Re: Stealing a Great Idea from the 6600

On 7/29/2024 8:40 PM, Lawrence D'Oliveiro wrote:

On Mon, 29 Jul 2024 12:31:27 -0500, BGB wrote:
 

Would be nice if, maybe they could add a white-list or something so that
it can stop checking files it has already looked at recently (and which
have not changed).

 Any kind of exemptions from checking will sooner or later be exploited by
some piece of malware.

If a file's contents can change without something going through the filesystem APIs to change it... The system is already compromised.
If a file has not been modified, and was already confirmed good, you don't really need to verify it again...
Like, generally, "stdio.h" or similar isn't just going to randomly turn into a piece of malware on its own.
Similarly, when trying to build something like LLVM, one generally ends up with 'ld' trying to eat all the RAM, while Defender and AVG sit around trying to eat the CPU.
...