> You're not secure until you whitelist. No, a whitelist isn't good enough. You ...

catnaroek on March 20, 2016 | parent | context | favorite | on: Bypassing Antivirus with Ten Lines of Code

> You're not secure until you whitelist.

No, a whitelist isn't good enough. You can't anticipate an exhaustive list of the programs the user will want to run.

What you can do, however, is enforce a policy by which programs are required to provide machine-checkable evidence, also known as proof-carrying code [https://en.wikipedia.org/wiki/Proof-carrying_code], that they respect the system's safety policy.

> it's a necessary but sufficient condition

Perhaps you mean “not sufficient”?

bitwize on March 21, 2016 | [–]

Yes, that's what I meant -- not sufficient.

Whitelisting seems to be working out well for Apple. It's a big part of why they're the most secure smartphone platform.