Marketing vs. Engineering

[Ron Lopshire]

From the Kaspersky Labs _marketing_ dep't:
(http://www.kaspersky.com/news?id=168124676)

Quote:
"This latest Virus Bulletin VB100% award once again confirms the
reputation of Kaspersky Lab products on the international IT market."

From the Kaspersky Labs _engineering_ dep't:
(http://www.viruslist.com/en/analysis?pubid=174405517)

Quote:
"It's also worth mentioning the tests conducted by VirusBulletin
(an industry publication) - I am sure that if I didn't include this,
readers would ask why the tests and the resulting VB100% award hadn't
been mentioned. Sadly, these tests are far from perfect. The test
standards were developed in the mid-1990s and have barely changed
since then. Antivirus products are tested using a collection of files
infected by ITW viruses. The award is given on the basis of the test
results. However, the ITW collection only contains between two to
three thousand files - fewer malicious programs than appear in the
wild in the space of a single month. Therefore, a VB100% award doesn't
necessarily mean that a product really provides protection against all
types of malware. It simply means that the product copes well with
VirusBulletin's ITW collection, nothing more."

As a user, I am pleased that KAV is an engineering-driven product.

BTW, I have seen others recommend VirusBulletin as a source of AV
information. I found that having to REGISTER in order to view the
results of the VB100% tests to be very annoying, and having to
PURCHASE a subscription in order to see how these tests were conducted
to be ignominious at best. As KL pointed out, the only
tests/comparatives worth mentioning are:

AV-Test (Andreas Marx - Germany)
(http://www.av-test.org/)
AV-Comparatives (Andreas Clementi - Austria)
(http://www.av-comparatives.org/)

And Web Site polls and reviews are, IMO, worse than worthless --- more
misinformation than they are worth.

Ron

 

[kurt wismer]

Ron Lopshire wrote:
[snip]

BTW, I have seen others recommend VirusBulletin as a source of AV
information. I found that having to REGISTER in order to view the
results of the VB100% tests to be very annoying,

yeah, the registration bit is (relatively) new... i was rather peeved
myself when i found out my vgrep keyword bookmark got cluttered by their
pointless registration system...

and having to PURCHASE
a subscription in order to see how these tests were conducted to be
ignominious at best.

i'm not sure that's really true... i haven't checked recently, but older
(much older) issues used to be freely available as pdf's...

As KL pointed out, the only tests/comparatives
worth mentioning are:

AV-Test (Andreas Marx - Germany)
(http://www.av-test.org/)
AV-Comparatives (Andreas Clementi - Austria)
(http://www.av-comparatives.org/)

??? no uni-hamburg for you?

 

[Ron Lopshire]

Ron Lopshire wrote:
[snip]

BTW, I have seen others recommend VirusBulletin as a source of AV
information. I found that having to REGISTER in order to view the
results of the VB100% tests to be very annoying,

yeah, the registration bit is (relatively) new... i was rather peeved
myself when i found out my vgrep keyword bookmark got cluttered by their
pointless registration system...

and having to PURCHASE a subscription in order to see how these tests
were conducted to be ignominious at best.

i'm not sure that's really true... i haven't checked recently, but older
(much older) issues used to be freely available as pdf's...

As KL pointed out, the only tests/comparatives worth mentioning are:

AV-Test (Andreas Marx - Germany)
(http://www.av-test.org/)
AV-Comparatives (Andreas Clementi - Austria)
(http://www.av-comparatives.org/)

??? no uni-hamburg for you?

Kurt,

Thanks for your reply. The VB Web Site is down for maintenance, but
IIRC, when I clicked on the link for the testing criteria, it took me
to the subscription page. I will try again when it is back up.

Is this 1) the link to which you are referring, and 2) is this site
still being maintained?
(http://agn-www.informatik.uni-hamburg.de/vtc/eng1.htm)

I am always looking for good sources of comparatives. IMO, this is the
only way to combat the purveyors of FUD. Opinions and polls are worthless.

BTW, I have seen a lot of people touting this article as a good source
of PFW information:

Long:
(http://www.informationweek.com/story/showArticle.jhtml?articleID=173402915)
Short:
(http://tinyurl.com/9g35k)

A poll! A poll, for crying out loud! And so Fred concludes:

"But two tools did stand out from the rest, garnering a combined total
of 70% of the reader recommendations: 43% of the respondents named
ZoneAlarm their top choice; 27% named Sygate."

Recommendation based on what? The one recommended is the only freakin'
firewall that most of these people have ever used! I once saw a forum
thread on a similar subject, and the thread devolved into which app
had the best skins. Skins as a criteria for choosing a security
product? Give me a break!

Of what possible use could a user poll be? Let's poll people for
automobile usage. The top 3 (in the US) will be Toyota Camry, Ford
Taurus, and Honda Accord. That means that many more people in the US
recommend these automobiles over Mercedes and Lexus. Beam me up
Scottie! Please!

