Reply to thread

Message

<blockquote data-quote="XhenEd" data-source="post: 584255" data-attributes="member: 19498">I would still say it is pure default-deny. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite115" alt=":p" title="Stick out tongue&nbsp; &nbsp; :p" loading="lazy" data-shortname=":p" /> It&#039;s just a matter of being restrictive or not too restrictive. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite116" alt=":D" title="Big grin&nbsp; &nbsp; :D" loading="lazy" data-shortname=":D" />&nbsp;I think the term for TAM is &quot;not-too-restrictive default-deny&quot;. It blocks by default (which by the way is what makes me believe it is default-deny), but it has a whitelist to allow programs. As what the Kaspersky TAM Whitepaper states, defualt-deny is blocking what is not explicitly allowed.COMODO, for example, markets their products as default-deny solutions. But don&#039;t they have whitelist? Yes, they have. Even AppGuard in Lockdown mode, I believe, would be &quot;default-allow&quot; if I follow what Jeff believes (default-deny is to block all programs in User Space) because AppGuard in that mode still allows, by default, MS-signed applications to run. Even system space applications are allowed by default to run.That&#039;s why I believe we only differ in our understanding of the term default-deny. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite116" alt=":D" title="Big grin&nbsp; &nbsp; :D" loading="lazy" data-shortname=":D" /> Some applications are default-deny, but are not too restrictive. Kaspersky&#039;s TAM falls into this. Some applications are default-deny, and are very restrictive. AppGuard&#039;s Lockdown mode falls into this.Jeff believes that default-deny means always restrictive (no whitelist, if possible). But for me, default deny means blocking immediately any program, until it is allowed (by a whitelist or the user).</blockquote>

[QUOTE="XhenEd, post: 584255, member: 19498"] I would still say it is pure default-deny. :p It's just a matter of being restrictive or not too restrictive. :D I think the term for TAM is "[I]not-too-restrictive[/I] default-deny". It blocks [I]by default[/I] (which by the way is what makes me believe it is default-deny), but it has a whitelist to allow programs. As what the Kaspersky TAM Whitepaper states, defualt-deny is blocking what is not explicitly allowed. COMODO, for example, markets their products as default-deny solutions. But don't they have whitelist? Yes, they have. Even AppGuard in Lockdown mode, I believe, would be "default-allow" if I follow what Jeff believes (default-deny is to block all programs in User Space) because AppGuard in that mode still [I]allows, by default,[/I] MS-signed applications to run. Even system space applications are [I]allowed by default[/I] to run. That's why I believe we only differ in our understanding of the term default-deny. :D Some applications are default-deny, but are [I]not too restrictive[/I]. Kaspersky's TAM falls into this. Some applications are default-deny, and are [I]very restrictive[/I]. AppGuard's Lockdown mode falls into this. Jeff believes that default-deny means always restrictive (no whitelist, if possible). But for me, default deny means blocking immediately any program, until it is allowed (by a whitelist or the user). [/QUOTE]

Verification