A Change in Perspective?

http://www.theregister.co.uk/2004/1...joins_av_zoner/

Picked up this link at one of the forums I frequent.

I wonder, how do the larger or more mainstream vendors view this
approach? Certainly, an argument could be made that this rewards a
person for his/her accomplishments. The counter argument would be this
sends the wrong message about values. Interesting....

optikl <optikl@invalid.net> wrote in
news:5GJkd.85285$R05.35004@attbi_s53:

> http://www.theregister.co.uk/2004/1...joins_av_zoner/
>
> Picked up this link at one of the forums I frequent.
>
> I wonder, how do the larger or more mainstream vendors view
> this approach? Certainly, an argument could be made that
> this rewards a person for his/her accomplishments. The
> counter argument would be this sends the wrong message
> about values. Interesting....
>

Hmm, not a single word about an A-V product at the company's
site mentioned in the article ("Zoner Anti-Virus is developed by
Zoner Software ...")

J
--
Replies to: Njk04s_130_p(at)Ojuno(dot)Tcom

In Message-ID:<5GJkd.85285$R05.35004@attbi_s53> posted on Thu, 11 Nov
2004 13:20:01 GMT, optikl wrote: Begin

>http://www.theregister.co.uk/2004/1...joins_av_zoner/
>
>Picked up this link at one of the forums I frequent.
>
>I wonder, how do the larger or more mainstream vendors view this
>approach?

We already know Fridrik Skulason's strident views on this and even the
more mundane activity of discussing virus authoring knowledge in an
academic setting from his comments about the University of Calgary.

>Certainly, an argument could be made that this rewards a
>person for his/her accomplishments.

or at least acknowledges the employment potential such a person's
accomplishments corroborate. like a left handed resumé <g>

>The counter argument would be this
>sends the wrong message about values. Interesting....

Values?
Isn't that just a happy talk, feel good term, that politicians and
salesmen (is there any difference) bandy about when trying to appeal to
the emotional rather than intellectual sensibilities of folk?

--

Bart

Bart Bailey wrote:
> In Message-ID:<5GJkd.85285$R05.35004@attbi_s53> posted on Thu, 11 Nov
> 2004 13:20:01 GMT, optikl wrote: Begin
>
>
>>http://www.theregister.co.uk/2004/1...joins_av_zoner/
>>
>>Picked up this link at one of the forums I frequent.
>>
>>I wonder, how do the larger or more mainstream vendors view this
>>approach?
>
>
> We already know Fridrik Skulason's strident views on this and even the
> more mundane activity of discussing virus authoring knowledge in an
> academic setting from his comments about the University of Calgary.

That's one voice. I'm curious about the consensus view, if there is one.
>
>
>>Certainly, an argument could be made that this rewards a
>>person for his/her accomplishments.
>
>
> or at least acknowledges the employment potential such a person's
> accomplishments corroborate. like a left handed resumé <g>

That's the one perspective.
>
>
>>The counter argument would be this
>>sends the wrong message about values. Interesting....
>
>
> Values?
> Isn't that just a happy talk, feel good term, that politicians and
> salesmen (is there any difference) bandy about when trying to appeal to
> the emotional rather than intellectual sensibilities of folk?
>

I think values run a little deeper than just talk. And yeah, there's a
big difference between values which come from some emotional level and
those which are based on well thought out principles. But I'm not
pushing any agenda, I'm just saying there are at *least* going to be two
sides to view this from.

Another perspective could be "who cares".

On Fri, 12 Nov 2004 00:09:18 GMT, optikl <optikl@invalid.net> wrote:

> That's one voice. I'm curious about the consensus view, if there is one.

My opinion. People change. They should be held accountable, for any
damages they've caused, but that's up to the victims, in conjunction with
the judicial systems.

Once a vxer matures enough to make better judgements regarding what's
worth doing (or not), I see no reason to exclude a competent programmer
or analyst from the av field.

