AV-Comparatives.org, bullying, censorship and financial deals-continued...

One would speculate saying one of the main reasons is: “AV-Comparatives does not want external auditors to audit them”.

But of course AV-Comparatives should reveal why they left AMTSO.

I’m starting to suspect something here… could it be that X, invents a product that is better than most products and then, to be able to reach people and to be able to better spread the word about it, he goes to these testing co. who dismantle his product and find out everything about it’s “innerworkings and the works”, and then, these testing co. blackmail X with releasing the secret “innerworkings and the works” of his product to the public !!!

IF (before flaming, remember this is just a suspicion) so… then there is no wonder I’ve struggled so long in my searching to find a truly good product that can protect my pc, paying money to use all the “top dogs” products only to get infected after, then reformating and then doing it all over again… I’m wondering if I’m starting to see where my money truly went… and why in fact I wasn’t able to buy protection for those money and in fact got malware instead… It seems that the SYSTEM IS CORRUPTED and that’s why MALWARE PREVAILS.
I’m starting to understand your reluctancy in putting your product in the hands of these testing co. Melih… it seems that you are doing the proverbial “pact with the devil” when doing it… Let the people spread the word about your product, and not these testing co. All they want is profit, they do not want to help protecting the good people of this world.

Funny thing, just when I wrote this, a mortuary march passed by my house… someone died.

Oh, GO 99%, the world is behind you, u guys are in our thoughts !

It seems in 2009 they find it unneeded and might be to expensive for them 88)
http://www.av-comparatives.org/forum/index.php?page=Thread&postID=3335&highlight=amtso#post3335

From AV-C:

"Melih continuously stated in his forum that we get paid by vendors, and insinuated that the payments have an influence on the results. "

Yes, they DO get paid by AV vendors and yes they MIGHT be influenced by money to put some AV products higher in rank than others. However this cannot be proven and should remain a speculation.

The FACT here is that AVC has a BIG influence on a products marketing and sales if AVC ranks it’s products DETECTION on high. The flaw here is that DETECTION means NOTHING compared to PROTECTION. They have an outdated view of AV testing by believing that DETECTION is THE SAME AS PROTECTION. If you detect malware, then you can stop it, right? Wrong! There are many AV’s that detect malware AFTER the damage has been done. You might have a product that detects 99% of malware, but what good is it if they are not stopped? And what about the 1%? That is still 1.000.000 pieces of malware let through out of 100.000.000.

As was stated in the Fee agreement, vendors can use the AVC logo for marketing purposes, meaning that AV vendors can put an AVC logo on their products, showing that it was tested by AVC and thus you can ‘trust’ it, boosting the products ‘trust’ and feeling of ‘safetey’, while in reality the product may provide less protection that those that scored very very low on avc (i.e: Comodo?).

For me AVC is like the FDA, creating false trust. They claim they use an AUTOMATED testing procedure and release results every 3 months or so? How many products do they test, about 20? How much does it cost to hire 1 person to test 20 AV products in 3 months time manually (like a real user would, i.e. Languy99 on YouTube) ? AV products will be used by people and NOT by robots! Or are they using this ‘automated testing’ thing as a protection when people claim that the tests are not accurate to reply that the tests were performed by an automated system and thus is more accurate than a human tester?

Bottom line,my opinion is that AVC is just a “marketing through trust” merchant where you can buy “trust” by having your product tested and results put in a ‘roulette’ of other vendor’s results, hoping your product would come out as highest ranking and use this in your marketing. For a couple of thousand dollars, you can also enter your AV into this roulette…who knows, you might ‘win’ this time? :smiley:

Here you can find AVC’s point of view and more clarification on what this ‘misleading information’ is:

http://www.av-comparatives.org/forum/index.php?page=Thread&postID=3798&highlight=comodo#post3798

LOL…once again Transparency and Honesty is an issue…

I think AV-Comparatives should reveal the real reasons why they left AMTSO.

Would you be so upset, too, about all this testing, if the tests would have shown comodo on top?

Why did you make the agreement with that company in the first place, if there are these points (amtso?, procedure) which suddenly are your only opinion about all what they do?

This is a very inacceptable accusing.

We are not in a spy agent conspiracy movie here.

My views, from day one, was clear about the irrelevancy of these test…btw…we did score high
here is what Andreas from AV-Comparatives said:

" Furthermore, your ~90% is higher than what some few other products scored and similar to what other well-known products reached. You will see " (in my blog).

One cannot claim to be independent without a 3rd party validation while getting paid for those tests!

Temporary post:
Could you correct the quote?
As the former quotes are not visible in quotes, the “inacceptable accusing”-quote is out of context in your post :wink:

So I am working on a new piece for my blog and need everyone’s thoughts. If you believe this test is not independent then how should a true independent antivirus testing group work and be funded? IGL Security:: What is an Independent Antivirus Tester?

Its not about believing if this test is independent or not. We “want” to believe it, but how can we believe it without a 3rd party validation? The whole world works with 3rd party auditing and validation, why should AV-Comparatives be different?

The issue is not about payment…its about honesty…if we could have “transparency” and “auditing/Validation” of these methods/tests, then there simply is no problem with accepting payment for them.

How do you believe it should be validated? It is really possible that a AV testing group can be validated?

of course!

Auditing exist and for well documented processes, there are many firms out there who can audit processes and provide their report. Its not about Auditor testing malware…its about auditor auditing the tester while the tester is testing malware…it ain’t rocket science and many respectable firms out there who will do it.

