Linked by Thom Holwerda on Sun 22nd Oct 2006 22:56 UTC
Linux "The talk lately has centred about Vista's security APIs, but Linux certainly needs improvements in this area, because AV vendors still rely on an external kernel module to implement 'real time' file scanning." The Inq also reviews AVG antivirus for Linux, and concludes it is a must-have
Thread beginning with comment 176371
To read all comments associated with this story, please click here.
Read and Reread
by hylas on Sat 28th Oct 2006 19:15 UTC
hylas
Member since:
2005-07-10

Reflections on Trusting Trust
Ken Thompson

http://www.acm.org/classics/sep95/

It's not the "little" bugs. You're not thinking low-level enough.
Keep reading until you understand.

Excerpt:
"The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect."


This is also instructive.

A Taste of Computer Security
Amit Singh

http://kernelthread.com/publications/security/

Yes, I know I'm harping ... :-)

Edited 2006-10-28 19:20