Comodo Agrees to pay $50,000 to AV-Comparatives.org.....

[SLE]

@kail post:220

Indeed, Mr 21 Posts per day and rising!

Funny argument!? A few days ago I was attacked because I only had 1 post.
If questions are not answered and others always write exactly the same again and again and again and again…I thought I play this game a while, too. Maybe it is a unwritten rule?
But I’m not in the position to complain…cause it’s not my corner
Sometimes I ask if Melih has some shortcuts for his repeating answers…enough i was just joking, I stop.

@kail post:220

BTW… Do you mean “innocent until proven guilty”

Yes.
If not: Everbody could come and claim something or attack somebody and the attacked person/organisation must justify? Strange logic, indeed.
To summarize: After all those posts we have seen no real proves for wrong tests or for the fact that vendors pay all the same has any influence - only attacks, assumptions and suggestions.

We have seen no clear guidelines that force AV-C to say this in any report or to talk about the amount of money everybody pays. (btw.: How much a test costs I learned from somebodys blog where the NDA was broken. And to be honest: I thought the tests were more expensive)

We have only seen Melihs wishes, his understanding of transparency. It’s ok - but it’s no law. So - why should anybody/AV-C care? And why after all? Why should they still trust a person who released E-Mails and parts of the NDA?

[Melih]

@SLE post:217

Thats ok, i believe you. Nevertheless allow me to wonder why you joined.
I’m not the person who can decide generally who to believe and who not. Such decisions everybody must make for his own, yes there can me more or less relevant criteria (like audits etc.)

But I said many times: Guiltiness must be proven. And not the opposite.
An no: I do not think that they should write everytime and everywhere that av-vendors pay. (If they never would write it - than indeed it would be a problem for me, too. But that is not the case.)

And also your posted guidelines don’t contain a clear hint that it has to be written everwhere and everytime. And really: look all at example 1 in that guidlines.

It’s your right to say that you don’t trust them, but it’s not ok to generally argue that they are not trustworthy at all - without clear facts of influence on tests! Huge difference.

Independence…

• yes they and there tests depend from money (like nearly everything in this world): technologies, people, infrastructure … all has to be paid. Normal. Even Comodo needs money - at least I believe.
• every vendor pays the same: so we can assume, that nobody has a specific influence
• they define their test-design by their own: here they are independent
• the payments have no influence on the results: here they are independent

Thats for AV-C! And as long as nobody proves the opposite we can believe it or not.
What we can criticize and discuss are methodologies, test designs etc. (and many vendors do so) Cause there we can work with special examples etc. (and many vendors do so). But nobody critisies only for the part that tests are paid and that fact isn’t written everwhere. Nobody ever released NDAs and Mails.

And if AV-C has no trust in you after that - it’s understandable for me. It’s also understandable that not everybody will discuss such things in public and jump into your game. That doesn’t mean that the one who shouts loudest in public is right

Once there is doubt, proof must be provided. This is how the whole industry works by auditing. All big comopanies provide auditing to prove their financials…they don’t say to their shareholders prove we are guilty first…we are not talking about “criminal” case…we are talking business cases here…Also, AV-comparatives.org clearly agree with the need to provide proof, hence they claim they are getting Certification which has to be audited.

Do you have a proof about “every vendor pays the same” assertion? how do you know that?

As per FCC guidelines it is clear that where-ever they publish their report, they must state that it is paid for. Its pretty clear.

As to releasing emails: According to AV-Comparatives, they first said they were going to release confidential information… We did not initiate it. AV-Comparatives threatened first.

SLE, can you pls answer my questions:

coming back to the point again you never answered and in the sipirit of decent discussion i think you should answer as I tried to accommodate your answers: There is no proof that AV-Comparatives tests are validated. Do you have any proof? Now that there is enough question marks about their conduct its fair to ask proof as trust has gone.

AVC should stop calling themselves independent and clearly mark these tests as paid tests, don’t you agree?

[SLE]

Ok, compacted my answers again:

@Melih post:222

Do you have a proof about “every vendor pays the same” assertion? how do you know that?

No, cause I don’t work for them. But I have no reason, no proof not to believe that fact.

@Melih post:222

There is no proof that AV-Comparatives tests are validated. Do you have any proof?

No, time will tell. But again I have no reason, no proof to believe that money has influence on test results.

@Melih post:222

AVC should stop calling themselves independent and clearly mark these tests as paid tests, don’t you agree?

No. For me it is clear and long time known that they are paid. And I have no proof that payment has any influence on methodology or results, and so I for me assume that the tests are independent in that cases.

And for all 3 cases you couldn’t give me any proof.
__

@Melih post:222

As per FCC guidelines it is clear that where-ever they publish their report, they must state that it is paid for. Its pretty clear.

They state this in methodology. Please cite the sentence which forces them that they have to write it clear in every report!

