The DMZ

etherealflux

2:00 PM

So, how has Gentoo 10 been going for everyone?

Terry Chia

Is Win 10 a free upgrade?

Rоry McCune

@TerryChia is you have 7 or 8 yep

Terry Chia

@RоryMcCune I assume Win 8 Pro -> Win 10 Pro?

Rоry McCune

@TerryChia AFAIK

Terry Chia

@RоryMcCune Cool. Will run the upgrade this weekend.

Thomas Pornin

2:03 PM

@TerryChia You are supposed to register for the download in advance. The download will happen in the background and may take some time.

raz

So I'm curious. I flagged this answer as "not an answer" it should be an edit or comment.

0

A: VirtualBox: Ubuntu With or Without Virtual Hard Drive

In your situation, I would rather use Tails on a USB stick or DVD (or just a CD since it does not require lot of space) to insure privacy and anonymity.

My flag was disputed...

etherealflux

there's a grammatical error in it

REEEEEEEEEEE

Simon

@raz That is not an answer.

etherealflux

ban him for using "insure" instead of "ensure"

Simon

@etherealflux He's French, he's a donut by definition.

raz

2:08 PM

@Simon Well someone thinks it is

Simon

@raz Oh well. I flagged it, let's see the outcome.

etherealflux

Ruby is wonderful sometimes

foo = bar

bar exists nowhere in the file, nor in the directory

'cause it's secretly a method

raz

@Simon Yours will probably be fine

etherealflux

from space

Simon

@raz Unless the same donut who declined it does it again.

It's kind of a sucky thing that the guy who just posted an answer which isn't an answer is reviewing answers.

Terry Chia

2:14 PM

@etherealflux Global scope monkey patching is still a thing in Ruby right?

etherealflux

@TerryChia Alive and well!

Terry Chia

@etherealflux I wonder who thought that was a good idea.

raz

@Simon I don't think you can review your own answer

etherealflux

@TerryChia It sounds great until someone else tries to work with your monkified code

Xander

@TerryChia Yup.

Stack Exchange

2:16 PM

“Why are there so many programming languages?”

Matt Sherman on July 29, 2015

I was asked this question twice in the past week, by colleagues who work with our clients. It’s a great question…

Simon

@raz Yeah but still, how can the guy judge if other answers are fine when he can't even answer questions properly himself?

Terry Chia

@etherealflux It sounds great until you realize every single module you import can affect your code is subtle ways you may not even notice.

etherealflux

aaaaa I can't tell what's being mocked out and what isn't right now

raz

@Simon That's a valid point. Maybe we should take tests to gain privileges

etherealflux

I'm just going to put puts 'pls' everywhere in the object I'm testing

Simon

2:17 PM

@StackExchange NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE NEW PROFILE

2

@raz That'd be the best way to ensure if the person is able to review answers properly.

raz

@Simon 6-8 weeks

Simon

@raz Is that the random approximation one of the donuts would give? I forgot the actual number.

Terry Chia

@raz Could be worse. They could be on Valve time.

Simon

Or they could be on the Terry got eliminated before me time.

etherealflux

Or Blizzard time

Soon™

AviD

2:29 PM

@CodesInChaos nah, don't worry about it, I've fixed it.

Simon

@AviD Look at it, it's not fixed at all.

Refresh yo page, son.

Rоry McCune

@Simon oy you!

CodesInChaos

Unlike OviD, Rory knows how to spell doughnut.

Simon

@RоryMcCune SIMONED

@CodesInChaos His name is Roro.

AviD

@Simon oh I be donut

Simon

2:33 PM

@AviD Roro silently changed it.

AviD

@Simon that creep.

CodesInChaos

But of course you can't expect correct spelling from somebody who thinks tiger is spelled tigger.

Simon

I only saw it because I restarted my chrome to update it.

@AviD Yeah no kidding!

AviD

@CodesInChaos tiger != tigger.

Simon

:D

AviD

2:34 PM

heehee

CodesInChaos

And we only have one new canadian overlord.

Simon

Who is MIA.

AviD

WE

CodesInChaos

Pluralis Majestatis is only acceptable when talking about The Bears.

