On Sun, August 17, 2008 10:58, david@xxxxxxx wrote:On Sun, 17 Aug 2008, Peter Dolding wrote:Instead swap across to the shorter white list to process and sort.
Quarantining for black list scanning so performance of machine is hit
with the least ammount. Some areas like email, p2p for people using
formats that should not contain macros or executable code white list
scanning there is all that is needed before either blocking or asking
user if black list scanning should be preformed or the file just
deleted. Lets close the door's on these malware writers without hurt
end users any more than we have to. What is the point of running a full
black list across a file the user will delete because it was not what
they thought it was.
you are arguing with the wrong people here. we are not trying to define
the future of anti-virus technologies, we are trying to figure out how to
provide the hooks so that people and companies can go off and do the
research and experimentation and try different approaches.
Given recent demonstrations that show how easy it apparently is to bypass
blacklist base approaches, providing hooks to allow these blacklist
approaches may I feel be rather futile. Focusing only on hooks for white
list approaches in combination with hooks for least authority approaches
like the powerbox would IMHO seem like a much more reasonable approach
given the current state of things and knowledge concerning the blacklist
technologies. Explicitly adding support for technology that is quickly
becoming obsolete would seem like a waste of time and resources.