full-disclosure-uk August 2008 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] McAfee + FUD ?

[Full-disclosure] McAfee + FUD ?

From: r0tten c0re <david.jonass_at_nospam>
Date: Tue Aug 05 2008 - 13:29:47 GMT
To: full-disclosure@lists.grok.org.uk


Hi all,

Seems like McAfee choose to counter FUD by more FUD which triggered this : http://www.nruns.com/_downloads/PR-08-02_Reaction_to_McAfee_statement.pdf

I have been aware of the ongoing AV insecurity catastrophe but not read about this mcafee<->nruns discussion. Anyways a good read.

"n.runs welcomes the AV-Industry SDL (Secure Development Lifecycle) effort spearheaded by McAfee. While we greatly support the introduction of an SDL, it will not entirely extinguish flaws with security relevance. Although it has the potential of greatly reducing their number and impact, it will not lead to invulnerable software. In order to reach this goal, we consider it necessary to reduce the amount of trusted code to an absolute minimum, reduce the attack surface to an absolute minimum and place all untrusted code into a strictly confined environment. This way no matter how badly the code behaves, and no matter how many vulnerabilities it has, it cannot violate the security requirements."

Regards,
David



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/