AviD

ARE

Simon

2:37 PM

THE RESISTANCE

AviD

ALL

CANADIENNES

CodesInChaos

BAD @ SPELING

Simon

@AviD We're all female Canadians?

AviD

eh

CodesInChaos

TIGGER NIX GRAMMER

Simon

2:38 PM

@CodesInChaos He spelled it right in French.

AviD

power company shut off our power today. We were all sitting in the dark. Was so scary.

Simon

But, as I said, that's for female Canadians.

CodesInChaos

@Simon That's why I said nix grammer.

AviD

@Simon I am for female canadians...??

@CodesInChaos whats Unix grammar?

Simon

@@@

AviD

2:39 PM

nevermind me, I dont know what I'm aboot

Simon

pls

I'm re-watching HIMYM, they still haven't laugh at the Canadians yet.

AviD

pls

Simon

It's just a matter of time.

AviD

that's like, in the 2nd episode.

Simon

lololol

My donut didn't want to watch the show for an unknown reason and now, as expected, she's addicted to it.

Silly donut.

AviD

2:42 PM

@Simon you should send her to me

3 mins ago, by Simon

But, as I said, that's for female Canadians.

Simon

wat

She'd make you question your whole existence.

"How did Simon land a gurl this hot?"

AviD

"How did Simon beat @Terry?"

Rоry McCune

@AviD Rly tigger tut tut I can seeee you

Simon

That too, that too.

AviD

@Simon but meh, I am happily married to a much hotter lady.

no need of AFF/AM for me, breach or no.

Simon

2:43 PM

pls

AviD

Thanks anyway.

@RоryMcCune AAAAUUUGGGHH

Simon

@AviD RUNNNNNNNNNNNNNN

AviD

Give me a towel, quick!

Simon

hands a paper towel

AviD

lol

wut

Simon

2:45 PM

does the pls dance

AviD

not while holding the paper towel!

etherealflux

@Simon that's highly illegal the FBI is on the way

they're driving down the highway at 120 mph blasting rap music

Simon

pls

AviD

@etherealflux as long as its not hardstyle

is it illegal to drive while listening to jumpstyle?

it sounds dangerous.

etherealflux

@AviD don't worry it's only psytrance

Simon

2:47 PM

@AviD Look at you knowing about all those styles of music.

etherealflux

I listen to genres that DON'T EVEN EXIST

AviD

@Simon you act as if they are different styles

and not all just the one

Simon

pls

Obligatory JS track:

Jeckyll & Hyde - Frozen Flame (Official Video HQ)

is this a framework?

jumpstyle.js

2:52 PM

@CodesInChaos We agree.

AviD

@Simon the audio is broken on that, otherwise it looks cute at least

Amelia

So. Stagefright. Who wants to bet that nobody is going to give a shit about it just because it doesn't have a logo and a website?

raz

@TerryChia Valve gives time?

You know I wish people would just edit answers when they see a mistake rather than create a long conversations in comments.

AviD

@Amelia it does, and it does - and they do.

Amelia

3:16 PM

@AviD by "nobody", I was referring to Samsung

AviD

@Amelia ah, fair enough.

etherealflux

that implies Samsung knows how to patch their devices

Amelia

@etherealflux you patch by allowing remote code execution from cell towers, right?

Right? :p

etherealflux

I mean, give them a break- they're REALLY busy removing features from their phones

raz

@etherealflux That implies Samsung actually patches their devices.

etherealflux

3:18 PM

@Amelia They could push out a fix via the exploit, actually..

It's like the Blaster worm all over again

Amelia

@etherealflux That is probably the best idea I've ever seen

raz

@etherealflux "Samsung has sent you an MMS, download?"

Amelia

Google could literally force every phone to update

etherealflux

Welchia

The Welchia worm, also known as the "Nachia worm", is a computer worm that exploits a vulnerability in the Microsoft Remote procedure call (RPC) service similar to the Blaster worm. However, unlike Blaster, it first searches for and deletes Blaster if it exists, then tries to download and install security patches from Microsoft that would prevent further infection by Blaster, so it is classified as a helpful worm. Welchia was successful in deleting Blaster, but Microsoft claimed that it was not always successful in applying their security patch. This worm infected systems by exploiting vul...

