Comodo Agrees to pay $50,000 to AV-Comparatives.org.....

[Guest]

[Melih]

Is it ethical to claim to be "independent" while providing data to "end user" disguised as "independent" with ZERO validation/auditing?

Time has come to arm the end users with information about the "reality" of these tests. It is no longer "ok" to disseminate information and pretend to be "independent". Its border line illegal to do what AV-Comparatives is doing according to FCC guidelines.

And when confronted to "flush" them with the offer of auditing, once again they find a way out, how original!

How about, for once, be transparent and give end users validated and audited data? Its totally unethical for AV-Comparatives.org to continue to provide these unsubstantiated, un-validated and un-audited information to public. Today they are NOT certified. Today they are still disseminating this misleading information. Shame on them!

I am sick of people who open their mouth and feed end users with "poison", time to stand up for end users! and I am sick of people who aid them without understanding what they are doing by aiding them!

Melih

[w-e-v]

But we take your word, after we get the accreditation, we would please you to donate the money to a charity organization we will tell you.

---

[at]melih:
The money argument: [...] be patient and please show how generous you are: If they get the ISO certification donate your 50k to "SOS-Kinderdorf".

I like the new game AV-Comparative.org is now playing.
Trying to draw money out of Comodo. Now they are asking the $50,000 to be paid to a charity organization they say they support. Its really good if they are doing that. Honestly!

But Melih's word are VERY CLEAR:
Comodo agrees to pay AV-Comparatives.org $50,000 for 3rd party auditors to validate AV-Comparatives.org tests

So dont try to come with your new users that have only 1 post and talk about where the money should go.
Money should go to 3rd party auditors to validate your tests.

In other words, AV-C would never have access to that money, so dont own it already and give orders where it should go, just because of an ISO process.

[SLE]

reply to melihs post:

Your only argument against there independence is that they take money from companies. (The same from all - so who has influence???) Tests cost money, peoples work should be paid etc.

If you repeat your points all the time they don't get stronger at all.

You criticise them for taking money and a few days later you suggest to help them with money for certification. At least: funny.

They were in certification process even before you jumped in...
__
If we wan't to critize those tests - we can: but than with real arguments! We could ask questions about methodology, about sample sets etc..

But beside that: Sad to see that none of my previous questions was answered.

What is ethical with your behaviour? Incomplete (=misleading by only posting excerpts) or complete information of people? Will you donate to "SOS-Kinderdorf" if they get the ISO certification?

[SLE]

reply to w-e-v's post:

So dont try to come with your new users that have only 1 post and talk about where the money should go....
Money should go to 3rd party auditors to validate your tests.
In other words, AV-C would never have access to that money, so dont own it already and give orders where it should go, just because of an ISO process.

Stop.
1) I have nothing to do with AV-C. Count on arguments not on the amount of posts - Thx
I read a lot of nonsense flaming (IMO) and decided to answer - what's wrong about it? Some problem with critical minds?

2) Melih said "I'll give you 50k for validation". They said "We are already in process of ISO validation...and don't need your money for that".

But I found the suggestion nice: If they get the certification Melih can show how generous he is and that there are more than just words. Will he spent the money for the children? Nobody said, that he should give the money to AV-C first.

[kail]

2) Melih said "I'll give you 50k for validation". They said "We are already in process of ISO validation...and don't need your money for that".

Unfortunately, the ISO 17025-2005 certification/accreditation is fairly meaningless by itself. But I guess you, and AV-C, are well aware of that. Which does make their assertions sound rather strange as far as any ISO accreditation is concerned. But, I guess you both must know that. Right?

However, if AV-C are, as you say, actually in the process of ISO 17025-2005 "validation", then there wouldn't be any harm in showing us the Scope document. It needs to published anyway and it shouldn't be changed because of the validation process. Or are you just making this up as you go along?

[w-e-v]

2) Melih said "I'll give you 50k for validation". They said "We are already in process of ISO validation...and don't need your money for that".

Show us where Melih did actually said that.
Melih never said that he will give 50,000 USD for validation.
You are mixing up everything.

Nobody said, that he should give the money to AV-C first.

Exactly! Melih never said that he will give the money to AV-C.
So neither them, nor you, can really say or suggest what to do with the payment.
Only the auditors would receive the money in order to audit the tests AC-V makes, so they become valuable to end users.

[w-e-v]

1) I have nothing to do with AV-C. Count on arguments not on the amount of posts - Thx

Forgot to say, its "cute" how you registered yourself to comodo forums only to participate on this thread.
Sure you have nothing to do with AV-C?

[kail]

The bit that I find fairly strange, and more than a little suspect, about all of this.. is that as far as I know you really need an audit (by external auditors) to validate/verify an ISO accreditation anyway.

[SLE]

Forgot to say, its "cute" how you registered yourself to comodo forums only to participate on this thread.
Sure you have nothing to do with AV-C?

