Patrick Elliott wrote:
> Seems to me, the best design would be an additional layer. An 
> application runs "sandboxed", until a scanner can verify its not 
> dangerous, and only then does it get "current user" rights, never mind 
> admin. 

Begs the question. How do you know it's dangerous?  And what happens if you 
run two sandboxed applications that change the same file? How often do you 
check? Every time you run it, or just when the code changes? If only when 
the code changes, just scan it before you start it the first time, but risk 
having malware modify the checksum you're using to check for valid programs.

-- 
Darren New, San Diego CA, USA (PST)
   Serving Suggestion:
     "Don't serve this any more. It's awful."

Post a reply to this message