"The talk lately has centred about Vista's security APIs, but Linux certainly needs improvements in this area, because AV vendors still rely on an external kernel module to implement 'real time' file scanning." The Inq also reviews AVG antivirus for Linux, and concludes it is a must-have
To view parent comment, click here.
To read all comments associated with this story, please click here.
Member since:2005-10-18
Well, the "many eyes" advantage starts already at the upstream level, repositories only add to it somewhat. Basically, it has to do with the very open source model, not with the specific distribution method such as a central repository. Repositories are good for basic automated checks (like a check for known viruses), but nobody in reality conducts regular, thorough security audits of even all core system software in a repository.
Member since:2005-11-11
//but nobody in reality conducts regular, thorough security audits of even all core system software in a repository.//
This is not correct.
People download from repositories all day every day. As soon as there was ever a problem with this there would be immediate howls of protest.
Put it this way - there is not one recorded case of a system being "infected" by malware from using an open-source repository.
Not one. AFAIK.
I have been waiting a long time to hear tell of a case of that happening. So far, zilch. Nada.
Edited 2006-10-23 09:58
Member since:
2005-11-11
"However, the malicious stuff can reside, for example, in an RPM package; in this case damage can result already during the installation (because of pre- and post-installation scripts), as well as at runtime."
This is why respositories are digitally signed. If you install RPM's from repositories, you get the open-source "audited by many eyes" trustworthiness assurance. If you just install an unsigned RPM from God-knows-where, then you are no better off than if you were installing stuff on Windows from an .exe.