Larry, thanks for a great article! Since I was assimilated into the anti-malware industry I've got used to being the object of automatic suspicion and derision, or simply ignored. I'm delighted to read an article that not only takes our concerns seriously (not just those of the vendors, but of the testing industry, reviewers and so on) but actually builds on them. If there's one overriding reason why I've been putting much of my own energy into AMTSO, it's because I feel that if the community in general is to get more benefit from detection testing, there needs to be more critical thinking and less destructive thinking.

This article is an outstanding example of what I think AMTSO is about: not the autocratic laying down of set-in-concrete commandments (though I think these principles are a huge step forward), but the evolution of better practice through informed discussion. Testing is a complex and dynamic field - it has to be, given the nature of the threat this industry is trying to mitigate - and this thoughtful commentary can only help to clear some of the gog around it.

David Harley
Director of Malware Intelligence
ESET LLC

Fine article, Larry. The group is looking for participation from experienced reporters and testers like you.
At the very least, please post comments on the rfc's as new drafts become available.

http://blog.threatfire.com/2008/11/amtso-on-eweek.html