@Melih post:222

Once there is doubt, proof must be provided. …

No. Complete off-topic - example: Even those days I can find malware samples signed by Comodo. No I have doubts that this is accident and you don’t know it when you sell your certificates. Put up evidence…

[Melih]

@SLE

I am glad you agree that AV-Comparatives.org have no proof or validation of their testing methodology.

[SLE]

@Melih post:224

I am glad you agree that AV-Comparatives.org have no proof or validation of their testing methodology.

And you have no poof for the opposite. So “innocent until proven guilty”
We have a classical draw and a lot of words…

[kail]

@SLE post:225

… So “innocent until proven guilty” …

I think not. Please see my post that you only partially cited for some reason. 88)

As there’s a lot repetition, I’d better join in to help you out.

@kail post:220

…
BTW… Do you mean “innocent until proven guilty” (as in the legal English term a presumption of innocence)?

Does that apply to entities? Given the way governments act with regulators and such, I’m not sure it does. I genuinely don’t know, I’m just asking.

edit: No, possibly not. According to EU Law it seems to only apply to EU Citizens and residents. But, then again IANAL and not very familiar with corporate law, EU or otherwise, outside of my direct experiences of it.

In the corporate world I don’t believe there is a presumption of innocence. I doubt that anybody could afford such a presumption anyway and that’s also probably part of the reason why we have auditors in the first place.

[Melih]

@SLE post:225

And you have no poof for the opposite. So “innocent until proven guilty”
We have a classical draw and a lot of words…

LOL…

in business world thats not how it works…it would be chaos…

So all you are saying is: While AV-Comparatives gets paid from Anti-Virus vendors, we should simply “trust” them when they said they are being fair …why didn’t i think of that

AV-Comparatives have lost end user’s trust by misleading them about where their money comes from…Just like any other company (including not for profits)…they are accountable and they have to prove to the government about their revenue and spendings. I doubt very much if Austrian government will take the word of AV-Comparatives about where they get their monies from I am sure they will want an audit of their financials.

[SLE]

@kail post:226

I’d better join in to help you out.

Generous

But I thought I made clear that it is a strange logic if everbody could come and claim something or attack somebody and the attacked person/organisation must justify. Is this really US-law? And btw. in other law rules it’s not ok to release NDA parts (and they forced us is no argument…). But that I also said many times - so enough.

And beside that: Only time will tell and show, AV-C never said that they are not looking for certification or auditing. They only don’t need and want Comodos support for that.

So we can only wait. And at least I believe that the fact others pay AV-C has no influence on test methodology and results. Until someone brings proofs for the opposite.

[kail]

@SLE post:228

Generous

I know.

@SLE post:228

But I thought I made clear that it is a strange logic if everbody could come and claim something or attack somebody and the attacked person/organisation must justify. Is this really US-law? …

Firstly, as you must know by now… these are not people (everybody, somebody. etc)… they are entities, organisations, whatever you want to call them. The law is different for them.

Secondly, US Law? I didn’t say anything about US Law. Didn’t you read my post? I said EU Law… as in the European Union.

[SLE]

@Melih post:227

… we should simply “trust” them when they said they are being fair …why didn’t i think of that

And why should I trust your assumptions and suggestions more? Others may - many not.

@Melih post:227

AV-Comparatives have lost end user’s trust by misleading them about where their money comes from…

Where are those end-users? Some Comodo Forum members (some people say Fanboys - I don’t mean it negative) - look in other security forums, there you and Comodo lost more trust.

@Melih post:227

…they are accountable and they have to prove to the government about their revenue and spendings. I doubt very much if Austrian government will take the word of AV-Comparatives about where they get their monies from I am sure they will want an audit of their financials.

Exactly. Like in Germany in Austria NGOs/NPOs must justify themselves and their financial relationships yearly before government (ministry of finance) otherwise they aren’t allowed to call “e.V.”
AV-C still are allowed to call “e.V.” so we can assume that all was right - at least for the government.
But that all not means that they are responsible to show their financial situation to public or Comodo.

[Melih]

@SLE post:228

Generous

But I thought I made clear that it is a strange logic if everbody could come and claim something or attack somebody and the attacked person/organisation must justify. Is this really US-law? And btw. in other law rules it’s not ok to release NDA parts (and they forced us is no argument…). But that I also said many times - so enough.

And beside that: Only time will tell and show, AV-C never said that they are not looking for certification or auditing. They only don’t need and want Comodos support for that.

So we can only wait. And at least I believe that the fact others pay AV-C has no influence on test methodology and results. Until someone brings proofs for the opposite.

wait while AV-Comparatives continue to get money from Anti Virus vendors for tests and do not audit their results??? really? You seem to have a different level of expectation when it comes to “standards”…for us…we like transparency…

How can you have defend an organisation who misleads their users http://www.av-comparatives.org/forum/index.php?page=Thread&threadID=1025 ???