Amelia

@etherealflux hah

raz

3:19 PM

@etherealflux Wow that's amazing

Talk about true White Hat hacking

Simon

That is indeed pretty damn cool.

etherealflux

It's quite the clever hack

Thomas Pornin

It is completely standard procedure.

When you exploit a hole, the first thing you do is to close the hole to prevent other attackers from using it and dislodging you.

etherealflux

but..what happens if Welchia gets out of control?

Amelia

I love how the wikipedia article goes on about how it restarts without the users consent, and stresses that

etherealflux

3:21 PM

We just need to send another worm out to handle it

Amelia

Like heck do you need the users' consent to patch :p

raz

@etherealflux It self deletes on January 1st 2004

etherealflux

@Amelia so you mean you don't manually inspect the binary contents of every patch you apply? caaaaasual

Thomas Pornin

Morris worm

The Morris worm or Internet worm of November 2, 1988 was one of the first computer worms distributed via the Internet. It was the first to gain significant mainstream media attention. It also resulted in the first conviction in the US under the 1986 Computer Fraud and Abuse Act. It was written by a graduate student at Cornell University, Robert Tappan Morris, and launched on November 2, 1988 from MIT. == Architecture of the worm == According to its creator, the Morris worm was not written to cause damage, but to gauge the size of the Internet. The worm was released from MIT to disguise the fact...

raz

@Amelia It's for their own good!

Thomas Pornin

3:22 PM

The Morris worm was a non-malicious worm that "got out of control" and just killed the Internet.

Amelia

Also: 113 days uptime on a windows machine with Chrome 12 have ended, violently, by shutting down the PC without the users's consent and locking them out of their account until their PC is updated.

Simon

"The U.S. Government Accountability Office put the cost of the damage at $100,000–10,000,000."

Good approximation lads, good one.

raz

@ThomasPornin Well "The Internet" back then was like 10 computers

Amelia

@Simon 6-8 weeks for a better one

Thomas Pornin

@raz Actually about 200, but the point of the worm is that it scales well.

Simon

3:24 PM

@Amelia pls we can't get that reference more than one in a day.

etherealflux

@Simon the virus affected one to one bajillionty million computers

2

Amelia

@Simon I've been subjected to it at least 8 times today

raz

You know what I haven't been subjected to? The new damn profile!

Simon

@raz Damn right!

AviD

@ThomasPornin isnt that the worm that Zero Cool is "based" on?

@Amelia 6-8 times

etherealflux

3:28 PM

@AviD my home server used to be called The Gibson

you couldn't hack it

because it's the Gibson

AviD

@etherealflux that's what @ScottPack calls his li'l scott.

dammit tigger, what is wrong with you?

raz

Maybe SecSE getting the profile would make the world implode?

@etherealflux Friends don't let friends name their network SkyNet.

etherealflux

owowow

just saw a Youtube ad for HP

"Disruption is an ever-evolving process..."

AviD

wut?

etherealflux

cloud-based framework disruption?

AviD

3:30 PM

@etherealflux Closed as unclear

etherealflux

apparently HP is evolving disruption

@AviD Are you just jealous of how much market synergy they've innovated through disruption?

AviD

I don't even.

Simon

ovid da jelly

raz

@etherealflux Cloud based framework for synergy

AviD

I am, once again, very relieved I decided to turn down their job offer, back when.

@raz disruption.js

etherealflux

3:32 PM

@raz [pivots internally]

raz

0

Q: Can you access google drive documents if you have the absolute path to the file?

I have been digging into google drive while I am trying to investigate a proper way to protect files on a site. In my experience if a user has the URL to a file they can access it without any protection like facebook images for example. However, google drive has a different method. For example an...

file-system

There's a BINGHASH?! Since when did that terrible search engine start creating hash algorithms

AviD

wut

also, ftr, bing happens to be a much better search engine, just less popular.

well at least for the important things, amirite? ;-) ;-) ;-) ;-)

raz

@AviD Bing returns google searches

at least it used to, not sure if they ever actually created their own search engine.

AviD

@raz wut

also, why is GOOGLE drive using a binghash?

raz

@AviD I swear Bing used to return basically straight Google Search results.

