why anti-av is absurd

in point of fact, both anti-av and pro-av are absurd... i'll explain why in a moment...

given my comments about dancho danchev's anti-av leanings in my previous post, i anticipate there will be a number of people thinking (though not necessarily bothering to say it to my face) that i'm the polar opposite - fanatically pro-av... indeed, this has already happened in the past as there are those who wonder about my sanity, consider me an av extremist, and think i belong on the list of the 6 dumbest people in IT security (an homage to ranum's largely ill-conceived 6 dumbest ideas in IT security)...

let me ask you something, though... does it make sense to be pro-hammer? how about anti-screwdriver? would you sit on the fence about a tape measure?

av, even if we accept the retarded interpretation of the term (somewhat more forgivable from average joe public since s/he has an excuse for not knowing better) as just known-malware scanning, is just a tool - no more and no less... it's a tool that is remarkably good at a narrowly defined set of tasks: detecting known-malware for the purposes of prevention, and connecting known-malware incidents that aren't prevented to expert knowledge of the malware in question (by identifying the malware) for the purposes of diagnosis...

being anti-av is like being anti-hammer or anti-screwdriver (and likewise for being pro-av, pro-hammer, pro-screwdriver)... it's a tool (not a religion or a political party), and there are times when it's the appropriate tool to use... those who would completely drop it in favour of some other supposedly superior technology, those who would complain that they relied on av and it let them down, are the very people who never learned the lesson about how when all you have is a hammer, everything looks like a nail... known-malware scanning is a tool, whitelisting is a tool, sandboxing is a tool, behaviour blocking is a tool, heuristic analysis is a tool, etc, and i use and advise on the use of most all of them - security practitioners better than anyone should understand the importance of having a well equipped security toolbox with a variety of tools for a variety of jobs... only the naive would think that the entire malware problem could be comparable to just hammering nails and thus require just one tool...

and since i do make use of all 3 preventative paradigms, it's hard to imagine how i could simply be pro-av... i'm pro-knowledge - i think people should know their tools, what they can do and what they can't, and know the problem so that they can choose and use the tools appropriately... it's really a shame when people commit the anti-malware equivalent of trying to hammer screws into wood, and not nearly as funny...

not enough innovation

you know the anti-av revolt is gaining momentum when you can start picking out repeating patterns in the propaganda... anti-virus is dead was one such pattern but here's another one i've seen plenty of times: there is "not enough innovation" in the anti-malware space...

whenever i read the "not enough innovation" claim i imagine a small child in upper management's body squinting his eyes, stamping his feet and yelling

i don't care how intractable the problem is - fix it, FIX it, FIX IT!

the essence of it is the belief that the people actually doing anti-malware aren't doing enough or aren't doing it right... the answer to this is really quite simple, however... if you think it can be done better then you must know something the people who are actually doing it don't know... if you know something they don't then it seems like you should be able to do it better... if you think you can do it better then get off your lazy butt and fix the problem yourself (or at least make concrete suggestions) - otherwise shut your pie-hole, or at the very least concede that you're talking out of your arse...

there's little in life that annoys me more than people eager to complain about a situation but unwilling to do anything to fix it, and that's precisely what vague, nebulous claims of "not enough innovation" represent...

the anti-av revolt

i briefly made reference before to a growing anti-av revolt... that is the customer base for the anti-virus/anti-malware industry rebelling against the industry out of some perceived wrong-ness in it... i'm sure you've probably heard of people who swore off anti-virus years ago, likewise readers of this blog probably recall more overt manifestations of this revolt such as the "anti-virus is dead" campaign or more topically the "race to zero" contest...

usually it's been technically possible to write off individual av detractors as uninformed cranks, but their numbers are growing and their pool of influence is increasing... bruce schneier crying conspiracy when f-secure attempted responsible disclosure with sony was just the tip of the iceberg... now there are a variety of security experts lending their voices to an escalating sequence of expressions of dissatisfaction with the anti-malware industry...

and it's not even like they don't have just cause to be dissatisfied - they do... vendors have let their marketroids run amok for decades, building false expectations of protection in the customer base that are so in-grained we may never be able to undo them, and then predictably failing to live up to those unreasonable expectations...

on the other hand, however, the marketing folks were just telling people what they wanted to hear... there's a school of thought that says if a marketing person isn't showing you a rose-coloured-glasses version of the world then they aren't doing their job - anything less and they hurt their own company by admitting the product/service isn't the best thing since sliced bread... that's generally not a good idea in a competitive market as your competitors will capitalize on that as a display of weakness...

furthermore, there's no good reason for people to actually believe the marketing... a real life whopper doesn't look as perfect and juicy as the one on tv, beer doesn't come with a bevy of buxom beauties all playfully vying for your attention, and cars can't leap over traffic to get you where you're going faster and with a funky soundtrack... we've all learned these things through our real-life experiences and we should have also learned that anti-virus software cannot provide complete protection so why are people getting so bent out of shape over the inevitable failures?...

it really doesn't make a lot of sense but that's the irrationality of the human element for you... unfortunately i don't think it's good enough to just observe the fact and then go on about you're day like it was business as usual - not if (as i suggest) the problem really is escalating...

this may be hard for most to believe but there's actually been a long history of cooperation between competing companies at the more technical levels... this hasn't held true for marketing however; these are businesses after all, they need to make money and generally that's at the expense of their competitors... on a technical level, anti-malware vendors have always had a common enemy - the malware writers - but on a marketing level their opponents have always been each other... now the various marketing departments have a common foe as well (the anti-av movement), but it remains to be seen if they'll recognize their common interests and start working together as the analysts/researchers have...

the industry needs to get serious about image management... they have to start working to repair the damage their marketing departments have done to the public's perception of both the technology and the industry... that means not selling snake-oil in order to pander to unreasonable desires for complete protection (mcafee total protection)... that means putting your creative new technologies into your existing products instead using them as creative new ways to bilk more money out of customers and thereby reinforcing the image of av as blood sucking parasites (norton anti-bot)... and that definitely means not saying asinine things like the malware problem is solved...

it also means marketing something other than scanners... it's all the vast majority of the public knows and it's all anyone seems to think the industry produces... it's like they've been going to the same grocery store for years but only ever went down this one particular aisle, they're barely aware the rest of the store exists and they're getting fed up with what they're finding in that one aisle... they need to be made aware that scanning alone isn't enough (something the more technical members of the industry have freely admitted in public forums for a decade or more) and that the vendors have other technologies available besides just scanners...

much of the av industry is at the mercy of the big 2-3 av companies, unfortunately... it is those companies that have the most influence over how people perceive av but it is also those that would suffer the least by the destabilizing effects of their own PR gone awry... those with the most capability to do something positive have the least motivation to shape up, and if they just keep on keeping on then the public's perception is unlikely to change and the anti-av revolt will continue to grow...