Surely you can’t tell me that that poor poster went away thinking that “yes AntiVirus vendors must pay them money for tests”…

Of course not…that poor soul is thinking…wow AVC is great Government and International organisations support it because they are great…not like other testing organisations who gets paid by AntiVirus vendors…

Come on…surely…even you can’t deny that…

[SLE]

@Melih post:231

How can you have defend an organisation who misleads their users http://www.av-comparatives.org/forum/index.php?page=Thread&threadID=1025 ???

Your new favorite quote? Why don’t write a blog article about it? I answered a few pages before (post 191) , so no need to ask me again.

I can’t read minds, so I don’t know what that “poor soul” was thinking ???

Other point:

@Melih post:222

As per FCC guidelines it is clear that where-ever they publish their report, they must state that it is paid for. Its pretty clear.

I asked you to cite the sentence which forces them that they have to write it clear in every report!
No answer, mhm. Your wish and no law?

But what I find interesting in that context and only shortly mentioned before (Clockword found similar things)
You cited a part of 255.5 (http://www.mlmlaw.com/library/guides/ftc/ftcendorse.htm) and if we look in example 1 we read:

“Example 1: A drug company commissions research on its product by a well-known research organization. The drug company pays a substantial share of the expenses of the research project, but the test design is under the control of the research organization. A subsequent advertisement by the drug company mentions the research results as the “findings” of the well-known research organization. The advertiser’s payment of expenses to the research organization need not be disclosed in this advertisement…”

I know it’s just an example, but we can ask:
(1) Is AV-C a well-known research organization? YES. No proofs for opposite.
(2) Did one company paid a substantial share? I think no, cause every company pays the same.
(3) Has AV-C control over their test design? YES. No proofs for opposite.
Result from guideline: need not be disclosed.

And even there: Nowhere stands that it has to be disclosed everywhere and evertime.

[M.Richter]

@SLE post:223

No. Complete off-topic - example: Even those days I can find malware samples signed by Comodo…

OFF-TOPIC

Thats off-topic, but hey, wow, very interesting! It is not the first time that i hear something like this about Comodo! Comodo is signing Malware… is this trustfully? How can this be that a security company signs malware? And again, it is not the first time that i hear this! But i still trust Comodo! So, is it helpfully to make a big Topic and a big show of this now? I ask you Melih, i dont know!

OFF-TOPIC

@Melih post:227

So all you are saying is: While AV-Comparatives gets paid from Anti-Virus vendors, we should simply “trust” them when they said they are being fair …why didn’t i think of that

Why not? You must not trust them, sure! But till now you have no proof that AVC is not trustfully! See me, often i heared this about Maleware is signed by Comodo. I have no proof from you that it is not so. But hey, i still trust you and your company!

[Melih]

@SLE…again you are basing your assumptions on things noone knows nor has any proof on…

Lets just agree to disagree…

My point was:

AV-Comparatives cannot call themselves Independent while getting money from AntiVirus vendors.

AV Comparatives MUST tell public that they are getting money from Anti Virus vendors…

[SLE]

@Melih post:234

[at]SLE…again you are basing your assumptions on things noone knows nor has any proof on…

Exactly as you.
Large Difference:
I don’t use assumptions without proofs for specultation and attacks against other companies.
In your logic I could attack Comodo and you must prove me your innocence. Funny.

Your arguments in this thread were getting fewer and weaker

1. You often were ignoring questions or fleeing into requestions - and telling all the same again and again.

2. You admitted to have no poof for you speculations against AV-C.

3. Your partly cited guidelines didn’t made clear that it should be written everwhere and everytime that tests are paid. + I showed that they also cover situations were this fact needs not be disclosed at all.
   (Dispite the fact that it were US guidelines)

4. You admitted that there were many on-demand tests which Comodo joined. Even if those tests are nonsense for you: Question remains why you took part at all and why you never informed you users direct about results and about your participation at all. (and users asked often for it even in your forum). So for me: This is your transparency issue.

So the only things which seem to remain are:

@Melih post:234

AV-Comparatives cannot call themselves Independent while getting money from AntiVirus vendors.

Your opinion, because you have no proof for any influence. Speculation, attacks, marketing(?)

@Melih post:234

AV Comparatives MUST tell public that they are getting money from Anti Virus vendors…

Your opinion AND they do in methodology. So it is nothing new that they get money from AV-companies.

You mean they must disclose that evertime and everywhere. Ok - but it’s just your opinion, nothing more.
And you are not in the position to force other companies, and you don’t speek for the public - so why you can say what public interest is?

At least: You violated the NDA, you published private E-Mails. Yes you argue you were forced - but you was the first who came out (and there would have been enough time for reaction…).
So here we also see a TRUST issue: Which company in future should trust you and write private things to you / or believe that you stick to contracts?

