Antivirus network

"Frederic Bonroy" <bidonavirus.TakeThisOut@yahoo.fr> schreef in bericht
news:2gm9l5F4cslkU1@uni-berlin.de...
> Wim Hamhuis wrote:
>
> > How about a universal program that shares antivirus definitions for
every
> > antivirus program. This would make the internet much safer than it is
now.
>
> Impossible since different scanners work differently. Or are you talking
> about a "definition converter"? Too much hassle.

There is some work to achieve this, but when it's implemented, they don't
have to invent the wheel again, and it's of same benefit to all, because
there are so much programmers and there are so much different operating
systems... it could look like the BASICODE in it's early stage..

with friendly greetings,
Wim
 >> Stay informed about: Antivirus network 

"Wim Hamhuis" <wimhamhuis.TakeThisOut@nietemailopgeveninnieuwsgroepen.invalid> wrote in message news:10aboskehf0fa8e@corp.supernews.com...
> How about a universal program that shares antivirus definitions for every
> antivirus program. This would make the internet much safer than it is now.

If all of the AVs used the same engine/def sets, then you will have
lost the advantage of diversity in a layered defense scheme.
 >> Stay informed about: Antivirus network 

"FromTheRafters" <!0000@nomad.fake> schreef in bericht
news:10adfinrejlg9dd@corp.supernews.com...
>
> "Wim Hamhuis" <wimhamhuis.TakeThisOut@nietemailopgeveninnieuwsgroepen.invalid> wrote
in message news:10aboskehf0fa8e@corp.supernews.com...
> > How about a universal program that shares antivirus definitions for
every
> > antivirus program. This would make the internet much safer than it is
now.
>
> If all of the AVs used the same engine/def sets, then you will have
> lost the advantage of diversity in a layered defense scheme.

Not neccasarily.

The programs could just maintain their own defense system, but it then would
not be neccasary to buy a live-update subscription anymore, and
antivirusprograms wouldn't expire in the way we are used to... the defence
network could also help with downloading removaltools (a thing we have to do
ourselves now) in a secure connection.

so nice of you to think with me for a good solution

With friendly greetings,
Wim Hamhuis
 >> Stay informed about: Antivirus network 

"Wim Hamhuis" <wimhamhuis.TakeThisOut@nietemailopgeveninnieuwsgroepen.invalid> wrote in message news:10aec14a8tmhd35@corp.supernews.com...
> "FromTheRafters" <!0000@nomad.fake> schreef in bericht
> news:10adfinrejlg9dd@corp.supernews.com...
> >
> > "Wim Hamhuis" <wimhamhuis.TakeThisOut@nietemailopgeveninnieuwsgroepen.invalid> wrote
> in message news:10aboskehf0fa8e@corp.supernews.com...
> > > How about a universal program that shares antivirus definitions for
> every
> > > antivirus program. This would make the internet much safer than it is
> now.
> >
> > If all of the AVs used the same engine/def sets, then you will have
> > lost the advantage of diversity in a layered defense scheme.
>
> Not neccasarily.

I don't see how it is not necessarily so. If there is a certain algorthm
for matching fragments of malicious code against a "definition", and
all of those "definitions" are universal, then the one you run on your
mailserver misses a certain mutation of the virus - wouldn't also the
desktop machines running the same algorithm miss the same virus?

Having two different algorithms would likely make it so that the holes
in a series of filters don't line up to act as a single hole ridden filter.

> The programs could just maintain their own defense system,

I may be wrong, but I always envisioned the engine/def set as being
a somewhat matched set. One must work so closely with the other
that universal defs implies universal engines to some degree.

> so nice of you to think with me for a good solution

I can think of only one real solution, but that requires *everyones*
participation - not a likely happening at all. The trusted computing
thing seems to be an attempt at ensuring mandatory compliance
with certain safe computing practices partially implemented in the
hardware. If all "out of the box" computers were in trusted mode
and it took some computer savvy to make it run like a *real*
GP computer - that would probably cut way down on the worm
noise we are all experiencing.

....that is..until something goes wrong.
 >> Stay informed about: Antivirus network