undefined | Better HN

0 pointsacoustics2mo ago0 comments

How is any kind of antivirus or threat detection software supposed to operate on this standard?

Libel suits can be financially catastrophic, so even a tiny false positive rate could present risk that disincentivizes producing such software at all.

And a threat detection mechanism that has a 0.0% false positive rate is conservative to the point of being nearly useless.

0 comments

rtsam2mo ago

I think that is the idea. They shouldn't exist without a prompt mitigation path.

In other words, if you can't deal with the false positives in a timely manner. You SHOULD be liable for the damages.

I can't build a budget car put together in an unsafe manner. Then complain I can't compete due to all the peoples cars crashing and blowing up and suing me.

kevin_thibedeau2mo ago

You document your claims with concrete evidence of fraud. That will be your libel defense. No evidence means you bear the full responsibility of a fuckup.

acousticsOP2mo ago

At internet scale, this would roughly be equivalent to not doing any warning or detection at all.

Scalable systems need to use heuristics to catch threats. Needing concrete evidence in every case means that an enormously higher amount of malicious resources will not be flagged.

There is a policy argument as to the right balance of concerns here. But there is a clear trade-off to make.

pocksuppet2mo ago

Then that heuristic is your evidence in court. If it's a good heuristic, you win the case. If it's a bad heuristic, you lose the case.

"Your Honor, we banned this person's website because his web page contained the word 'bitcoin' more than 5 times" will not hold up.

"Your Honor, we banned this person's website because it contains a bitcoin miner script. See, here is the script, and it matches the hash value found in these other attacks" hopefully holds up.

account422mo ago

No one elected Google to be the internet police. Why should we legally protect vigilantism on the web any more than we do in real life?

donmcronald2mo ago

> Needing concrete evidence in every case means that an enormously higher amount of malicious resources will not be flagged.

Giving everyone a fair trial just doesn't scale. It costs too much.

j / k navigate · click thread line to collapse