Regards, Dave Hodgins

--
Change nomail.afraid.org to rogers.com to reply by email.
(nomail.afraid.org has been set up specfically for
use in usenet. Feel free to use it yourself.)

optikl wrote:

> http://www.theregister.co.uk/2004/1...joins_av_zoner/
>
> Picked up this link at one of the forums I frequent.
>
> I wonder, how do the larger or more mainstream vendors view this
> approach?

most think it's stupid... there was a blog post in the f-secure weblog
about some small-time av firm hiring a vx'er... it basically stated
that it was quite odd and questionable and they made it clear that
unlike the company in question, f-secure does not hire criminals...

--
"maxwell can tell he's in hell
just wants you to visit him there
same old game that he's playin'
his rules are never fair"

optikl <optikl@invalid.net> wrote in message news:<5GJkd.85285$R05.35004@attbi_s53>...

You already know my point of view - I think it is completely
unacceptable from an ethical perspective - and I think many of the
other smaller companies may share that view - after all, our ongoing
existence is based on our reputation.

The larger AV companies may share my views, but they have another
reason - a fear that their competitors may use the fact against them:

Company X sales person: "As you know, company Y employs people who
have written viruses. They may even have sold you software to fight
viruses written by their employees - do you really think you can trust
them to protect you - No, buy our software instead."

The advantages of hiring a former virus writer are relatively small,
compared to the potential damage to reputation and business. Why take
the risk? It is not even as if most virus writers are good
programmers anyhow. Some are, yes...but the vast majority of viruses
are written by people with very limited skills beyond that of
modifying code written by some one else.

-frisk

Fridrik Skulason wrote:

> The advantages of hiring a former virus writer are relatively small,
> compared to the potential damage to reputation and business. Why take
> the risk? It is not even as if most virus writers are good
> programmers anyhow. Some are, yes...but the vast majority of viruses
> are written by people with very limited skills beyond that of
> modifying code written by some one else.
>
> -frisk

I would tend to agree with Fridrik's point of view.

Fridrik Skulason wrote:
> optikl <optikl@invalid.net> wrote in message news:<5GJkd.85285$R05.35004@attbi_s53>...
>
> You already know my point of view - I think it is completely
> unacceptable from an ethical perspective - and I think many of the
> other smaller companies may share that view - after all, our ongoing
> existence is based on our reputation.

I would agree that an ethical conflict would exist, hiring a someone
currently active in the VX scene either as a programmer or a
groupie/spreader. But, what about someone who may have been there and is
now gone? And I'm talking about at what point might you consider someone
who has redeemed themselves? Do you withhold employment opportunities
forever to anyone and everyone who was active in VX, or do you make
judgment calls? I'm only asking 'cause I'm curious (the Socratic method
of learning). I don't have an agenda to push.
>
> The larger AV companies may share my views, but they have another
> reason - a fear that their competitors may use the fact against them:

Everyone who has competitors has to deal with fear, uncertainty and
doubt, regardless of what it is we sell. That's life

>
> Company X sales person: "As you know, company Y employs people who
> have written viruses. They may even have sold you software to fight
> viruses written by their employees - do you really think you can trust
> them to protect you - No, buy our software instead."
>
> The advantages of hiring a former virus writer are relatively small,
> compared to the potential damage to reputation and business. Why take
> the risk?

I don't know. But, if you can answer my questions above, I might understand.

It is not even as if most virus writers are good
> programmers anyhow. Some are, yes...but the vast majority of viruses
> are written by people with very limited skills beyond that of
> modifying code written by some one else.

Now that I understand. If the skill levels of those coding viruses is
that basic, you don't need them working for you.


Thanks for taking the time to share your perspective.

kurt wismer wrote:

> most think it's stupid... there was a blog post in the f-secure weblog
> about some small-time av firm hiring a vx'er... it basically stated that
> it was quite odd and questionable and they made it clear that unlike the
> company in question, f-secure does not hire criminals...

This one? http://www.heise.de/english/newsticker/news/52731