Rafiot
commented
2 years ago I'm not totally sure how to represent that efficiently and generically: the expectation is that unless it is green, do not touch it unless you know what you're doing, or can pass it along to someone who knows. I'm interested in better ways to inform the users, but it needs to be generic enough because all pandora is doing is looking for static indicators of potential maliciousness.
There are false positive, but pandora will generally err on the safe side (there is some work to do there, but that's the goal).
When pandora issues an alert, it would be great to get a small explanation about the reason for flagging something 'malicious'.
Example: docx contains OLE objects to local referenced files. This can be normal, but with the background of recent OLE reference exploits, it makes it malicious. Many people are not aware of such a vulnerability and may find pandora overreacting/exaggerating. A small tooltip with a reference/reason would help understanding.