Design philosophy for Comodo Antivirus

nice one :wink: …as you’ve probably already figured out, the argument that a standalone AV is useless (yeah…detection…prevention etc…) is just there to avoid answering the OP’s question, and remain as quiet as possible about the “potential” of CAV, apart from granting it some sort of layered protection abilities (? >>>> less pop ups with Def + 88) ) when it’s basically just there to allow Comodo to rebrand CFP to CIS, and pretend there’s a full security solution there, which as everyone knows is not the case, the anti-virus component (again 88) ) being what I just said, a useless add-on to CFP.
Say you’d want to pick up a single component in CIS, and choose other providers for the rest. You could pick up Def+ and have a fantastic standalone HIPS, you could pick up the firewall and have a brilliant stand alone firewall. But you couldn’t pick up CAV…no need to elaborate there, the existence of this thread speaks for itself.

Before anybody get lured to have this topic take the shortcut of pro-CAV against-CAV oversimplification it would be obvious that there would be no meaningful purpose without clarifying the criteria to match the so far ambiguous “standalone” category.

That is as long comments are made under a constructive purpose and especially if supposedly meant to point out possible areas of improvement.

you’re welcome to start living up to your constructive ambitions and suggest “possible”…improvements, if any comes to mind ;D

It wouldn’t help adding other aspects before having the previously pending ones unclarified, this obviously would include you previous comment as well.

Do just tell what you implied CAV do not have when you classed it as “useless add-on”.

Will you actually do that or leave it pending like the others, leaving the “useless” remark as the fulfilling purpose of your comment? :-La

Rather then debate terms,lets analyze some text:

Quote from: Melih on September 11, 2008, 04:10:32 PM
“Detection will continually improve next 12 months to get us to be one of the best!”

Quote from: Melih on March 06, 2009, 04:35:21 PM
I did promise to give you guys one of the best AVs within 12 months of launch (i still got few months left). And as you can see we are making good progress.

Quote from: Melih on May 22, 2009, 10:51:27 PM
“My 12 month promise is yet to be fulfilled. I am running behind on few things due to circumstances beyond my control (like new hardware infrastructure was delayed by about 4 months) but I think we will still have one of the best AV products within 12 months of us launching it…(so time is ticking…tick, tock…)(rushes back to AV labs to continue his work)”

Quote from: Melih on September 05, 2008, 09:54:29 PM
“We still have around 12 months (maybe less…but who knows) before I can say we are one of the best AVs out there, but I am confident about our new engine and architecture!”

Quote from: Melih on February 14, 2009, 03:37:53 PM
And our AV… I said 12 months since launch… we made some amazing progress"

Quote from: Melih on January 16, 2009, 11:41:54 PM
“We said 12 months since launching that we will be one of the top AV guys if not the top, slowly but surely we are making our way towards there.”

Quote from: Melih on September 24, 2008, 10:31:30 PM
“Anyway, our job is to protect our users! We do a good job on that. AV is a secondary defense layer and within 12 months we will be one of the best.”

Quote from: Melih on August 13, 2008, 04:42:19 PM
“You will see a great improvement over next 12 months, then we are going for the top position for the AV market… so guys, at the top there… pls make us some room… WE ARE COMING!!!”

Quote from: Melih on August 23, 2008, 11:18:26 AM
“So, one thing I can promise you all is that I will do my best to deliver you a world beating AV!!! And with CAV3 we have the beginnings of a world beating AV!”

All of the above seem to refer to the Comodo Anti-virus itself.
“Stand Alone” if you will.
They seem to reflect the design goal,if not its philosophy.
Has the goal changed?

I will repeat this again:

Where the addition of the AV may have started to lessen the amount of D+ pop ups the plans surely have changed. The change of plan makes sense because people who will use the Clean PC policy and have their computer scanned during the installation need to be sure the AV does a proper job. And according to Melih it will.

As far as I understand things it is about layered protection. With the in v4 upcoming behaviour blocker and enhanced AV capabilities two purposes will be served: get less alerts and facilitate a more then decent AV. And as a consequence the AV would be a cool standalone product. O0

So now its about “goals”…

It looks like there won’t be any clarification about the peculiar way standalone was used so that everybody will get to know what criteria an AV have to match in order to fit that category.

