Free Windows Desktop Software Security List - discussion thread

[MrBrian]

Does anyone have a preference for which of the following you'd like done first?
1. Rearrangement of list at the section level.
2. Inspection of each item on the list for issues.

---------
Addendum to post #4:

Phase 0.5: Use an automated link checker to identify broken links. Broken links will be repaired if possible or else deleted. Phase 1 won't begin until Phase 0.5 ends.

[Jojo Yee]

Originally Posted by MrBrian

Does anyone have a preference for which of the following you'd like done first?
1. Rearrangement of list at the section level.
2. Inspection of each item on the list for issues.

Probably item 1 can be done faster and that's also my preference.

[MidnightCowboy]

Originally Posted by MrBrian

The last time that I asked ako (which was probably before Windows XP stopped getting updates), he said that Windows XP-only items should be on the list.

In the case of non-signature-based programs such as ThreatFire or PE Guard that won't get any more updates, how are we supposed to know if they work against current threats without resorting to testing them?

Some might argue that software such as MSE and Agnitum is not much good against current threats but in the specific examples you quote of non-signature based programs, I would suggest that as custodians of the list, it is your choice to leave stuff out if there is reasonable doubt as to its effectiveness.

[MrBrian]

Originally Posted by MidnightCowboy

Some might argue that software such as MSE and Agnitum is not much good against current threats but in the specific examples you quote of non-signature based programs, I would suggest that as custodians of the list, it is your choice to leave stuff out if there is reasonable doubt as to its effectiveness.

I'll repeat a message that I had sent privately to J_L and ako:

J_L had previously mentioned that discontinued or old software that doesn't protect against current threats shouldn't be included. I think that's a good criterion, but I'm not sure what the threshold is. Does that mean that an item should be on the list unless it protects against no (or almost no) current threats? Also, if we don't know how good an item does against current threats (whatever the threshold is), do we keep it on the list or remove it?

[MidnightCowboy]

Originally Posted by MrBrian

I'll repeat a message that I had sent privately to J_L and ako:

Was there a response from ako?

[MrBrian]

Originally Posted by MidnightCowboy

Was there a response from ako?

I didn't get a response from either one yet. I sent it a few hours ago.

[J_L]

I think we should focus on that later. As for the criterion, isn't what we've always been doing (removing known ineffective programs) sufficient?

Yes, older programs that are XP-only should be kept. I'm not sure whether keeping them in the same sections or creating a new section is better though.

[MrBrian]

Originally Posted by J_L

I think we should focus on that later. As for the criterion, isn't what we've always been doing (removing known ineffective programs) sufficient?

"that" = ?

Ok, that sounds good. I didn't know (or didn't remember) that that was the criterion.

[MrBrian]

Some questions regarding the "Web application" key:
1. Do you ever take note of its use?
2. If the "Web application" key is used on a given item, one doesn't know if the given item is also a Windows application or not. One of the list editors thinks that there should be a new key named "Web and Windows application." Another list editor believes that there should be no changes to current practice. Any thoughts on this?

[MrBrian]

How about these new keys?
1. icon for "Discontinued or inactive"
2. icon for "Discontinued or inactive"(<= XP)
3. icon for "Discontinued or inactive"(<= Vista)
4. icon for "Discontinued or inactive"(<= 7)
5. icon for "Discontinued or inactive"(<= 8.0)
6. icon for "Discontinued or inactive"(<= 8.1)

Any of these could qualify as being discontinued or inactive:
1. Developer has explicitly said so.
2. Application website is no longer available.
3. Latest version is 3 or more years old.

The last 5 keys are the icon followed by various operating system-related text. The operating system-related text would only be used when there is evidence that the given program doesn't work on the next newest operating system.