OSNews

And what do you mean by: This is exactly the mistake that Microsoft made in 80s, 90s?
Dedoimedo

I said this earlier, but the link to your article on white-listing and black-listing is broken (it is a file:// URL). It looks like you forgot to put that on the Internet. I would be interested in reading it.

Just go to his own site and search for it.
http://www.dedoimedo.com/life/whitelist-blacklist.html

And also, I would say that the whitelist blacklist article on his website is pretty much against what I think about whitelisting and blacklisting.

Central to his whitelisting and blacklisting article is the idea that whitelisting = innocent-until-proven-guilty and yet he goes on to say that whitelisting is done in old Soviet Union yada yada and that blacklisting is the norm of the society, done in US and guilty-until-proven-innocent.

I would say that trying to divide it into forms of governance and behavioural patterns is much more complicated. Not to mention the amount of prior work needed to prove that governance and behavioural patterns can be mapped into the analogy in the first place. But I'm digressing. My main problem is that I do not even agree with his use of the words whitelisting and blacklisting.

Basically, the idea of blacklisting (not coincidentally, blacklist as a word is permitted by the spell check while the much newer whitelist is not) is to select known bad elements of the pool of all elements and apply strict rules on them. Contrast this with whitelisting where you select the known good elements and build a fence around them to protect them.

Actually, both cases' characteristics are very well known. Blacklisting allows for more rapid development but is much more prone to attacks while whitelisting is much more secure (though not eliminating insiders) but can be so painfully slow. Usually, in real life, they are used in combination -- simply allow for a gray area and you can selectively relax rules for known good elements and apply strict rules to the known bad ones, with whatever policies the administrator wants to apply on the gray.

I am now going to show how both cases are doomed to failure if not applied together. Blacklisting is currently employed in malware scans. This is where malware appears in the wild first (recall Blaster, mydoom, sasser?) and then the malware scanning companies will do whatever they can to block it, which, for virii (stupid spell check allows for viruses but not virii) is a signature check. This model of work is proven to be easily compromised. Whitelisting, on the other hand, is going to say that you can only use openoffice.org and mozilla firefox. That way, you cannot install stuff that compromises the security of the system. If chrome comes along, it will need to be thoroughly vetted first (no wonder it is so slow moving), but this system is only vulnerable to regulation oversight and insider malevolence. It tends to last longer, and is evolutionarily selected for use in large governmental organisations, most notably in military (i.e. those that try to be funny in war tend to be infiltrated too quickly).

Hence, it is important to incorporate both. Which is the problem with malware scanning these days -- old systems used to have intrusion prevention rather than detection, and when they compared the newer detection to prevention, they found out, quite unsurprisingly, that detection is a lot lousier in dealing with attacks (and that the number of signatures to scan increases so fast that whatever gains it initially had over prevention is quickly overrun).

If you want to read more, read ranum at
http://www.ranum.com/security/computer_security/editorials/dumb/ind...

PS: In fact, the whole site itself is generally well-written.