blogs? on Campaign Financing Cyber Loophole · · Score: 4, Insightful

    It's starting to look as though McCain-Feingold will end up hurting larger blogs, as they risk being counted as contributions during an election cycle. Manolo's Shoe Blog is probably pretty safe, but Daily Kos and Instapundit aren't. I'd bet both their bandwidth bills violate the cap, and they both tend to back specific candidates. So, this law is likely simply a clumsy way to protect blogs.

  13. Re:This isn't anything new. on Toshiba HD-DVD Player Planned to Enforce HDMI · · Score: 1

    Actually, even in North America, most up-converting DVD players that I've used will let you output at least 720p via component output (analog).

    Usually, though, the method of doing this is not documented in North American players. One frequently has to either flash new firmware from outside North America, or enter a key sequence.

    The Samsung DVD-HD850, for example, requires a brief simple sequence keyed on the remote, and I've been using it for some months now with component output at 720p.

    I suspect most manufacturers of HD-players will do as most upscaling player manufacturers do today: they will loudly proclaim their (North) American HD-players to not allow > 480p via analog outputs. This will satisfy the studios.

    Quietly, they will make that analog upscaling available in other parts of the world, and available in North America for any technically oriented person who can manipulate a remote control and use google. This will satisfy the slashdot crowd. Granted, if they don't do that, HD will be DOA.