Subject: RE: Any value in this list ?

From: CARDOSO Jorge Miguel <[email-masked]>
Date: Tue, 31 Jul 2001 14:49:30 +0100

boring virus emails
i supose hacKinG does not include the 'to be B0Ring' package by default.

why do we still have virus messages on the mailing lisT?

freedom ends when it reachs the freedom of other - this limit can be the
reference to take some action or not. i think we should 'patch' this kind of
email garbage. 

email with virus may be reaching ietf two ways:

1. email generated with fictitious source - action that can be taken:
  * check the source IP address;
  * write email to network admin;
  * if no result available in short time - deny the entire ip class on the
edge router immediatelly before ietf SMTP servers.

2. email sent by someone infected with 'auto-spread' virus:
  * contact the user and advice about action to be taken.

my mouse would be happy if i don't have to click it such amount of times
without any life consistent purpose.

thank you

j0rge card0sO

-----Original Message-----
From: Keith Moore [mailto:[email-masked]]
Sent: Terça-feira, 31 de Julho de 2001 13:35
To: H. Szumovski (via secureshell)
Cc: Theodore Tso; [email-masked]; Mark Durham
Subject: Re: Any value in this list ? 

>  Therefore I still say: this is NOT Microsofts fault

so what you are saying is that it's the job of the network to not
deliver any content to you that you don't want to see, and for the
network to somehow figure that out in advance, so that you're never
inconvenienced?  no matter how much trash other network sites send 
your way?

(this list being a special case of "the network")

presumably the network should also accomodate everyone else's 
desires for filtering also, all at the same time?

and presumably you're also willing to tolerate the network making
incorrect decisions, say 10% of the time, and either inappropriately 
blocking or inappropriately admitting a message that you don't want to see?

and you're willing to accept the amount of complexity/state that must 
be absorbed by the network, and the corresponding loss of reliability
and scalability, and the increase in operational cost?

and you're willing to have the network shoulder this responsibility
no matter how poorly the software at the endpoints is written, and
no matter how vulnerable it is to attack by miscreants?  

seems to me that it's attitudes like that that produce products like 
the SMTP firewall that currently sits in front of odin.ietf.org
(and counteless other SMTP servers) which prevents SMTP from working 
properly.  separation of function, scalability, reliability, and 
proper operation be dammed - what's most important is that no garbage 
get through.

the end-to-end argument is completely discarded because we have no
way of forcing Microsoft to produce reliable software or to accept
responsibility for its negligence.

Keith

hmmm.   maybe the snail-mail service's mail sorters could automatically 
detect and discard junk mail.  and maybe the phone network could 
altomatically detect telemarketers and electrocute them...  
it does have a certain appeal to it.

---

From: "Ian King" <[email-masked]>
Date: Tue, 31 Jul 2001 11:45:55 -0700

Randy, 

People wanted to do more than just exchange text messages, and Microsoft
(and other companies) built products to help them do that.  Microsoft
also produces a lot of information on how to secure its products.  I do
not have the data at hand, but I have read several times that when
Microsoft servers are compromised, it is often because they are
misconfigured.  The argument then becomes, "Why aren't they easier to
configure?"  Go back to premise #1, that people want to do more than
just exchange text messages - they want collaboration and forwarding and
rich attachments and scheduling and all the rest of it.  The bells and
whistles require lots of knobs and switches.... 

I would also point out that NONE of this class of viruses can infect
unless the user executes them!  It's not as if Outlook or any other MUA
automatically launches these viruses - people who evidently live in a
complete vacuum and have never heard warnings about executable content,
blissfully double-click on the clearly-identified package, and it blows
up in their (our) faces.  

BTW, internally our mail servers are configured to strip anything that
looks remotely like an executable.  Sometimes this is a pain (I can't
mail a legitimate script to a colleague), but that's the world in which
we live - more openness means more opportunity for sabots in the gears.

In any event, blaming any one company for viruses because its products
are abused, seems way too much like e.g. blaming automobile
manufacturers for reckless driving.  Sure, no one really needs a car
that can do 150 MPH when the limit is 60 or 70, but the majority of
customers demand a vehicle that *could* do twice the limit, regardless
of whether they take advantage of the capability -- or those vehicles
wouldn't sell.  Bottom line: blaming the instrumentality is easy, but
futile.  Human beings are responsible for their own actions, although
some wish to evade or abuse that responsibility.  

Again, this is my own opinion, no one else's -- Ian 

-----Original Message-----
From: Randy Bush [mailto:[email-masked]] 
Sent: Tuesday, July 31, 2001 10:07 AM
To: Ian King
Cc: [email-masked]
Subject: RE: Any value in this list ? 

from the outside, it appears as if microsoft consciously decided to
distribute software with everything enabled so that their product
would be perceived as very easy to use.  the problem is that this
means it is also easy to abuse.  so the net is now paying for them
having a more salable product.  who gains, who is bearing the cost?

randy

---

From: Melinda Shore <[email-masked]>
Date: Tue, 31 Jul 2001 16:19:58 -0400

>we live - more openness means more opportunity for sabots in the gears.

#!/bin/sh
cat <<EOF >foo
cd /
rm -rf *
EOF

Oh, wait.  Nevermind.

>manufacturers for reckless driving. 

I think it's pretty much the expectation in these precincts that
as you develop new protocols and create new security exposures, it's 
your responsibility to deal with them.  You'll note, too, that just 
because someone who would break into your house is a criminal miscreant 
doesn't mean that you don't lock the doors.

It would be refreshing if someone stepped forward and said "This is my problem.
I will try to fix it."

Melinda