× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



From: Leif Svalgaard <leif@leif.org>
> If you had a malware checker
> that, for instance, could check a save file before you restored
> anything from it, you would have a somewhat better defense.
> If malware is detected, have the vendor explain what is does
> and why it is there.
A malware checker is not sufficient. It has the same problem as a virus
scanner; you can only update the malware checker after something has been
unleashed.

A much better alternative is to always retranslate anything that comes on
your system and not let it on if it can't be retranslated.  By always
retranslating, you can remove any viruses that *might* be there without
having to know for sure if there are any.

You can do this today in V5R2. Configure your system to force retranslation
of executables. Also use the service tools lockdown system values function
so no install exit can change the system during install and change it back.

Set QFRCCVNRST to level 8 (don't let anything on that can't be
retranslated). Anything that gets retranslated is guaranteed not to be
malware. If the application doesn't work after retranslating it's most
likely because patches added by the vendor, programmer, interloper were
removed. If it won't retranslate it's because: 1) the program was compiled
prior to V5R1 and had observability removed; the creation templates (that
are used to do the retranslation) were hacked in such a way that they were
not understandable by the translator.

Three system values in V5R2 now work as a set of filters that allow you
very tight controll over what comes on your system. QVFYOBJSGN, QFRCCVNRST,
QALWOBJRST. If you set all of these on your production system to their most
restrictive values and lock down system values, you have a system that is
easy to manage and difficult for anyone to distribute unwanted patched
programs to your system. When installing software from trusted sources you
have your choice of relaxing the system values during installation or, if
they have not informed you of any *non-standard* implementations or of
programs that adopt authority or use setuid(), you can install everything
at the strictest level. If the install fails or the product fails it's a
pretty good idea that the provider did something that could impact security
or integrity on your system that they didn't tell you about.  They either
didn't tell you because they don't understand security or because they
understand it very well and don't want you to know.

P.S. Retranslation is not related to observabilty in V5R1 and greater. You
can remove observability in V5R1 and still retranslate a program. Prior to
V5R1, removing observability removed the source code and the *translation
templates*. In V5R1 and greater removing observability only removes the
source code.

Patrick Botz




As an Amazon Associate we earn from qualifying purchases.

This thread ...

Follow-Ups:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.