Update: University virus writing debate gets heated

Anti-virus firm Sophos has waded back into the debate over Calgary University's virus writing course.

Graham Cluley, senior technology consultant for Sophos, hit out at the growing band of silicon.com readers who have come out in whole-hearted support of the University course.

In an email to silicon.com, Cluley said: "A number of your readers quoted think that it is good for people to analyse viruses to develop better anti-virus software. We are not in disagreement with this.

"What we do strongly disagree with the University of Calgary about is whether it is necessary to write new viruses to study them.

"In our opinion writing new viruses tells you nothing about how to defend against them. It's a bit like saying "building and planting new landmines helps you work out how to defuse them".

"Anti-virus researchers around the world do not write viruses for a number of reasons - not only would it be commercial suicide to have been found to have been writing the things we are supposed to be defending our customers against, but more fundamentally it serves no purpose whatsoever and would be a waste of our time.

"We develop better anti-virus software by examining the 80,000 viruses already in existence. If we wish to examine new potential threats which could be done by viruses in the future then this can be done through code which is not self-replicating. In other words, it is never necessary to write a virus to see what techniques viruses could use in the future.

"It appears that Dr Aycock of the University of Calgary's ideas are half-baked. It's interesting to note that a statement on his website says much of the anti-virus industry supports him, but he declines when asked to actually name any anti-virus organisation which agrees with him that writing viruses is in anyway useful."

Cluley's last point echoes the assertions of others in the anti-virus community. Trend Micro and Network Associates added their support to Sophos' stance on the Calgary course. All three companies have said they will not employ students who graduate through the course.