Mikko Hypponen of F-Secure, an antivirus company, wrote an interesting post discussing the limits of antivirus software. Of particular note is that Flame, Stuxnet, and Duqu were all reported to antivirus firms months or years before they were flagged as malware. He suggests that his and other antivirus firms failed because of the sophistication of