Thanks again, Kurt. Sorry about the rant.
Ron

 

[Ron Lopshire]

Ron Lopshire wrote:
[snip]

BTW, I have seen others recommend VirusBulletin as a source of AV
information. I found that having to REGISTER in order to view the
results of the VB100% tests to be very annoying,
SNIP

and having to PURCHASE a subscription in order to see how these tests
were conducted to be ignominious at best.

Thanks for your reply. The VB Web Site is down for maintenance, but
IIRC, when I clicked on the link for the testing criteria, it took me to
the subscription page. I will try again when it is back up.

Kurt,

The VB Web Site is back up. What I was talking about was from this page:
(http://www.virusbtn.com/vb100/about/index.xml)

All links on this page require registration for viewing, except these
links, which require a purchase:

"The full test results are available in _Virus Bulletin magazine_.
....
Complete details of the most recent test results are available to
_Virus Bulletin subscribers_. "

These links are redirected to the subscription page. I did see these,
but assumed that these were not "full" or "complete":

Windows XP - June 2005
(http://www.virusbtn.com/vb100/archive/2005/06/complete)
(http://www.virusbtn.com/vb100/archive/2005/06/testsets)
VB 100% testing protocol

(http://www.virusbtn.com/virusbulletin/archive/1998/01/vb199801-vb100-protocol)
Short: (http://tinyurl.com/bkwpt)

Thanks again,
Ron

 

[kurt wismer]

Ron Lopshire wrote: [snip]

and having to PURCHASE a subscription in order to see how these tests
were conducted to be ignominious at best.

i'm not sure that's really true... i haven't checked recently, but
older (much older) issues used to be freely available as pdf's...

As KL pointed out, the only tests/comparatives worth mentioning are:

AV-Test (Andreas Marx - Germany)
(http://www.av-test.org/)
AV-Comparatives (Andreas Clementi - Austria)
(http://www.av-comparatives.org/)

??? no uni-hamburg for you?

Kurt,

Thanks for your reply. The VB Web Site is down for maintenance, but
IIRC, when I clicked on the link for the testing criteria, it took me to
the subscription page. I will try again when it is back up.

actually, what i was referring to was sort of a round-about way of
finding out the testing criteria... they used to have pdf versions of
some of the older issues online... i was thinking you might find one
that contained the test results and therefor the testing criteria...

maybe not though...

Is this 1) the link to which you are referring, and 2) is this site
still being maintained?
(http://agn-www.informatik.uni-hamburg.de/vtc/eng1.htm)

that looks like the right url... as to whether or not it's being
maintained, i think it is... don't let the age of their results fool
you; they don't run their test very often, once a year at best i think...

I am always looking for good sources of comparatives. IMO, this is the
only way to combat the purveyors of FUD. Opinions and polls are worthless.

distinctions between the major players based on detection rates aren't
worth much either, these days... they're all close enough together that
the one on top can (and does) flip-flop from one month to the next...
look at the long term track records, pick the product that suits your
personal requirements best, and keep an eye out for any emerging
downward trend in that product...

BTW, I have seen a lot of people touting this article as a good source
of PFW information:

Long:
(http://www.informationweek.com/story/showArticle.jhtml?articleID=173402915)

Short:
(http://tinyurl.com/9g35k)

A poll! A poll, for crying out loud! And so Fred concludes:

"But two tools did stand out from the rest, garnering a combined total
of 70% of the reader recommendations: 43% of the respondents named
ZoneAlarm their top choice; 27% named Sygate."

Recommendation based on what?

reader recommendations have no consistent basis... it's a popularity
contest...

 

[kurt wismer]

Ron Lopshire wrote:
[snip]

These links are redirected to the subscription page. I did see these,
but assumed that these were not "full" or "complete":

Windows XP - June 2005
(http://www.virusbtn.com/vb100/archive/2005/06/complete)
(http://www.virusbtn.com/vb100/archive/2005/06/testsets)
VB 100% testing protocol

(http://www.virusbtn.com/virusbulletin/archive/1998/01/vb199801-vb100-protocol)

Short: (http://tinyurl.com/bkwpt)

hmm... y'know, it would be nice if the webmaster spent less time on that
dumb registration system and more time on making sure links worked...
the only one of the above that works for me is the testsets one... that
said, it's a really good find... especially since the link to the test
sets that appears in the pdf mentioned below is broken...

the test procedures can be found at
http://www.virusbtn.com/vb100/about/100procedure.xml

a pdf of the issue of virus bulletin that the test appeared in can be
found at
http://www.virusbtn.com/virusbulletin/archive/2005/06/vb200506/pdf

(i found it at http://www.virusbtn.com/virusbulletin/archive/index)

 

[Ron Lopshire]

Ron Lopshire wrote:




that looks like the right url... as to whether or not it's being
maintained, i think it is... don't let the age of their results fool
you; they don't run their test very often, once a year at best i think...

Kurt,

I will keep an eye on this site (VTC). The thing that concerned me was
that the July 2004 Scanner Test is flagged as "New". And thanks for
the pdf link.

Ron