I would think that in order for CAVS to be a good “standalone” antivirus it would have to be tested against other AV’s (not security packages). Thus a “standalone” antivirus should be one that can be used by a novice user and not incorporate default deny technology. That is what needs to be tested (hopefully soon), the AV portion of CAVS.

I used “goals” because you seemed to take umbrage at “Philosophy”.

“Stand Alone” is a pretty innocuous ,commonly used term, seems most often used in the context
of individual components of a suite,when used by themselves.

It does not implies quality or lack of.

Nod-32 is part of the ESET suite,but is also available as stand alone.
ClamWin is a part of the SpywareTerminator “suite”,but is also available as stand alone.

I seems unlikely the term, “stand alone” holds any hidden meaning,that will one day be dug out by
a bevy of paralegals,and change the course of Common Law.
It is precise enough as used.

We are not at The Hague here.
Full exegesis of every phrase is not needed.

Quote from: Melih on September 11, 2008, 04:10:32 PM "Detection will continually improve next 12 months to get us to be one of the best!"

Quote from: Melih on March 06, 2009, 04:35:21 PM
I did promise to give you guys one of the best AVs within 12 months of launch (i still got few months left). And as you can see we are making good progress.

Quote from: Melih on May 22, 2009, 10:51:27 PM
“My 12 month promise is yet to be fulfilled. I am running behind on few things due to circumstances beyond my control (like new hardware infrastructure was delayed by about 4 months) but I think we will still have one of the best AV products within 12 months of us launching it…(so time is ticking…tick, tock…)(rushes back to AV labs to continue his work)”

Quote from: Melih on September 05, 2008, 09:54:29 PM
“We still have around 12 months (maybe less…but who knows) before I can say we are one of the best AVs out there, but I am confident about our new engine and architecture!”

Quote from: Melih on February 14, 2009, 03:37:53 PM
And our AV… I said 12 months since launch… we made some amazing progress"

Quote from: Melih on January 16, 2009, 11:41:54 PM
“We said 12 months since launching that we will be one of the top AV guys if not the top, slowly but surely we are making our way towards there.”

Quote from: Melih on September 24, 2008, 10:31:30 PM
“Anyway, our job is to protect our users! We do a good job on that. AV is a secondary defense layer and within 12 months we will be one of the best.”

Quote from: Melih on August 13, 2008, 04:42:19 PM
“You will see a great improvement over next 12 months, then we are going for the top position for the AV market… so guys, at the top there… pls make us some room… WE ARE COMING!!!”

Quote from: Melih on August 23, 2008, 11:18:26 AM
“So, one thing I can promise you all is that I will do my best to deliver you a world beating AV!!! And with CAV3 we have the beginnings of a world beating AV!”

All of the above seem to refer to the Comodo Anti-virus itself.
“Stand Alone” if you will.
They seem to reflect the design goal,if not its philosophy.
Has the goal changed?


Dammm, why are you quoting him like it was the bible or something. ??? In 2008 anti-virus was weak, Now it is good, not great, but good and that’s WITHOUT the Heuristics and all that other good stuff that will be added

just by looking at the quotes you posted, in (specific the dates on them), I’m guessing you have way too much time on your hands AND if you look at the quotes LOOK AT THE DATES: why did you shuffle them around.

By your answer I bet you did not read the previous posts. Please read them first before having an opinion.

Peace.

Hammersmith

Do not fall into the trap of the word game. You expressed yourself well and carried your point across :-TU. It is too bad the simple minded, with all due respect, did not understand what you were saying.

Peace.

Obviously your posts are taking “umbrage” under this topic title as well along with a “Philosophy” related question of yours.

That was not the only use made of that word as some also used it to purport a “category” whose specifics/properties AFAIK were never described.

As such it didn’t look a matter of packaging/availability like your above quoted example implies though I now wonder if you previously meant it in such way in a previous post I was also confused by a sudden shift of your claimed argument.

Anyway as long nobody wish for such ambiguity it doesn’t look like the necessity of clarification of that category ought to be so easily neglected.

