Why Threatcast will work [CLOSED]

Comodo Internet Security - CIS Beta Corner - CIS
1

We have in excess of 15 million installed base of our CFP/CIS. The profile of these users are advanced users who like power and control of their system and don’t want stuff happening on their PCs without their knowledge. System administrators are within this group as well.

Now, as we make CIS more user friendly and enabling threatcast, the average users will benefit from the feedback on alerts that this experienced and advanced user base provides. This is a very unique position with the scale of user base and progress of CIS into everyday users. This is why Threatcast will work. Of course Comodo will be putting people on validating more popular alerts and migrate these alerts to either safe or blacklist too.

thanks

Melih

2

But what if some advanced users blocked a trusted/ok app according to their own preferences, so an average user decided to block the app too. But that average user is blocking an action of the app that the user needs, while the advanced user doesn’t.

:-\

3

I think there has to be pointed a quality control group, the group has to have knowledge about a wide range of applications and has to have the ability to analyse application behavior… this way, the quality and the quantity can be more guaranteed…

4

It’s a very interesting and daring experiment in collective intelligence.
I hope it adds usability and value, and expect it to do so.

5

yes, threathcast is based on the thinking that the intelligence of the mass is more powerful than the intelligence of 1 person… this is a known theory and many people acknowledge this theory… it sounds very logical, still I have my doubts in some cases… (:WIN)

6

It needn’t be the Philosopher’s Stone, yet

I hope it adds usability and value, and expect it to do so.

PS: It might be the elusive Stone after all. :slight_smile:

7

I think the formulas the mathematicians are building for ThreatCast will prove useful.

Cheers,
Josh

8

“in silence, without notification. Simply to check: with TC enabled, D+ in “CleanPC M, SM or PM”, when a new app is launched you may get a pop-up, like always. But, NO MATTER what you answer to that, if the app is listed on DB, you will get that rule! And your choice/rule goes away, without any warn. Even if you explicity type some permissions OR denials, you will get what is in TC DB. For an example: if you set to “ask” for all items for Firefox (trainning), next time you go to see the rule you will see that it is ALL allowed!!! Angry
Oh God… The only way to do your own choose is to let TC disabled at all! This is too much agressive! You can’t have TC for what you want only, or for what you don’t recognize (as a “help” to configure CIS).
I think that this is dangerous, for browsers mostly.” Link

One question, is this supposed to happen in TC? Is this the only way to use it or are there different settings with TC (e.g. “give me rating, but don’t change rules”) -or does this depend on the D+ mode you’re running in?

:comodo110:

9

Well… There is a flaw to this threatcast. A team of Psychopaths could easily override the allow vote and making average people confused and blocked without knowing it that it was safe. You can maybe use the Usuability people to vote Allow or Block first before you release this as final, but have a perfect RC final-like version that doesn’t have as much ThreatCast votes or statistics in them.

If I am not getting this, then alert me lol. :smiley:

10

Nevermind my last post, i was being a bit too unrealistic. LOL.

11

TC enabled should just give an option, as a “guide” for who doesn’t know what to choose.
Could say: “10 million users allowed this, do you accept allow this?” This is imperative to success.

:■■■■

I will NOT leave COMODO, no matter what. I really TRUST in COMODO.

I really did a serious comment, and I didn’t planned to hurt anyone. Sorry if I was rude, my bad. (just learning english - not my natural language)

edit:

I will try to make sense on my point:

  1. D+ is in PM.
  2. I did a rule by hand for svchost. Tested and working for now (re-started 3 times, used FF, sol.exe and some others app that I did before, no new rules created)
  3. Then I want to access paint.exe never acessed before, so no rules for it yet.
  4. I change from PM to Clean Mode to get the rules for paint.exe via TC.
  5. paint.exe is fired now.
  6. TC get the rule for paint.exe.
  7. Get back to Paranoid Mode.
  8. TC changed my pre-defined rules for svchost, not only for the interaction with paint.exe, but allowing everything else in a generic way, without asking or notifying.

TC shouldn’t modify a pre-defined rule without asking or notifying the user in a generic way.

If I wasn’t clear, let me know. I hope I can be helpful. 458 and 459 reacts the same for this.

12

Changing the word TC with Safelist/Trusted vendors will likely provide a less inaccurate description. :-La

COMODO Internet Security 3.8.61948.459 BETA Q&A’s\Feedback will prove an appropriate place to possibly ask devs about new changes to default CIS behaviors.

13

Hmm. I allow everything in my malware testing just to see what a sample does. Guess I’d better turn off ThreatCast…

14

if you are allowing a malware to fully run, then what is your purpose for having CIS?

but of course ill intention is always a threat that we will look out for.

Melih

15

Sorry, but I genuinely don’t understand why you would need to turn off Threatcast to test malware.

Threatcast won’t stop or allow anything, it will only offer an opinion as to what your next action should be and, even then, it will only appear as part of a D+ alert.

If the issue is slowing down the malware activity or blocking it, then D+ should be the issue, not Threatcast,or am I not getting something here?

Cheers,
Ewen :slight_smile:

16

Well, I think that if everybody’s going to do that, people will just follow the votes and let the malware run ?

Xan

17

Simple: it’s a quick and easy (albeit not always accurate) way of seeing what a sample does.

To prevent others from seeing votes that say to allow malware?

18

Off with my head and on with a pumpkin. LOL> Sometimes the most obvious is the hardest to see.

Ewen :slight_smile:

19

First of all Threatcast should be an additional information for CIS users about how others answered to this kind of alert but not the main security considaration. That’s why I think that the Security Considerations tab should be always displayed first and not only if there is no Threatcast rating. ( Or at least add an option to Settings menu which would allow to set which tab should be displayed first when Threatcast is enabled).

Secondly, Theatcast shouldn’t send to database answers of users who didn’t choose ‘Remember my answer’ because most likely they Allowed/Blocked an application only for this session or for testing purposes.

20

Very funny reaction there, panic. LOL
Been a long time since I bursted out in laughter whilst reading a forum topic.
And all that on one page. Boy oh Boy, life can be great.

Thanks,
Bgrds,
mack