undefined | Better HN

0 pointsnyrulez7y ago0 comments

I am not sure I completely agree. If I know how my adversary detects and studies stealth code, I may be able to design better stealth code that is better at evading their methods of detection.

I mean the evolution of stealth tech in military has followed a similar path. As radar systems improve over decades, they keep on working on new ways to evade detection for aviation/missile tech.

I understand the high level point of good tools being more widely available to the white hat crowd, but I am trying to understand the argument that this is 100% better in all cases and there are no downsides.

0 comments

4 comments · 3 top-level

tptacek7y ago· 1 in thread

It's just another disassembler. There are a bunch of them already. It is, to the state of the art of reverse engineering, about as big a deal as the first release of Sublime Text was for programmers. It's hard to think of a "downside", or at least one that wouldn't be equivalent to "Sublime Text made it easier for people to code malware".

tedunangst7y ago

Should there be export restrictions on weapons grade text editors?

jcranmer7y ago

The main cat-and-mouse game with malware isn't in making disassembly/decompilation hard--quite frankly, the problem is simply too trivial--it's in trying to keep the malware analysis people from finding the malware in the first place. The "I'm being run in a VM for malware analysis, so don't trigger my payload in the first place" game.

andrewflnr7y ago

Nothing is ever 100% better with no downsides, except maybe drinking water. That's a silly standard.

The upsides of people getting it who aren't willing to break the law outweigh the downsides of bad people getting it more easily. Probably. That's the best you can expect with security tools.

j / k navigate · click thread line to collapse