-=> Mocking Rod Fewster to Luther Kolb And Kurt Wism <=-
   
 RF> Aaaaaaaaargh!
 RF> If I'd read Luther's reply to Kurt earlier I could have saved myself a
 RF> message!
 
why would you want that? don't be shy, rod, we like your messages just
fine, you're as welcome as the next guy...
 > How do you know any given identification is exact ?  YOU DON'T!  ALL you
 > know is what the scanner tells you!  If Dr. Solomon says you have
 > One.Two.Three(a) how do you know your virus isn't really One.Two.Three(b)
 > or any of the other 350 variants ?  YOU DON'T!  In fact you don't even
 > know for sure that it's a virus!  ALL YOU KNOW IS WHAT THE SCANNER TELLS
 > YOU!
 RF> Yep ... right or wrong, that's ALL you know ... and the average guy in
 RF> the street has no way of checking the accuracy of the information.
 
it's all the average guy knows, i'm not an average guy... a) i know at
least some of the details of how the scanners work and b) i can actually
verify a virus is a virus, i know the distinguishing characteristic
behaviour...
 > Have you ever noticed that the only people who stress the "importance"
 > of "exact identification" are the anti-virus companies who claim to have
 > more of it than the next guy ?  Nobody else gives a fuck about it as
 > long as their scanners can clean up the mess.  Like Rod said, it's a
 > buzz-word for techno-wankers, worth about as much in real life as
 > reverse-fucking-piggybacking!
 RF> IMO, touting one scanner as "better" than another simply because it
 RF> accurately names (or purports to accurately name) more viruses _is_
 RF> a technowank ... but it's gotta be worth a lot more than "inverse
 RF> piggybacking".  :)
 
being able to accurately give a name is a side effect of the real issue,
as i see it... it's the certainty behind the diagnosis, when a scanner
is verifying that the virus is not only in the right place in the file
but also has all the right bytes, there's a lot more certainty there
than if you were to simply grep the file for a given scanning string...
that certainty translates into fewer false alarms (for obvious reasons)
and thus less unnecessary hassle for the user...
 RF> Jimmy Kuo (McAfee) raised a valid point in a.c.v a few days ago when
 RF> he said _no_ AV product tests are 100% independent.
 RF> If you think about this carefully, he's 99% right.  For example: even
actually, i have thought about it and as far as i can tell he's 100%
right... no matter who does the test, they will always have some kind of
bias, whether there is a good reason for that bias or not...
 RF> Jimmy _is_ 99% right ... if you pull _most_ "independent" AV tests
 RF> apart you'll find _some_ bias
bias is inherent in all av tests, but some of it is taken for granted...
sort of a philosophical point really...
jimmy isn't always so accurate though... usually, but not always, he's
human just like you, me, and every supposedly independant reviewer on
earth...
... in AV, the code that gets control first wins... boot clean!...
--- TGWave v1.20.b09
---------------