And surely: Many people will think different to me, but for me you lost your own game!

[Melih]

The facts are:

1)AV-Comparatives.org takes money from Anti-Virus vendors
2)They do not reveal that they take money where they reveal the tests.
3)They do not act transparently about who pays them and how much
4)They are not certified
5)They are not Audited
6)There are no 3rd party validation of their test results
7)They bully AntiVirus vendors with threats about revealing confidential information.
8)They mislead their own users when asked about how they are funded (http://www.av-comparatives.org/forum/index.php?page=Thread&threadID=1025)

So with all the above facts, its difficult to trust AVC.

PS: To answer your question about which company: The company who will not blackmail and bully us is the one that should trust us

[kail]

@SLE post:235

… but for me you lost your own game!

For you that happened several days before you even registered here.

You have proved little and I think you are giving yourself far too much credit to think/say otherwise… or is it a touch of öffentlichen selbstbeweihräucherungen perhaps? But, you did prove to me several times that you didn’t know the basic facts of what you were arguing about. You still don’t. But, I suspect that at least some of this could have been down to language issues (hopefully).

[clockwork]

@Melih post:236

The facts are:

1)AV-Comparatives.org takes money from Anti-Virus vendors
2)They do not reveal that they take money where they reveal the tests.
3)They do not act transparently about who pays them how much
4)They are not certified
5)They are not Audited
6)There are no 3rd party validation of their test results
7)They bully AntiVirus vendors with threats about revealing confidential information.
8)They mislead their own users when asked about how they are funded (http://www.av-comparatives.org/forum/index.php?page=Thread&threadID=1025)

So with all the above facts, its difficult to trust AVC.

1,2,3,6
There are countries where mandatory and on demand tests of products are madeable by “independent institutes”. Not only that, this institutes take money too. And in a way, some cultures might see a general fee as a better garant for independency, as when one candidate would give a free tester an amount beyond the otherwise regular fee, which could lead to other results.
But all the antivirus companies would avoid a paid tester if theres any chance of manipulation. Your combinations of “paid /= no independence” do not look in all cultures as logically, WHEN its a regular fee.

When you buy a product, and it says, regular tested by institute, its expectable that this is regular paid. But independent though.

4,5,6
The institutes claims on the products stand on their own. Its not as informative, as if there would be tests of tests printed next to it. But until this point, nothing accuseable.
But when (like google now browsers) all products are tested in an arrangement paid by ONE vendor, THEN this arrangement has to be make public. But doesnt mean automatically that the test is a bad and sided one though.

In our case here, all arrange with a general fee a test participation. And both sides have a vital interest that the test is not sided.

7
I remember the sentence,… if you speak public and its maybe not right enough, and if you dont speak about that with us (them), we (they) will react public TOO. Whatever has been more justificable, the intention was a speaking. Not revealing. Btw, what revealing? What should a participant have to hide? So no base for forcing-power at all. Or?
The “forcing to go public”, like you call it, was worded as a reaction which would follow as a reaction to public assumptions, which are not discussed while there are reasons for discussion.

8
Thats a strange formulation, indeed. But its only 1of8 points.

[kail]

@clockwork post:238

1,2,3,6 …

Citations needed. Are your sure the majority are not funded by government/association grants?

@clockwork post:238

4,5,6

You are applying the generalisation of “institutions” to AV-C like it means something, where as it doesn’t. If you believe it does, then post citations please.

@clockwork post:238

7 …

Like I asked SLE, how can you possibly not know this? It’s basic information of this issue that was clearly available from the very beginning. To not know this implies that you are not aware of all the disputed/undisputed facts and available information. And not by not asking questions either, but by not reading what was available.

I’m really not sure how one could argue/debate the issue like this, unless one was merely operating on… faith (for want of a better description/word).

@clockwork post:238

8 …

Strange indeed.

[_0M0D0]

@SLE post:235

You mean they must disclose that evertime and everywhere. Ok - but it’s just your opinion, nothing more.
And you are not in the position to force other companies, and you don’t speek for the public - so why you can say what public interest is?

And surely: Many people will think different to me, but for me you lost your own game!

Are you jealous about Melih, just because masses of people listen to him and follow him for the good things he is making?
He is providing good and better security for FREE. And many people trust him for that and because of the results of his actions, the way he runs COMODO, Very transparent and honest, etc.

And you come here and think that people will agree with you just because.
Have you contributed, really big time, to the Internet Community, as Melih?

Im sorry if I sound “heavy” on you (nothing personal, really).
I am just explaining you WHY Melihs word are important (in response on your unrespectful words to him: “but it’s just your opinion, nothing more […] and you don’t speek for the public - so why you can say what public interest is”)