Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 905119" data-attributes="member: 83059">Yeah and I’m personally not a fan of such an approach. Using digital signatures on the vendor or whitelisting hashes of specific files are not ideal. One leaves customers vulnerable if a vendor becomes breached, and the other is volatile against zero day updates (Emsisoft for example has had historical problems with marking brand new Firefox updates as malware, which can get in the way of getting critical security updates)I think the main point I’m making regarding this test is that it doesn’t tell us enough about false positives. Testing with a corpus of curated samples for false positives doesn’t tell us enough about the way each vendor is addressing false positives, and whether or not those test results will translate to the kinds of false positive events the average user is likely to run into.It’s easier to argue that in the wild malware samples are generally relevant because, well, they’re in the wild. This random grab bag of esoteric and mostly unsigned software? I’m not convinced that’s what I want for a real-world false positive test.</blockquote>

[QUOTE="MacDefender, post: 905119, member: 83059"] Yeah and I’m personally not a fan of such an approach. Using digital signatures on the vendor or whitelisting hashes of specific files are not ideal. One leaves customers vulnerable if a vendor becomes breached, and the other is volatile against zero day updates (Emsisoft for example has had historical problems with marking brand new Firefox updates as malware, which can get in the way of getting critical security updates) I think the main point I’m making regarding this test is that it doesn’t tell us enough about false positives. Testing with a corpus of curated samples for false positives doesn’t tell us enough about the way each vendor is addressing false positives, and whether or not those test results will translate to the kinds of false positive events the average user is likely to run into. It’s easier to argue that in the wild malware samples are generally relevant because, well, they’re in the wild. This random grab bag of esoteric and mostly unsigned software? I’m not convinced that’s what I want for a real-world false positive test. [/QUOTE]

Verification