Devil's Advocate
December 2nd, 2006, 01:13 PM
It strikes me that while Wilders might not be the most technically advanced forum on the net, most of us aren't super leet hackers, there's one thing where we are No 1.
That is in the use of HIPS. The average member here has used more brands of HIPS than the average user has used antiviruses.
We are the ones who drive demand for such products by recommending them to others. So we should be heard.
This is the thread for us to give generic advise to makers of HIPS (please no specific remarks about existing products).
My take (for us - advanced users)
Give us more control + no hard coded rules
Everything should be configurable. Something like Prosecurity is the first step in the right direction, but there are still many options that should be added.
No blackbox modules please. Don't worry if the settings are dangerous and needs a computer scientist to adjust safely, we are advanced users who can do it, or at worse recover from backups.
Make everything modular , so we can mix and match security products.
Also don't worry about us locking ourselves out by accident, we are advanced users we know how to recover.
If you are concerned about novices you can create two modes one for advanced users.
About Adding firewalls.
If you are going to add firewalls/ network controls, for god's sake, make it a real attempt, not one of those joke implementations that is practically unusable. We are advanced users we need to be able to set specific rules (by remote/local ip, port etc) in response to a prompt.
If not, please for the sake of God, allows us to turn it off, or better yet to not even install that component at the point of installation.
File/folder control
Please add this. I want to be able to protect my files and folders from being read or overwritten. Encryption is nice, but I want to protect the data files of my security programs.
I heard it's harder to protect files changes than blocking registry changes, but this feature is still not that common (short of sandboxes) so it is a feature to compete in. The whole process protection gig is getting a bit stale, everyone does it these days.
Tell us why your HIPs is better.
Don't be shy, tell us why your HIPS is better than the competitor's. I mean better in terms of protection, and not just hard to verify subjective stuff
like "our gui is better looking", "we are faster" etc.
Releases tests like Regdefend, APT, SSM's 2 hips test, CPILsuite etc so we can verify your claims. Or teach us enough technical stuff to understand why yours is better.
Add features that increase safety even if it is by a small amount.
Add features even if they are only a bit safer, every bit counts.
BTW I'm shocked for example to see that prosecurity uses SHA1 as a hash function. It's a new product it should be using SHA256 at least if not whirlpool. If I wanted outdated products I might as well use <insert you know what>.
Compatibility with other products
We advanced users will not just use your product as the sole line of defense no matter how good your product is. So you should ensure that your product doesn't conflict with other products.
Almost everyone here uses KAV , NOD ,Bitdefender, Antivir etc for example, it is criminal for a HIPS product to conflict with those! That's just a turnoff, and one of the few actors that will lead to auto rejection of your product.
Between KAV and your product, almost everyone will choose KAV over your HIPS, no matter how good your HIPS is.
If you have generic browser related functions, make sure they work in Firefox and Opera! A lot of us don't use IE at all (not so bad if it's IE only stuff like Activex).
BTW, a certain product which I shall not name has suffered and is not popular here, because it broke the last 2 points.
Also important is to ensure compatibility with popular HIPS like SSM, because most of us will be running more than one HIPS.
This is where your choice of beta-testers is important. Pick people who run all sorts of HIPS.
Rope in experienced members of Wilders into your team and establish a presence here
It is not enough just to post support in your own forums. Come here and personally answer questions , post updates.
Features that make operation easy
Okay so we are advanced users, but that doesn't mean you should make it difficult to use on purpose. Even we advanced users can get tired up answering prompts, so there should be features to reduce that.
Learning mode where every application gets 100% right automatically is passe. Who can ensure that his system is safe enough to run in such a mode everytime a new application is installed?
Make rules easily exportable, importable, so you can easily get new rules. I can imagine there will be fans of the product who will be willing to maintain rule sets or will be willing to create rule sets for applications you request.
We advanced users won't just blindly import any rules of course, but it helps.
That is in the use of HIPS. The average member here has used more brands of HIPS than the average user has used antiviruses.
We are the ones who drive demand for such products by recommending them to others. So we should be heard.
This is the thread for us to give generic advise to makers of HIPS (please no specific remarks about existing products).
My take (for us - advanced users)
Give us more control + no hard coded rules
Everything should be configurable. Something like Prosecurity is the first step in the right direction, but there are still many options that should be added.
No blackbox modules please. Don't worry if the settings are dangerous and needs a computer scientist to adjust safely, we are advanced users who can do it, or at worse recover from backups.
Make everything modular , so we can mix and match security products.
Also don't worry about us locking ourselves out by accident, we are advanced users we know how to recover.
If you are concerned about novices you can create two modes one for advanced users.
About Adding firewalls.
If you are going to add firewalls/ network controls, for god's sake, make it a real attempt, not one of those joke implementations that is practically unusable. We are advanced users we need to be able to set specific rules (by remote/local ip, port etc) in response to a prompt.
If not, please for the sake of God, allows us to turn it off, or better yet to not even install that component at the point of installation.
File/folder control
Please add this. I want to be able to protect my files and folders from being read or overwritten. Encryption is nice, but I want to protect the data files of my security programs.
I heard it's harder to protect files changes than blocking registry changes, but this feature is still not that common (short of sandboxes) so it is a feature to compete in. The whole process protection gig is getting a bit stale, everyone does it these days.
Tell us why your HIPs is better.
Don't be shy, tell us why your HIPS is better than the competitor's. I mean better in terms of protection, and not just hard to verify subjective stuff
like "our gui is better looking", "we are faster" etc.
Releases tests like Regdefend, APT, SSM's 2 hips test, CPILsuite etc so we can verify your claims. Or teach us enough technical stuff to understand why yours is better.
Add features that increase safety even if it is by a small amount.
Add features even if they are only a bit safer, every bit counts.
BTW I'm shocked for example to see that prosecurity uses SHA1 as a hash function. It's a new product it should be using SHA256 at least if not whirlpool. If I wanted outdated products I might as well use <insert you know what>.
Compatibility with other products
We advanced users will not just use your product as the sole line of defense no matter how good your product is. So you should ensure that your product doesn't conflict with other products.
Almost everyone here uses KAV , NOD ,Bitdefender, Antivir etc for example, it is criminal for a HIPS product to conflict with those! That's just a turnoff, and one of the few actors that will lead to auto rejection of your product.
Between KAV and your product, almost everyone will choose KAV over your HIPS, no matter how good your HIPS is.
If you have generic browser related functions, make sure they work in Firefox and Opera! A lot of us don't use IE at all (not so bad if it's IE only stuff like Activex).
BTW, a certain product which I shall not name has suffered and is not popular here, because it broke the last 2 points.
Also important is to ensure compatibility with popular HIPS like SSM, because most of us will be running more than one HIPS.
This is where your choice of beta-testers is important. Pick people who run all sorts of HIPS.
Rope in experienced members of Wilders into your team and establish a presence here
It is not enough just to post support in your own forums. Come here and personally answer questions , post updates.
Features that make operation easy
Okay so we are advanced users, but that doesn't mean you should make it difficult to use on purpose. Even we advanced users can get tired up answering prompts, so there should be features to reduce that.
Learning mode where every application gets 100% right automatically is passe. Who can ensure that his system is safe enough to run in such a mode everytime a new application is installed?
Make rules easily exportable, importable, so you can easily get new rules. I can imagine there will be fans of the product who will be willing to maintain rule sets or will be willing to create rule sets for applications you request.
We advanced users won't just blindly import any rules of course, but it helps.