20 years in av

i knew time was coming, i even thought about marking the occasion here, but my attention was elsewhere at the time so there weren't any posts on the subject.

then eddy willems posted about his 20th anniversary in anti-malware and i thought maybe i should post about this after all - so it entered my to-do list and languished there for a while.

and then today david harley posted about his upcoming 20th anniversary in anti-malware so i figure it's time to pop that task off the to-do stack and actually write something.

you see, i also had my 20th year in the anti-malware field this year - though not in the professional sense that eddy and david did. i don't recall the exact date but i know it was in late november of 1989 that i started down the path i'm on today (i gave a basic run down of how it happened in my about me post 3 years ago).

it's interesting to me to discover that some of the other names i know in this field also got started the same year. it didn't really seem like '89 was all that significant a year or anything, but i guess that's about when awareness of the malware problem (or rather the virus problem at the time since that was the principle form of malware being created) was reaching the critical mass necessary to entrench itself firmly in the general public's consciousness - first as an obscure curiosity, but as an increasingly real and oftentimes personal annoyance for people as they had their own run-ins with the problem. as such i'm sure there's quite a few more who got their start that year.

at any rate, happy anniversary eddy and david. i hope it's been as stimulating for you as it has been for me.

i'm still here

i know it's been a while - i'm still alive, just preoccupied with other things. i'm going to try to clear out some of the backlog of things i intended to write about. expect some old subjects for the next little while.

ok, i'll draw a bunny

yes, this is a fluff post, you have now been warned...

some of you may have noticed i haven't posted in a while... in fact it's been over a month since i last posted anything - my post archive has no entries for february at all... as some of you may recall, anti-malware is not my job - in fact security itself isn't really my job unless you count implementing security features in other software (and even then the only reason i'm the one doing it is because i'm the one who's really familiar with the concepts), so security in general and anti-malware in particular isn't my day job but rather something i've just always had a natural affinity for... that being said, sometimes you need to step back for a while, smell the roses, and gain some perspective, even when it comes to something you're passionate about... ergo, i've been absent...

but today i got an email from cd-man, checking up on me and letting me know that he's tagged me in some internet meme about drawing bunnies... now, i must admit i have a fascination with memes (for purely pragmatic reasons) and how better to study a meme than from the inside by participating in it so i figure why not give it a shot... thus i dug out my highschool sketchbook, an appropriate pencil, found a worthy subject and threw this together (if only i also had a scanner and didn't have to use a crappy digital camera to put it on the web)...



so now i've got to tag 3 people... hmmm, 3 bloggers - jonathan poon, costin raiu, and aaron walters...

the post with no name

well, here i am on the first day of my christmas vacation, trying to do stuff that i didn't have time to do while i was still working...

like blog posts about the distinction between static and dynamic heuristics for martin mckeay (even though that distinction was incidental to the issue i was bringing up)...

since the holiday season is upon us, i thought maybe it might be nice to clarify to martin (and rich mogull before him, and others to whom this will apply equally well) that i wasn't trying to be critical of him personally or attack him... i try not to attack people just for doing/saying something that is technically wrong (ethically/morally wrong, sure, but not technically wrong), everyone makes technical errors... on the other hand, although i don't use people who make technical errors as targets, you folks do make wonderful examples - and examples are an important part of the learning process that (frankly) a lot of people could benefit from...

so, gentle readers who may at some point find themselves the subject of one of my posts, try not to take the fact that i don't usually sugar-coat things too personally - it's just my way...

take my content, please!

rich mogull exacted his revenge against a blog scraper today by calling the scraper out on his blog and thereby getting that scraped and put on the scraper's site...

i've seen people complain about scrapers before but i just don't get it, especially when they're not monetizing their own content in the first place...

now, i have no idea if the scraper in question also scrapes this blog but i know there are others who do and it's never really bothered me... that's not because i'm a crank (though i know some people like to think so) or because i'm desperate for readers... it's because (perhaps counter-intuitively) i don't write content for the purposes of drawing people to my blog...

i write content for precisely 2 reasons - to get things off my chest and to share what i know and neither of those things are negatively impacted by scrapers republishing my content... in fact, republishing actually helps me share what i know because it makes the information (rather than just links to my site) easier to find by virtue of being in more places...

