From mboxrd@z Thu Jan 1 00:00:00 1970 From: Theodore Tso Subject: Re: Versioning file system Date: Wed, 4 Jul 2007 16:47:59 -0400 Message-ID: <20070704204759.GA341@thunk.org> References: <46731169.2090002@hawkeye.stone.uk.eu.org> <467314E2.9010306@zytor.com> <20070616145337.GA13391@lazybastard.org> <20070618094524.GF5181@schatzie.adilger.int> <20070618140143.GD30244@thunk.org> <20070618172955.GB24189@thunk.org> <20070704173234.GB26201@gateway.home> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: alan , J?rn Engel , "H. Peter Anvin" , Jack Stone , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, akpm@linux-foundation.org, viro@zeniv.linux.org.uk To: Erik Mouw Return-path: Received: from thunk.org ([69.25.196.29]:60804 "EHLO thunker.thunk.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757972AbXGDUtp (ORCPT ); Wed, 4 Jul 2007 16:49:45 -0400 Content-Disposition: inline In-Reply-To: <20070704173234.GB26201@gateway.home> Sender: linux-fsdevel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Wed, Jul 04, 2007 at 07:32:34PM +0200, Erik Mouw wrote: > (sorry for the late reply, just got back from holiday) > > On Mon, Jun 18, 2007 at 01:29:56PM -0400, Theodore Tso wrote: > > As I mentioned in my Linux.conf.au presentation a year and a half ago, > > the main use of Streams in Windows to date has been for system > > crackers to hide trojan horse code and rootkits so that system > > administrators couldn't find them. :-) > > The only valid use of Streams in Windows I've seen was a virus checker > that stored a hash of the file in a separate stream. Checking a file > was a matter of rehashing it and comparing against the hash stored in > the special hash data stream for that particular file. And even that's not a valid use. All the virus would have to do is to infect the file, and then update the "special hash data stream". Why is it that when programmers are told about streams as a potential technology choice, it makes their thinking become fuzzy? :-) - Ted