Yes  - I'm very sure. Will you prove me the opposite? If you don't believe me - google my nick. You'll see that I often criticise AV-C Tests / AV-Tests at all in different security forums. So I hope this point is clear now. But i found this "argumentation" too interesting - so I jumped in.

Or have you anything against new players in (t)his public game?
__

About: ISO and AV-C, ok no validation. I was talking about post 6 in this thread ( http://forums.comodo.com/melihs-corner-ceo-talkdiscussionsblog/comodo-agrees-to-pay-50000-to-avcomparativesorg-t79151.0.html;msg567153#msg567153) - where Peter only talked about certification/accreditation.

But nevertheless - the post made clear that they don't need Comodo for that. But as Melih has made his offer in this public game - I found the suggestion that he should spend the money to a charity organization instead very nice.

But there was no clear reply to that - so I asked.
_
And: Nothing against you both. It was a clear question (beside some others) to Meilih himself which he didn't answered.

[kail]

.. where Peter only talked about certification/accreditation.

But nevertheless - the post made clear that they don't need Comodo for that. ..

Maybe not, but if Melih could see the scope of their ISO 17025-2005 attempt, then he might agree to pay for the external audit (which would be needed anyway). I didn't realise that AV-C were so obviously flush with surplus cash to reject that.

To me this looks awfully like ISO is being thrown around as some sort of sacred object without many of the throwers knowing much about it at all! To put it another way, I could pay over my $200 (or whatever it is these days), download the PDF & I also could cheerfully assert that I'm in the process of ISO 17025-2005 accreditation. It's truly that meaningless as it stands now and it makes me wonder what on earth is going on.

[SLE]

To me this looks awfully like ISO is being thrown around as some sort of sacred object without many of the throwers knowing much about it at all!

On that point I'm with you.

But beside all talking about the words "independent" and "validation/auditing"... My honest opinion is that you must criticise tests themself in there methodology etc. if you want to put some arguments.
But to start public flaming with releasing parts from E-Mails or NDAs where nobody beside the 2 parties knows which parts are left out and if we from outside really see the relevant parts of the story is nonsense. And when I then read that the same person is talking about ethics/moral it's just sanctimonious for me - Sorry.

And there are so many other tests out there that don't have the label "independent" but are not certified at all. But if Comodo is good in this tests all is fine? Come on - a little bit more objectivity. Nobody says that AV-C is perfect, but the whole discussion is more than strange. Look in other security forums, this is not good for Comodo. (In germany the tenor is often: the product is quite ok - but the CEO is an egoistic idiot)
 

[kail]

But beside all talking about the words "independent" and "validation/auditing"... My honest opinion is that you must criticise tests themself in there methodology etc. if you want to put some arguments.
But to start public flaming with releasing parts from E-Mails or NDAs where nobody beside the 2 parties knows which parts are left out and if we from outside really see the relevant parts of the story is nonsense. And when I then read that the same person is talking about ethics/moral it's just sanctimonious for me - Sorry.

Sorry? Yes, you probably should be. Couldn't see the wood for the trees eh? After all, you must have missed the bit where AV-C attempted to blackmail Comodo I guess.. it is why Melih released those emails in the first place.

[SLE]

where AV-C attempted to blackmail Comodo I guess.. it is why Melih released those emails in the first place.

Nobody really knows if it was only a language thing and beside all: Melih was the first (and only) who did it. And not only once, part for part, again and again: Emails, NDA ...
But even than: Was it complete - or do we only see what he wants us to see? I don't know. Creating trust online - wow.

Nobody would have said anything about REaction if there were some internals made public first by AV-C. But Melih was the only person who made things public - so  there was action.
Thats my wood...

[kail]

Thats my wood...

I see. Since AV-C are not contradicting what Comodo have published, you're seeing that as AV-C being noble, as opposed to being unable to contradict it. That's indeed some wood you've found there.

However, even if language was an issue, as some have claimed it was, then AV-C would have been completely insane to threaten Comodo in anyway whatsoever. But, that is exactly what they did. And with a deadline no less! This is your "action". It was the explicit threat, with the added deadline that forced Comodo's hand.

Of course, a threat with a deadline really does take this way beyond any plausible language translation issues. You don't act like that because of possibilities and maybes.


edit: missed a bit.

[loveboy_lion]

this is not good for Comodo. (In germany the tenor is often: the product is quite ok - but the CEO is an egoistic idiot)
 

By saying this what do you exacly mean
You only think this because he wants the truth out and want to support AV-C by auditing the test which is beneficial to users Do you find any harm in that unless something is really wrong in their results and tests
Or
You say this because he Provides security for free
In any case i dont think he is an idiot very few people out there do anything for free
and by the way how many CEO's do you know actively take part in discussing things with users
i don't know what you think but if he was an idiot he wouldn't be running comodo for so many years now that's for sure

[Tags:]