AviD

3:39 PM

@raz uhhh wut

etherealflux

BINGHASH is probably a typo. They meant to type "VOMITHASH"

AviD

I think you're thinking of Yahoo, and Bing results.

etherealflux

I vaguely remember that happening

someone said it on the internet, @AviD. It's true.

AviD

@etherealflux vomiting a hash?

@etherealflux ohh of course.

etherealflux

@AviD preferable to using Bing, at least

raz

3:40 PM

@AviD It's how the internet works.

AviD

really don't get the mad hate that MS gets.

oh sorry, I meant M$

Simon

I soft your micro.

raz

@AviD I think it stems from Windows ME

AviD

@raz ohh well cant blame them for that.

thought that IS kinda historical, doncha think?

raz

And Vista was a horrible operating system, but generally I have no problem with Windows.

They got in the game too late for smart phones, Win8 is a solid mobile OS.

Simon

3:44 PM

Very solid, when you throw it at a wall it makes a hole.

raz

I've only heard good things about their Surface Pros.

etherealflux

"Let's put a tablet interface on a PC"

and then they went back to doing massive quantities of drugs

AviD

@etherealflux you've heard of the Ballmer Peak, yes?

raz

@etherealflux Well yeah that was stupid, but overall I like 8.1. I just do mostly development on laptops now, so Linux is a better fit for me.

etherealflux

@AviD Yep, and they swerve all over the place

My concern is that 8.1 burned their "good OS" karma

and now 10 will be a disaster to please the all-powerful OS gods

AviD

3:47 PM

@etherealflux Nah, Stallman is never pleased.

raz

@etherealflux Every other version sounds about right.

etherealflux

brb Gentoo

I'm thinking of ironically setting up a Gentoo install on my laptop

this will make me the undisputed master of the CS lab

raz

I've never used Gentoo

Xander

@raz I've replaced all my other computers with mine. I went from a desktop, a laptop, and a Chromebook to just using my Surface Pro. The only one I ever miss is the desktop. I'll probably add one of those back into the mix at some point.

etherealflux

I got to use a Surface for a bit in one of my classes. It felt pretty nice

but it didn't have the Apple logo on it so it was totally unusable

Simon

3:50 PM

@etherealflux Yep, I understand that.

AviD

@etherealflux I think you have that backwards.

@Simon see @etherealflux, @Simon agrees with you, you should rethink your life.

raz

@Xander Yeah, maybe it's the nostalgia but I love my desktop.

etherealflux

@AviD pls

AviD

hahaha

that is probably the best placed pls yet

-5

Q: Should Free and Open Source Software and Hardware be Legally Manadated to Protect Users' Digital Rights?

In light of the advent of the Purism Librem 15, and the Novena laptops, is it time to consider legally mandating the manufacture of Free and Open Source Hardware and Software, in order to uphold Digital Rights? In light of the fact that Closed Source Software and Hardware (Closedware) stand in th...

hardware

sorry I didnt wait for your VTC's boys. too toxic to wait.

Ohnana

NOO PROFILE?!

AviD

3:56 PM

heh I just got an email about a defcon party, ended with this line:

> Time to make the donuts.....Mmmmmmmm Donuts!

raz

@Ohnana No?

Iszi

@AviD Instead of unclear, how about S&M?

Ohnana

@raz ;-;

Iszi

@AviD @Simon?

Ohnana

i saw the pin and got excited

AviD

3:57 PM

@Iszi considered, its not even clear enough for a rational opinion.

Ohnana

in other news sexuality stack exchange is in beta :D

AviD

@Iszi e.g. this houstonpress.com/arts/…

Iszi

@AviD Perhaps. But "unclear" is "more fixable" than S&M.

Simon

@Iszi What do you want, you pesky little shawalaza?

AviD

so at that point I can reopen and reclose. That would be fun.

@Simon hehehelolol pesky little waaat?

Iszi

3:59 PM

@Simon Your mother oughta wash your mouth out with soap.

Simon

@AviD I dunno, I made it up for the cause.

raz

@Ohnana Didn't mean to get your hopes up!

Ohnana

weeeeeh

raz

4:21 PM

Is there a canonical answer for securing web applications?

AviD

@raz bluuhh?

caaan you be any more broad?

raz

1

Q: What security practices should I keep in mind during development?

