|Main Archive Page > Month Archives > full-disclosure-uk archives|
Seems like McAfee choose to counter FUD by more FUD which triggered this : http://www.nruns.com/_downloads/PR-08-02_Reaction_to_McAfee_statement.pdf
I have been aware of the ongoing AV insecurity catastrophe but not read about this mcafee<->nruns discussion. Anyways a good read.
"n.runs welcomes the AV-Industry SDL (Secure Development Lifecycle) effort spearheaded by McAfee. While we greatly support the introduction of an SDL, it will not entirely extinguish flaws with security relevance. Although it has the potential of greatly reducing their number and impact, it will not lead to invulnerable software. In order to reach this goal, we consider it necessary to reduce the amount of trusted code to an absolute minimum, reduce the attack surface to an absolute minimum and place all untrusted code into a strictly confined environment. This way no matter how badly the code behaves, and no matter how many vulnerabilities it has, it cannot violate the security requirements."