and if they're selling ads around my content? even better, they have an extra monetary incentive to spread the word of kurt and the money doesn't come out of my pocket...

i'm not trying to monetize my content and i'm not trying to build a brand out of my content... i want people to learn and i have no interest in trying to control how or where they get the information i try to make available...

this isn't to say that other people with other motives shouldn't have the right to try and control such things about their own content, mind you, i just think trying to exert such control is silly...

so with that in mind, to all you scrapers out there - if you want to republish my content then you're free to do so...in fact it was one of the possible uses i had in mind when decided on which creative commons license to use... my only request (and it is just a request) is that you use the full content, not partial text feeds... i despise those abridged post summaries as they ruin the usability of the message (far more than my wacky writing style does)...

a glimpse behind the kurt-ain

(it's times like this i wish i lived in australia - then i could be the wismer of oz...)

i got some 'link love' from mike rothman earlier this week that caught my eye... no word love, mind you, as it seems mike has decided i generally don't know what i'm talking about... hopefully our disagreements are over value judgments (like our respective moral compass' pointing is slightly different directions) rather than over facts, but that's not really what caught my eye... one of the reasons i read mike's blog is for the pointed criticism, it would be hypocritical of me to turn around and cry foul when that criticism is directed at me... what surprised me was mike's realization that i'm not in the anti-malware industry...

i generally don't write too much about myself on this blog, i don't think it's interesting or topical (though some schools of thought suggest it humanizes the blog and makes it easier for people to relate), but i thought i had been pretty transparent about who i am and where i fit in in the greater scheme of things in my about me post... mike now has me thinking that perhaps that's not the case...

so to start things off: i am not a member of the anti-malware industry... instead i'm a member of the anti-malware community... you know, those people who discuss the concepts with others online, who help people with malware problems, that sort of thing... i've done a bit of infiltration - an enlightening experience, but not really worth repeating... i collected viruses for a while, though i'm glad i stopped; with a half million malware projected for this year that would be like a full time job without the benefit of getting paid... i've done a bit of disassembly, though not so much that i ever got good at it, and there never really seemed to me to be a shortage of malware analysts... what there did seem to be a shortage of (at least at the time many moons ago) were people willing to get their hands dirty and help out their fellow man (or woman) with their immediate problems with viral infection and their more long term problem of learning how to cope with the reality of viruses in the future... at one time i committed myself to making sure that every plea for help in alt.comp.virus got an answer, but these days there are plenty of people down in the trenches now in multiple forums so i feel less pressure to do so myself... there's still that longer term problem, of course, which is why i put up my (admittedly under-maintained) av reference library site (to make the information more available), and why i spend so much time on this blog explaining things (when i'm not ranting on topics i know nothing about, of course)... i suppose you could say i've tried on roles the way some people try on personae (it was certainly the right developmental period)...

not being in the anti-malware industry means i don't have to wear the corporate muzzle, i can say what i like about the anti-malware field without consequences other than making some enemies and possibly making myself less employable in that field (and since i've never tried to be employed in that field and am not sure i could start wearing the corporate muzzle, that works out just fine)... i can criticize any and all vendors if i see fit (and i have)... i can point out their ethical misdeeds, their marketing mistakes, their snake-oil, their FUD, their hype, etc...

not being in the anti-malware industry also means i don't have as much insider knowledge as someone who is... the only insider knowledge that i have is what i've acquired by interacting with those who are part of the industry, but i've done a fair bit of that over the years...

second: i am not an IT/security professional... i'm not the guy that manages the networks or the desktops in my company, i don't decide whether the company roles out virtualization on it's servers or any of that stuff... i write code, and lucky for me i get to implement (and in some cases design) a variety of the security-related functions and features of my employer's product...

i'm also not under the illusion that the security professional's frame of reference is the only game in town... as technical as i may be sometimes, i generally adopt a more consumer-centric frame of reference with regards to the application of security controls... i like free tools and i like safe-hex and i think understanding the threat and the counter-measures helps a lot...