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) phone number and email, and I plan to keep this data in an SQL database. Users will be able to sig...

web-application php android ios api

AviD

> put on hold as too broad

raz

It's a broad topic, but a canonical answer with "things to consider" for us to point all of the "How do you secure web apps" questions might be helpful

AviD

@raz that is like, the definition of too broad

raz

4:26 PM

lol

AviD

but heeeey! @schroeder starting to enjoy that modhammer there, eh?

raz

@AviD Gotta stretch that hammer out when you first get it.

AviD

right then, @RoryAlsop we need to avoid the flags for a few days, let the new kid stretch his legs, break him in...

speaking of which: JEEEZ LOUISE, why do people keep talking about Steve Gibson?

Xander

@AviD Why not? He is an InfoSec celebrity.

AviD

@Xander sorry, your snark isn't coming through.

Jul 17 at 15:15, by AviD

Listening to any ideas Gibson has on security is akin to asking Donald Trump for suggestions on unemployment.

schroeder

4:33 PM

@AviD I felt that closing was in line with past decisions on similar questions, "I made a web app: how do I secure it?"

AviD

@schroeder oh absolutely, it was definitely a good close.

q's like that, you an even hammer on your own, dont need to wait for community, but you're probably uncomfortable at first with the idea ;-)

Simon

pls lads, I flagged it as too broad 20 hours ago.

I'm the one who runs this place.

Xander

@schroeder A+++++, would vote to close again.

AviD

its not like you're @Adi ;-)

raz

@schroeder I made a security module, how do I secure it?

AviD

4:35 PM

@schroeder I was just noting that you were closer #4, so that was probably your first use of modpowerz, right?

Xander

@raz With a WAF. Duh.

AviD

@raz Several big banks are paying me to build their security module. Does anyone know what this base64 encryption is, and do I really need it?

2

Cyan, part of the problem is that, as usual, Gibson did not quite understand the topic he was discussing, thus conflating terms often and making a general mess of things. You'd be best off completely ignoring what he said, since it's only value is in confusion. You should start fresh with a proper explanation. — AviD ♦ 4 mins ago

Xander

@AviD That's not encryption, that's encoding! Here, use this advanced code sample that implements DES in ECB with l33t-obfuscated password for a key instead.

Simon

pls lads, ROT13 is the standard.

Look, I've cipherized this with ROT13, good luck finding what it means: qbahg

evillaugh.jpg

schroeder

@AviD yep - late to the party, I guess

Is there a way to vote to close without being the deciding factor? Or am I now forever "The Decider"?

[I made an American reference there to make the US folks more comfortable with their new Canadian Overlord]

[eh]

Simon

4:47 PM

If by overlord you mean donut, sure.

etherealflux

I'm encrypting my data with MD5

raz

@etherealflux Normally it's, "How can I decrypt MD5 encryption?"

etherealflux

"it has really good compression!!"

raz

@schroeder schroe "the decider" der (encoding)

Thomas Pornin

5:06 PM

@schroeder The only known way is to vote to close with your sockpuppet account.

@AviD Personally I don't like using Windows, so I don't use it.

Especially their update management sucks big time.

Rоry McCune

wooo computing breakthrough! I can use text selection keys and CTRL-C, CTRL-V in the windows command prompt!

etherealflux

I wonder what sends an interrupt now

Thomas Pornin

In much older days, a case could be made about how Microsoft's dominant position made it hard to support hardware with non-Microsoft operating systems. But nowadays it became much better.

Simon

@RоryMcCune About fucking time.

Rоry McCune

@Simon aye yer not wrong..

huh that's interesting, there's a bug in the DMZ using Edge on Win10

if you reply to a post it places your cursor at the start of the box instead of after the post reference

anyone know where we report bugs?

Iszi

5:18 PM

@RоryMcCune Depends. Is it an Edge bug or an SE bug?

Simon

@Iszi pls Roro knows what he's doing

Rоry McCune

@Iszi is it either? SE Chat doesn't fully support edge it would appear

traditionally sites work around browser inconsistencies

so I'd guess they'll want to do so here...

given their audience, I'd guess they'll get a fair few early adopters...

