Re: Possible Virus
On Wed, 3 Nov 1999 07:17:25 -0500, Irv Mullins <irv at ELLIJAY.COM> wrote:
>On Wed, 03 Nov 1999, Everett Williams wrote:
>
>> I still feel that Eu is an open invitation to hackers to attack
>> and I don't believe that current virus checkers are liable to be able to
>> detect what can be done legitimately from Eu.
>
>I just don't see anything that makes Euphoria more or less vulnerable
>than any other programming language. Do you have the source code
>for all those Windows programs you download.? I don't think so.
No, but Euphoria, as most interpreter type languages, is by it's nature
viruslike in behavior and therefore difficult to check for virus action
before it is taken. Ninety-nine percent of those windows programs are pure
data and executable. They do not go through a transform(interpretation) to
take whatever action that they take. Virus checkers know how to look for
patterns imposed on existing executables. If the virus is written into the
program, the virus checker will probably not have a chance at it until it
takes a viruslike action. Those of us who have used virus checkers for a
long time know that active virus checkers suck up lots of cycles and set off
lots of false alarms. The solution to that is to only download from sources
that heavily virus check programs before putting them into downloadable
status. In general, I do that. The small nature of the Eu effort makes that
almost impossible.
>
>If not, how do you know that among those many megabytes of files,
>there isn't a little routine to read a seemingly harmless data file,
>transpose the bytes in one manner or another so it is restored to
>it's original "virus" form, and write it somewhere? No virus checker
>will detect that until the damage is already done. If there's a time delay
>involved, perhaps not until months later.
The fact that it has only happened once in 14 years makes me think that the
precautions that I do take are fairly effective.
>
>Even when you have the source code, I really doubt that you are going
>to wade thru each program in search of a tiny routine such as mentioned
>above.
I don't have to if the source is available someplace to be checked if
problems arise. I don't have to possess the source if I know someone other
than the author has a copy that can be checked.
>
>In the final anlysis, it's up to each of us to provide what protection we
>feel is necessary. Either run virus scans, or choose a less-vulnerable
>environment than Windows.
As I have pointed out above, Euphoria can easily create a situation where
such scans are ineffective.
>
>Regards,
>Irv
>
>Side note:
> symptoms: Windows running slowly, no free memory left.
> diagnosis 1: Virus cure 1: reload Windows from scratch.
> diagnosis 2: Windows cure 2: reload Windows from scratch.
>When both symptoms and cure are the same, maybe the disease is also
>the same.
No question that you are right on this point, but I am a consultant and must
run the environment possessed by most of my customers. If I chose to run
Linux or any other option all the time, I wouldn't be able to run about
ninety percent of the downloads available from the archive or use the major
libraries that are being written for Eu. I think that the emphasis in the
future should be towards creating a set of libraries that function across
systems and isolate the programmer from the underlying operating system.
This is not the current direction of most of the contributions to the
archive, but some of them could be warped to that purpose. I tend to agree
somewhat with Jiri's wry comments about the Microsoft hacker nature of most
of the current libraries. From his other comments, I know that he respects
these people, but wishes, as do I, that their efforts were directed
elsewhere. For example, if many of these 3D efforts were directed towards
OpenGL instead of DirectX, their potential for portability would obviously
multiply. If a portable GUI interface could be chosen or written, then the
non-game programmers among us could hope to write portable programs without
re-inventing the wheel each time. A portable language without portable
programs is at best a non-sequiter.
Everett L.(Rett) Williams
rett at gvtc.com
|
Not Categorized, Please Help
|
|