third (and this has nothing to do with mike's post, but it is something that comes up from time to time): i am not an expert... some people think i am, or think i consider myself to be one, but i'm not and i don't... i consider myself to be a specialist in the sense that i have specialized knowledge (something one tends to pick up when following a field for 18 years)... i have not and will not lay claim to the title of expert - i know experts in this field and they're far more knowledgeable than i...

finally (and this is probably of the most general interest to readers of this blog): there is nothing wrong with my shift key... once upon a time it was not entirely unusual for people to neglect using the shift key - and, if you haven't guessed from the distinction i make between hacker and cracker, i'm a little bit old-school... besides it's not like following traditional capitalization rules imparts any extra information... punctuation (whether properly used or misused as i'm want to do) is entirely sufficient to mark off the places where one statement ends and another begins... i am capable of following those rules, i just don't generally find it natural or necessary...

happy new year

i generally try to keep the administrivia posts to a minimum here, i don't think they're generally all that interesting, but in light of the new year and some reconsidering i've been doing i've decided to do something i previously said i wouldn't do...

i'm enabling comments on this blog (moderated, CAPTCHA'd comments, but comments all the same)... i had to manually enable them on a number of posts (due to some setting changes i made a while ago) so the feed is probably going to show some old posts - oops, sorry about that, i'm not sure why blogger re-inserts things into the feed when i don't make changes to the content of the post but oh well...

i still think usenet is a superior medium for intelligent discourse, but it's clear to me that people want to be able to leave a comment right there on the page and as i use other people's blogs i'm starting to see why...

enjoy the new feedback mechanism...

administrivia

just a quick note for those who've subscribed to the feed, i recently switched to the new blogger beta and that seems to have caused some wierdness with regards to the feed (you might have seen the last 25 posts show up as new because they all got republished in the process of the migration)... sorry for that, hopefully that won't happen again (at least not on that scale, can't promise i won't edit things when i spot an error)...

about me

ugg - what a boring topic... well if you're like me and the question of who writes this stuff is uninteresting to you then you can stop reading this right now because that's basically what this entry is going to be about...

my name is at the end of each post, you're free to google it or click on it and send me email... i'm a computer scientist - i got my bsc in computer science from university of toronto in 2000... computer science was a natural path to take as i was already quite familiar with computers before i started - i'd been a coder since the age of 10 and had taught myself a variety of programming languages by the time i entered university (c was probably the most helpful)... i'd also developed an almost instant interest in computer security back when i was still puttering around on my vic20 when i was 10-11 (though obviously not out of any actual necessity as all my data was just games and coding experiments)...

in late 1989, the 2nd hand compaq luggable i had been using for about a year developed a very strange problem where characters would appear on the screen without ever having been typed... around the same time i had heard through the media about these things called computer viruses and i got to wondering if maybe my computer had one and set out to learn more about the subject because the problem was quite annoying and i wanted it solved...

of course in retrospect that all seems silly - it was clearly a problem with the keyboard, which i did deduce after a while and did manage to repair but not before having developed an interest in computer viruses...

so there ther i was, 14, with a couple of years of programming under my belt, and i'd just developed an interest in computer viruses - i think we all know where that leads....... hah! don't trust stereotypes, that's not where it lead - not because my moral compass was anymore more developed than other teenagers, it definitely wasn't... when i did finally find forums for talking about viruses (which i find are generally much more useful than books) in the early 90's ('91 or '92 i think - if anyone can remember when edwin cleton stepped down as moderator of the VIRUS echo in fidonet, let me know) i found the analytical approach used by the anti-virus community to be more appealing than the less rigorous approach used by the vx at the time...

so there you have it - i've been learning about computer viruses (and by extension, malware and related security problems) since 1989, trying to discern the underlying principles, trying to put it into a nice, neat, easily understood package, and for much of that time sharing what i've learned with others... i'm not an expert, at least i don't consider myself one - i've interacted with those i consider experts (like frisk or dr. solly) in various forums and they're far more knowledgable than i... i'm also not a member of the anti-virus industry, basically because there aren't any av shops in my area and i don't want to move, but i also gather prior knowledge of/interest in viruses can actually be a barrier to getting hired (av companies don't want to risk hiring someone who might have a virus writing past they aren't disclosing) so it's not something i've really investigated too much... i'm just a long time member of the anti-virus community...