Xander

@RоryMcCune Yeah, it's already bitten me a couple of times.

etherealflux

I have a similar problem. When I try to reply to a post, the CD tray fills with blood and the lights go out. Is this malware?

Xander

@etherealflux No, that's a standard Linux feature.

Iszi

5:25 PM

@Ohnana We should adopt the tagline, "We were Sec.SE before there was Sex.SE"

Thomas Pornin

@etherealflux No. You opened a portal to Hell, not a portal to spammers.

etherealflux

@Xander This is Windows ME

Xander

@ThomasPornin Stupid malfunctioning portal.

etherealflux

@ThomasPornin Would pouring holy water on the PSU fix it?

Xander

@etherealflux Oh, so it's an IE 5.5 feature then. Same diff. Same level of sophistication.

etherealflux

5:33 PM

@Xander I tried to disable ActiveX controls, but it bit me

Xander

@etherealflux Shouldn't have spent extra on the model with the jaws and teeth option.

etherealflux

@Xander They have to be present for Active Desktop to work

Xander

@etherealflux Yes, Windows ME was essentially a big pile of ActiveX controls. It was, well, special, in that way.

etherealflux

@Xander No, the jaws and teeth do

it's like a security dongle

but more aggressive

they're also whispering dark secrets into my ear when I sleep

But hey, at least it doesn't use LM hashes

Xander

@etherealflux True.

M'vy

6:04 PM

hi there

Congratulations @schroeder

@Iszi you were in my list too :)

schroeder

@M'vy thanks, @M'vy!

raz

6:28 PM

0

Q: How to store passwords in database without hashing?

I'm developing a password manager web app. It's just for fan, I'm not exposing anybody's passwords, hehe. My idea was to use hashing+salting, and that's what I did for the master password. But then I realised that I have to recover accounts' passwords (and I felt a bit stupid), so that hashing ...

encryption cryptography hash

Hey guys can I be insecurely secure?

Xander

@raz It's for a toy password manager.

raz

@Xander I just don't understand the question. If he just wants it in plaintext, then store it in plaintext.

@Xander Ah, I just read your comments.

Xander

@raz Think of KeePass, or LastPass, or 1Password. That's what he's trying to do.

raz

Gotcha

Xander

I don't know that I've ever seen a post with 2 answers in ten minutes, both wrong and deleted.

That's impressive.

raz

6:40 PM

Yeah i was just going to mention

@Xander So I guess really he's asking how to generate a master key from a master password. I just got turned around a bit.

Xander

@raz I actually don't think he had gotten far enough down the path to know that is in fact what he needed, but essentially yes. He was more in the "help, what do I do?" stage of the process.

raz

@Xander Right, we all start somewhere.

Xander

@raz Yep.

raz

I was originally turned around thinking he was asking, "I'm doing a password manager for fun, and want to store passwords in the clear. So i'm asking on a security site how to do that."

Maybe I just need to go home for the day

etherealflux

7:23 PM

I know of a far stronger scheme

No data about the passwords are stored in the manager

The manager is secured by a username and password

The user can only store one password in the manager

upon logging in, the user will have knowledge of the single password contained in the database, which must be the same as the password used to access it

to stop brute force attacks, the manager will pretend you've entered the right password if you get it wrong

Rory Alsop

@schroeder wait until 4 others have voted. That's the easy way :-)

Rоry McCune

Evenin' All

etherealflux

I went to a weird bus and someone tied hose on my arm and then stuck a needle in it

sounds sketchy

Rоry McCune

@etherealflux then did they give you chocolate to make you feel better about your ordeal?

etherealflux

7:39 PM

@RоryMcCune Nope, but I did get a banana

Rоry McCune

^is this you?

etherealflux

@RоryMcCune No, but this is

i'm actually two people

and a statistic

please respect my pronouns

etherealflux

7:51 PM

web.archive.org/web/20060206021547/http://www.spy-sheriff.com?

"Your computer is infected when [...] you have downloaded music or software from the Web"

Xander

8:05 PM

-1

A: Could malware move during a scan to avoid detection?

Yes to all three. AV companies and malware writers are in a constant game of cat-and-mouse with AV companies finding new ways to search and malware writers finding new ways to hide.