Because even if Comodo Antivirus endorse a layered protection approach it should still be clarified by what criteria the 3rd party AVs insofar mentioned match in order to fit that “standalone” category.

Once those criteria are unambiguously specified it will be possible to know when any AV does or will match them (and not that, for example, that only CAV does not)

There are some comparative tests available at Malware Research Group and virus.gr which pertain only the AV portion of CAVS though CAVS itself indeed incorporate default deny technology.

lets check it out (MRG)

Comodo Detection %

Test 18 = 90.7% (average) (December 2008)

Test 19 = 96.2% (Could not find)

Test 20 = 97.1% (August 2009)

Test 21 = 98.1% (October 2009)

I see nothing but improvement, yes it is only 8% but that is very hard to do in the AV world.

“I’m simply asking if the direction of CAV is to be an integral part of the suite and only a layer of protection or to become the best product at doing what AV’s do, even outside of the whole package of CIS and therefore be rated higher on testing sites that only test traditional AV technologies”

First of all being an integral part does not preclude it from being one of the best if not the best for it does. So we are aiming for one of the top spots as an AV. You can always install CIS in an AV only mode…but wait for some other surprises we got up our sleeves soon…:slight_smile:

Melih

That so-call improvement comes from a test that Melih himself would not support since such a test was not reviewed nor approved by the AMTSO review board. You show me progress only with an AMTSO approved test. Melih has to be consistent, he cannot claim that he supports only AMTSO approved test and then turn around to accept the result of a test, that is not AMTSO approved, as a sign of progress.

Peace.

It doesn’t look any AV got a test proven to comply with AMTSO guidelines whenever some tester might have claimed compliance or uses phrasing that implies compliance, such as “following AMTSO principles”.

As David Harley from ESET pointed out claims of compliance are not to be assumed as compliance certifications.

In the meantime, I’d strongly recommend that if you come across claims of "compliance", you take them to be as a declaration of intent to comply: it doesn’t mean that they are proven to comply or have the blessing of AMTSO.

Nor it does look that AMTSO ATM will act as a certification body though it looks AMTSO Review Analysis Board can validate specific tests.

Even then, since AMTSO is not a certification body (not yet, anyway – who knows what will happen further down the line?), it probably won’t mean that any specific test from that tester or organization is compliant. Unless, of course, an analysis from the Review Analysis Board has determined that it is.

Nor being a member of AMTSO would be a sufficient condition to claim compliance…

Even if the tester is a member of AMTSO, that doesn’t mean at all that they have the automatic endorsement of the organization for their testing. Indeed, they’re at least as liable as anyone else to have their adherence to the AMTSO principles scrutinized by the Review Analysis Board.

For what it matters IMHO even an AMTSO certification won’t be enough if the methodology is flawed or incomplete/undisclosed, nor any test can be stretched to assume that the parentage actually represent more than a value relative to the testset (as such only a way to compare different AVs)

Nevertheless at least it looks Malware Research Group and virus.gr tests got similar results even if carried by different testers.

Obviously they never claimed AMTSO compliance so I guess some might be willing to ignore them.

Other AV products that are offered as seperate products do things such as scanning Instant messages, emails, and web pages. CAV, as far as I know, doesn’t do any of those things. That is why many people don’t think it’s any good even though it’s detection rate in on access and manual scanning have increased. In my opinion, to be accepted as a “stand alone” AV, it would have to have those features. When used in conjunction with the rest of CIS, it doesn’t need to do any of those things.

I guess the question I asked will not be answered until we see the new CAV in CIS4. There are promises of a greatly improved and more powerful product. I guess we’ll just have to wait and see.

I do use CAV myself because I think it’s sufficient as part of the package and also because I like being in on it’s evolution. In it’s present state, I would never use it without the rest of the suite however and would never recommend it to anyone who did not want to use the Firewall and D+. I would tell them to use Avast! or MSE. MSE seems to have problems with it’s auto updater though. It doesn’t work a good part of the time.

With all due respect, I really do not know that you can either read properly or understand English. Who was talking about alleged AMTSO compliant tests here, but you. I was only talking about tests that are AMTSO reviewed and approved by the AMTSO review board. Please read attentively before you post.