Re: Virusscan

[Tomasz Cichecki <knight@kopernet.org>]

On Sun, 12 Jan 2003, Jord Swart wrote:

> All,
> 
> I know the the amount of virusses on Linux is close to zero, nevertheless I 
> was wondering if you guys know of a GPL-ed virusscan for Linux? I know McAfee 
> has one for Unices available, but I would rather not use it.
> 
> Second question to it: do you actually use one?
> 

Linux is meant to be attack-proof, its concept is different from that of
windows where you let another piece of software to guard your system
against attacks. On the other hand linux is not very attack-proof should
you use root account on regular basis - but that case is so stressed in the
litarature that very few users (apart of those who make their first
steps with linux and as they describe "want to feel power under their fingers") 
actually use root account for their daily tasks.
As a linux user you also has very little opportunity to get software
from an unknown source - take Debian as example - nearly all that takes
place in unix development is there in that or another repository - well
packaged, maintainer-signed (and this person isn't just someone who's
happend to write correct control and makefiles). Not to compare to
windows world - where all you get is or pirated software, or not well
written shareware/firmware (turning out to be also spyware): results
after sometime of using it you'll be forced to reinstall the system or
clean up with a software or so - that's why sometime ago I gave up the
windows world, but nevermind...
I want to point out that as well as in windows world the danger
of using a malicious written program exits in linux too. Though the possibility
of using a friend-handled program in linux is less because both of them
can download it from a well-known repository.
The virus scanners for linux are mostely used to scan incoming mail for
windows clients. There was only one example when I was infested with a
virus/trojan (whatever it was) - OpenSSL has a hole and if you had
apache-ssl/mod_ssl and gcc both installed the buffer overflow soon got
exploited. 
Nevertheless, I don't thing we'll need a virus scanner soon. Not unless
it's (linux) more common on desktop where the user is not forced to be a 
admin and a user at the same time. Linux, however, used in prodution
environment must be properly audited. It's easy to make updates with
dselect but I don't think you might trust it ultimately if you think
about business - you would have to hire people to make decisions about
updates - to take responsibility of how the system performs and
installation of software from other sources - just like you'd do if you
were running a commercial system.

knight
> Thanks very much,
> 
> Jord
> 
> 
> -- 
> To UNSUBSCRIBE, email to debian-testing-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
>