A Fairy Tale

[Also published – because of the subject matter – on the Anti-Malware Testing blog]

Long ago and far away in a town called Santo Iago, the townsfolk were beset by plagues and pestilences. Sometimes green, poisonous frogs rained down from the sky. Sometimes great ferocious horses from the neighbouring city of El Troya rampaged through the town and the farms that surrounded it, trampling the crops and terrifying the children. Sometimes flying bugs would descend upon the farm animals, burrowing painfully into their hide and proving almost impossible to dislodge.

Over the years, however, a community of sorcerers arose in Santo Iago and developed notable skills in defence of the townsfolk, using a variety of spells and incantations. While they were unable to eradicate the plagues and pestilences completely, they did contrive to reduce the damage that was done, enabling the townsfolk to live a tolerable and sometimes even reasonably prosperous existence.

Yet the townsfolk were not happy. Certainly, those who were unfortunate enough to bear the brunt of new plague, and sometimes lost their livelihoods in consequence, had ample cause to complain. However, even those more fortunate grumbled that surely all those wizards could find a way of stopping all those plagues altogether?

Some even muttered that the wizards and sorcerers were surely casting spells themselves to _cause_ the plagues and pestilences, so that the people were obliged to give some of their hard-earned ducats and florins and centavos to those same wizards.

And in time, there arose a group of townsfolk called truthsayers or soothsayers, who had learned some of the ways of the magicians and undertoook to examine their spells and potions and incantations. Then they would tell the townsfolk which spells they believed to be most effective against the current wave of disasters.

Unfortunately, some of the truthsayers proved to be better at this form of spell divining than others, and when they passed on their opinions to the town crier, so that he might proclaim them to the populace, both he and the people became very confused, because different truthsayers said very different things about the same spells. This was not only because some knew the ways of divination and magic better than others, but also because their ways of divining changed according to the time of day, the nature of the plague, and even which quarter of the town they happened to be in at the time.

Still, the better soothsayers and sorcerers started to work together and learned from each others’ experience. In this way, they hoped to make a real difference to the lives of the townsfolk, and even banded together in a league called the Alliance of Magicians, Truthsayers, Soothsayers and Oracles. But one of their number began to whisper to the townsfolk, saying that the other truthsayers were too much in league with the sorcerers, and that only he knew the ways of the sorcerers well enough to say which of the sorcerers’ spells could be trusted. And some of the townsfolk noticed that his nose was getting longer as he talked, but this didn’t mean anything to them because in Santo Iago few of the bookshops sold Italian fairy tales.

But then this man (who called himself Ricrol The Trustworthy) went to the sorcerers and said that if they would share their treasure with him, he would tell them which spells he would be recommending, and if their spells weren’t included, they could come to some agreement. And his nose was getting longer all the time, but the sorcerers didn’t notice: they were too busy grumbling among themselves, because most of them weren’t sure that he was very good at divination, and knew that he didn’t even have his own oracles. But they also knew that the townsfolk not believe them if they said so. And because they were frightened that Ricrol would not recommend their spells even if he _could_ make them work properly, some of the richer sorcerers shared some of their treasure with him. But others, who didn’t trust him to interpret the auguries correctly, refused to share any treasure because he would not tell them how he was going to go about until he’d been paid.

When Ricrol had performed his rites, he told those sorcerers who’d shared their treasure what he was going to tell the town crier. And sure enough, some of them found that he’d made mistakes in his divination, and after much consultation, he told the town crier that their spells were good and had been cast in the right way. But he also said that the magicians who hadn’t given him some of their treasure had cast their spells in completely the wrong way, and that no-one should use those spells any more. And he told everyone that his divination was better than anyone else’s because he hadn’t been given treasure by one of the sorcerers. And in a way this was true, for more than one sorcerer had shared treasure with him.

Now when the sorcerers who hadn’t given Ricrol some of their treasure heard that he’d told the townsfolk that their spells were useless, they were very angry, because they were experienced wizards who knew that their spells were as good as anyone else’s. But then they thought that if there was something wrong with any of their spells, they needed to find out what so that they could do a better job of protecting the townsfolk who’d already bought their spells. And indeed, the Alliance of Magicians, Truthsayers, Soothsayers and Oracles had already passed a decree saying that it was very helpful for everyone if truthsayers were willing to tell the magicians what had gone wrong, so that they could fix their spells. Because Ricrol was a member of the league and had agreed that the decree should be passed, they asked him to tell them which plagues and spells he’d looked at, and how he’d performed his divination, as laid down in the decree.

But Ricrol, whose nose was, by now, getting very long indeed, said that he couldn’t quite remember how he’d come to his conclusions. However, if they would share some of their treasure with him, he would look through his book of divination and tell them what they wanted to know, and he’d be able to tell the town crier that they’d come to an agreement that suited all parties.

While the entire community of sorcerers and truthsayers was sitting open-mouthed and wondering what to say next, Ricrol strolled off home for some lunch, and to play some tunes on the new lute he’d just bought with some of the treasure he’d already been given.

But just as he stepped outside, a new plague of winged lawyers descended upon the town and a flock of them came straight for Ricrol. He tried to run back inside, but tripped over his own nose, and before he could get up again, they disembowelled him with their sharpened quills. Which wasn’t very nice for him, but at least everyone else (reasonably) happily ever after.

[This is, of course, a fairy tale. Obviously, nothing like this could ever happen in the real world. Least of all in anti-malware detection testing.]

Previously published here. Written, IIRC, while waiting for a delayed flight out of Geneva. And not something I would ever have considered publishing on the AMTSO blog… 

David Harley 
Small Blue-Green World
ESET Senior Research Fellow

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s