Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon access scanning

[Theodore Tso <tytso@MIT.EDU>]

On Wed, Aug 06, 2008 at 08:10:53AM -0400, Press, Jonathan wrote:
> I think if it as being like the Sieve of Eratosthenes.  The further down
> you go, the more numbers drop out.  In AV scanning, each step of the way
> removes some percentage of the harmful files, and closes the window of
> time that they have to operate or migrate.  Or maybe it's like spraying
> insecticide when there is an outbreak of some deadly mosquito-borne
> illness.  Without getting into the political issues about spraying,
> because this is JUST AN EXAMPLE -- would you not spray because 5% of the
> bugs would still be left behind?  Wouldn't you then spray again, because
> you wipe out another 95%?

The problem with your example is that it ignores the cost; the cost in
code maintenance; the cost in performance, etc.  That's the problem an
absolutist view towards security.  Going back to the your sparying
analogy, if the illness is considered *so* utterly deadly that you
don't consider the costs of beneficial insects dieing, children
getting exposed so badly that they get cancer five years later,
etc. --- then the argument would be heck, let's spray every day!
Let's spray every hour!  Let's have a insectside misters going 24
hours a day in the parks and in the schools!!!

In the TSA example, let's force every single traveller to strip naked
publically and be submitted to body cavity searches!  Since
**obviously** stopping terrorist bombs is so important that no other
considerations need to be taken into account.  Oh, and we should
obviously also give all of our financial information to the security
agencies so they can do futher screens to look for terrorists; who
cares about the risks that laptops with all of that unencrypted data
will be stolen out of a locked office in the San Francisco airport?

Similarly there are costs to doing all of this extra scanning.  You're
getting carried away here way you say that it never hurts to do extra
scanning, and that we don't need to decide whether or not it makes
sense to do it all.  That's just stupid.  The whole defense in depth,
taken to extremes, leads to completely nonsensical thinking.  Security
is *defintiely* a cost/benefit tradeoff, and to do something
meaningful here we need to think rationally about the threat
environment --- and part of that threat environment is the existing
security systems in Linux, which are definitely far more powerful than
what DOS/Windows have.

							- Ted