Hacker News
points by xydone 1 day ago | 0 comments
But the trust as a service (TaaS) platform could decide tomorrow that you are not trustworthy because, I don't know, it matched a pattern in a piece of ransomware which is actually a pattern you can produce by allocating 3 pages of memory in one call. Should you as a language now put compile time guarantees that 3 pages cannot be allocated?

This is obviously a ridiculous example, but what I'm aiming to say is, if a piece of software is matching something as untrustworthy when it's not, you shouldn't chase it down to force the little guy who's maxing good will software to fix it because the big bully thinks they are evil and deserve to get quarantined

[–] dwattttt 1 day ago
Sure. But the heuristic the TaaS world is using isn't something as absurd as "allocates 3 pages", it's "uses undocumented system APIs". We're also not arguing in the abstract that "they might make a stupid determination in the future", they're making this determination now.

I'm not a fan of the the security industry's practices, but I can't say they're making a malicious/stupid choice here.

[–] xydone 13 hours ago
Yeah, I get that, I'm just unconvinced that using lower level, less documented APIs, which are not necessarily meant to be the way users interact with the system, is a good heuristic for malware detection.

I'm ignoring the fact that very few people in the world need an antivirus (other than maybe elderly/less technologically knowledgeable people, but even then I'm not sure they can be fully protected)