Then what about other AV/Firewall testing groups? Have the other groups of testers that have tested Comodo (matousec, VB, AV-Test| I can’t remember which of those last 2 Comodo was in) been validated?

No. But they don’t call themselves “independent” or claim that only good AVs make it although they can’t test all AVs, or hide financial details. Also likes of Matousec makes all their tests available so that you can reproduce their tests, unlike AV-Comparatives.

AMTSO would have been a great initiative to standardise all this but AV-C dropped out of it, most likely because they didn’t want External Auditors to audit them.

http://www.matousec.com/matousec/about-us.php

http://www.matousec.com/services.php

Here they are very descriptive about what they do, and they clearly explain their services and also mention that they charge for them.

Well said, and as speculations, should not be spread as truths without well-grounded proofs (that is to say, proofs that would not open to a wide range of possibilities). If one speculates, a rigorous research of proofs must be done and then properly documented. This would make for a more persuasive argument and would thus be legitimate in its claims. This mudslinging acts are further marring the situation. It’s blown way out of proportion in my view.

see here: https://forums.comodo.com/other-security-products/retrospective-test-november-2011-t78699.0.html

Well, I don’t view it as that, that detection should be the sole basis for trusting a product. I understand that systems are just as unique as its users (as a matter of fact, I’m preparing to write an essay about this. still doing some more research), hence, needs vary. Detection is ONE of the MANY criteria to consider in choosing a product. This is something not many people understand.

“Malware detection rate is still one of the most important and reliable factors in determining the effectiveness of an anti-virus engine which works without asking for user interaction, decision or opinion.” -From AV-C

This is a clear attempt in objectifying the basis for choosing products. Because detection can be objectively measured, but not protection (because protection is subject to vary per person depending on the current level of knowledge he possess about his system. Objectifying protection cannot be successfully done without causing misunderstanding. For example, product A claims to protect 100%, but has compatibility issues with system A and causes system A to crash, or product B claims to protect 100% but is entirely user-dependent and since user B has little working knowledge of systems, allows malware in anyway. Protection cannot be measured as it is a very general criteria and varies from person to person. One way of trying to measure it is by measuring INDIVIDUAL COMPONENTS of protection i.e. Detection rates).

Their methodology is included in their website and can be downloaded from there. I have attached the file here for faster access.

They include in their test summaries these lines:
"Do not take the results as an absolute assessment of quality - they just give an idea of who detected more, and who less, in this specific test… Readers should look at the results and build an opinion based on their needs. "

“We do not give any guarantee of the correctness, completeness, or suitability for a specific purpose of any of the information/content provided at any given time.”

It would seem that only the vendors propagate this “Detection is Everything!” marketing strategy.

Trust cannot be commodified as it is an abstract object and without a clear definition of its nature. Trust cannot be forced upon anyone. Only influenced. People choose the highest detection? Ok, sure. What about others? My colleagues, I and my brother choose products that are consistent in their records. Which means we shift through records to identify reliable companies. Since there has been no formal statistical collection of the number of users and how they base their judgment on choosing products, we cannot assume that AV-C has such a huge influence. Maybe on the more technically inclined, but certainly not average users. In my university, only three of ten people (on a sample size of 1000 users collected in ten months time. This is an informal statistical collection by the way done in 2010 by me and two other friends in their colleges) are aware of AV-C and only 1 of ten base on AV-C results as a SOLE criteria. So claiming that AV-C has a huge impact on the general public does not seem to appeal to me much.

[attachment deleted by admin]

Melih, I’m very well aware of your thoughts concerning protection vs detection/cleaning. You even have posts about it. And I applaud you for them.

However…

what exactly do you wish to happen with this argument of yours between av-comparatives? Are you threatened by other AV companies as well? As I see it, AV-C have done nothing as of now that would gravely affect your share of the market. You do realize of course that by your claims with AV-C, you are also stating that other vendors are using underhanded tactics, and thus publicly discredit them. And you are discrediting companies such as Norton, GData, Qihoo, Avira, Kaspersky, Eset, FSecure, Bitdefender and basically every other vendor that scored high now and in the past, implicitly (or perhaps may be even explicitly) stating that they are paying AV-C more than what is required to have better results.

Would it not be better if say you have other views for testing antimalware products to establish your criterias of how testing should be done? Then have this critiqued by various sources and then post it as research material. I’m sure there are ten or a few others more who are more than willing to collaborate with you.

I see no reason why you should engage in such a futile argument as this with AV-C.

And for those others who seem to be in paranoid mode,

I am in no way affiliated to any company (for crying out loud people, this isn’t one of those conspiracy movies we see in the theaters). I am not a spy. I am not anything but a Literature major whose hobby is internet security. Speculate if you must, but back it up with legitimate arguments and not with proofs that you just happened upon while searching for keywords. I myself don’t know the truth. So I seek it.

Calm down. We have yet to see the truth so don’t go jumping into conclusions and spreading word about it the first chance you get. Otherwise, we’ll see this thing blown too much out of proportion and soon lawsuits and mudslinging and other forms of politicking follow. This is tiring me.

Have you read my blog to see what started this?

Are you serious? (I am not Melih, but I was urged to answer this, sorry for being nosy)

Have you read everything he posted? Then you would understand why.

Internet is about sharing information in many ways.
This information heis sharing is for the benefit of all of us, and believe it or not, that includes AV-C itself.