On Sun, 04 Jan 2004 21:55:49 EST, Harry Hoffman <hhoffman@ip-solutions.net> said: > I'm not sure that not protecting against known threats is a good idea. The > willingness to accept a "0-day" is limited by the necessity of Internet usage, > which (usually today) is a nesessity. On the other hand, your system getting wiped out by a nuclear blast is *also* a known threat, but one which most people don't bother with protecting against because the cost-benefit ratio sucks. > Not to protect against known virii would be negligent and lazy which is why > most > modern OS's provide these "fixes" as patches to eventually become part of the > main OS. My point was that if the goal is to provide actual protection for the end user rather than something that looks good next to a ruler, you quickly reach a point of diminishing returns in trying to include more signatures. At some point, what you should be doing to maximize return is saying "screw it, that's enough viruses, let's look at bundling Thor Larholm's Quik-Fix in here". Also, consider this - if the product is otherwise good, which does more good to the user community - release *now* with a database of 75 signatures that catch 99.8% of the stuff, or hold off for a year while we track down the 650 additional signatures needed to push it to 99.9%. The case can also be made that failing to do something "quite good" now because you're waiting for " almost perfect" is even more negligent than putting in "quite good" knowing there's only 2 or 3 9's rather than 4 (especially when the known risk of a 0-day is much higher than the extra 9 of protection against old stuff).
Attachment:
pgp00005.pgp
Description: PGP signature