if you really must know more, well, i can only suggest visiting my other blog to see a different side of me...

anti-malware linking policy

linking policy? what's a linking policy?... well, it's basically the rules i follow (or should be following) when including links in my blog posts (or elsewhere)...

it occurred to me that i need to take a look at this question because i've approached the issue in a very ad hoc sort of way in the past and on occasion i've had to go back and remove links when i realized what i'd done...

why does that even matter? well it's like this - i'm an anti-malware sort of guy and so links that lead people to malware or otherwise make it easier for people to find malware goes against my principles... i'm really not big on helping people find malware online, i'm more interested in helping people avoid malware, so links to malware are kinda counter-productive... also such links raise the search profile of the malware and make it easier to find with search engines like google... avoiding this kind of link really is not a problem, in fact it's quite easy to not link directly the malware...

on the other hand, sometimes a site has information on it that i really want to reference/cite in one of my posts, but the site also hosts malware... this is a much harder case to figure out the right solution... i could just be hardcore about my principles and say 'nothing doing' and maybe copy the information verbatim with author attribution...

how about if a site with interesting info only links directly to malware that's hosted elsewhere?.. you see where this is going, the shades of gray are a big headache... search engines caches of sites hosting malware would fall under this category, am i going to avoid using google's cache entirely? or simply not use google's cache as a way to get around my principles when they're inconvenient...

how about if a site with interesting info only links to other sites that have malware but not to the malware directly? even if the site is also anti-malware and just doesn't follow as strict a linking policy as me? that would be verging on the absurd...

after much deliberation i've come up with the following:

1. i will not link directly to malware
2. i will not link to pages (or caches of those pages) with links to malware
3. i will not link to domains (or caches of those domains) whose sole purpose is to distribute malware (like commercial malware vendors) or which make malware distribution a major part of their purpose (so vx sites are out, but most sans.org pages are ok)
1. unless the page i'm interested in linking to has no links that could lead back to malware (and just to be on the safe side sticking with no links at all is generally best for this exception)
   
4. i will correct any non-compliant linking when i find out about it

feedback

this post is a little towards the administrivia side but it's been something i've been thinking about for a while...

you'll probably notice that there is no way to post comments about my blog articles - that's intentional and there are a couple of good reasons for it...

the first is that by and large most of my posts here are rants - they're posted in order to get something off my chest, not necessarily strike up a discussion...

the second, perhaps the more important, is that i don't feel like providing yet another malware forum, much less have to maintain yet another malware forum (i'm already the moderator on a couple of malware discussion forums and frankly, i don't need to add to that list)...

and lastly, i just like having the last word, and rather that fiddling around with comments or arguing 'til i'm blue in the face, i just leave comments off... (i also don't have to deal with comment spam this way)

that said, i suspect people would find my blog more fulfilling if they had some means of interacting with me and maybe even changing my mind or holding me accountable for whatever errors they think i've made... i still don't want to create any new forum for discussion so i've decided to do something a little unorthodox - i'm going to direct people to existing unmoderated (so that there's no chance of me manipulating conversations) forums in the form of 2 usenet newsgroups - alt.comp.virus and alt.comp.anti-virus... i've also created a disposable email address specifically for feedback so you can email me here [edit: mailto link removed]...

[edit: adding new contact feature]
ok, i was using sneakemail.com to provide a disposable email address that i could use on this site, but mailnull.com has an even better service... the idea was always to prevent spammers from getting my real email address by having their bots parse my blog looking for anything that looked like an email address... the disposable email address allowed me to be contacted without revealing my real email address but the spammers could still send email to that address... mailnull.com offers a web contact form to go along with their disposable email service and that effectively removes all email addresses from the web page - so now you can contact me here...

[jan 1, 2007 - edit: this is probably the most changed page on the whole blog]
guess i'm growing soft in my old age, i've just enabled comments... so much for all my arguments against them...

funny business

having one blog is good... having 2 blogs is bad... so says whatever universal process/concept/thing it is that makes me post entries to the wrong blog...

ta da!

well, i pretty much knew this was coming... i knew i was going to create an anti-virus blog, i just didn't know when...

the time is now apparently...

criticisms, explanations, wishlists, and assorted rants to follow soon...