Risky Business #105 -- RSA conference wrap plus X10 security

I wouldn't recommend OS X A/V just yet.

while it's something to come in the future, I think you're still better off using a little common-sense, and something like Little Snitch.

Little snitch, is in essence a firewall, but it's rules are very customisable, and in particular I like that you can set a temporary rule something like,

allow terminal to send ICMP traffic until the process terminates.

So that way, I can say, yes, this application I've instructed to run does infact need to do this kind of network traffic, but only this time.

The reason I don't recommend OS X A/V just yet is that while it's becoming an emerging threat, the cost of CPU cycles / money / pain in the arse that AV gives isn't worth it.

If you REALLY want to put something on, you can start with the FOSS tools like Clamx AV (clam AV for os x) or tripwire (tripwire prevents writing to system files)

For paid tools, I've used Intego in the past and found it to be pretty effective. Also the dashboard widget and management interface is easy to use, and the context menu scanning (so right click, scan this file) is handy.

But I've since removed them and defer my os x security to a bit of common sense (ie. don't type in that admin password unless you're 100% sure the program needs it. Which is why real player _Still_ bugs me for the realplayer agent.)