Subject: Any value in this list ?

From: "H. Szumovski (via secureshell)" <[email-masked]>
Date: Mon, 30 Jul 2001 12:45:39 +0200

Hi All,
if there is still somebody reading email to this list, I would be interested
if they see any value in being a part of this list. 95% of email to this list
are virus infected, and therefore deleted automatically by my mailserver, and I'm 
tired of filtering all the virus messages to the trash. Normally the listserver 
should just delete such messages without any information to the list itself. Because 
the listserver doesn't do that (which I think should be a standard behaviour of 
every listserver) I just unsubscribed from this rubbish.  
/Herbert

PS: My opinion about the default behaviour of every well administered listserver is:
.) Delete silently and don't forward ANY message with a virus attachment.
.) Delete silently and don't forward ANY message with the uppercased string 
   "[spam" in the subject.

At 11:47 30/07/2001, [email-masked] wrote:
>Incident Information:-
>
>Originator:    "Manh Chau Nguyen"<[email-masked]>
>Recipients:    [email-masked], [email-masked]
>Subject:  dem-rep-sal
>
>WARNING:  The file dem-rep-sal.doc.com you received was infected with the
>W32/SirCam@MM virus.  The file attachment is not delivered.

---

From: Mark Durham <[email-masked]>
Date: Mon, 30 Jul 2001 08:17:48 -0700

I'm doing the same. This is situation is absurd, and an embarrassment to the IETF. Those
I've mentioned it to (some of whom are *very* active in WGs) just shook their heads in
amazement.

If someone does set up a filtered version of this list, please let me know. And thanks
in advance.

> >W32/SirCam@MM virus.  The file attachment is not delivered.

- - - - - - - - -
mark durham
writer and editor
- - - - - - - - -

---

From: Randy Bush <[email-masked]>
Date: Mon, 30 Jul 2001 08:23:55 -0700

procmail is your friend

# thanks to Sematimba Noah K <[email-masked]>
:
*^Content-type: (multipart/mixed|application/octet-stream)
{
    :0 HB
    *^Content-Disposition: attachment;.*filename=".*\.(bat|com|exe|vbs|chm|hlp|shs|wsf|vbe|wsh|hta|pif)"
    {
        :0 fhbw
        |/usr/bin/sed -e 's/\([nN][aA][mM][eE]=".*\....\)"/\1.txt"/'
        :0 c
        /dev/null
        }
    }
#
# thanks to <oops!  rob or patrik or ....?>
:
* ^Subject:.*(Virus Alert$|Virus Notification: A virus has been detected|Antivirus Utility found the|Antigen found.*virus|Attachment Stripped in Transaction|ScanMail Message: To Recipient virus found and action taken.|Report to Recipient|Suspicious email message intercepted)
/dev/null

---

From: Theodore Tso <[email-masked]>
Date: Mon, 30 Jul 2001 12:09:41 -0400

On Mon, Jul 30, 2001 at 08:17:48AM -0700, Mark Durham wrote: I'm doing
> the same. This is situation is absurd, and an embarrassment to the
> IETF. Those I've mentioned it to (some of whom are *very* active in
> WGs) just shook their heads in amazement.

Personally, I'd say it's an embarassment to *Microsoft*.  Let's
allocate blame where it properly belongs.  They were the ones who made
the mail reader which made these sorts of viruses possible....

						- Ted

---

From: [email-masked]
Date: 30 Jul 2001 12:23:59 -0400

gnus nnmail-split-fancy filters for the various broken virus filters
that seem to be subscribed to the ietf list.

;;; stupid virus alarms
   ("subject" "Antigen found"                            "blackball")
   ("subject" "ScanMail Message"                         "blackball")
   ("subject" "Report to Recipient"                      "blackball")
   ("subject" "Suspicious email message intercepted"     "blackball")
   ("X-Guinevere" ".*"                                   "blackball")
   ("InterScan-Notification" "yes"                       "blackball")
   ("from"    "[email-masked]"                       "blackball")

I haven't been filtering the viruses themselves, because as a Linux
user I'm immune and I find the document payloads amusing.

-- 
Scott Lawrence                            [email-masked]
Virata Embedded Web & UPnP Technology    http://www.emweb.com/

---

From: Einar Stefferud <[email-masked]>
Date: Mon, 30 Jul 2001 09:55:34 -0700

The value of this list is only apparent when a real issue arises that 
needs attention for the whole IETF.

Until then, most of its content is clearly "UNINTERESTING"!

But, this list is valuable between episiodes of real need for it, if 
only because it lets us know that nothing really important is in need 
to serious IETF-wide discussion.

We all notice when the flow here becomes serious, and until then, a 
breif scan of unread received mail tells us that things are pretty 
mucn OK.

However, I too will be white happy to have the listserver cull out 
virus carriers;-)...  My uncounted estimate is that I have received 
several hundred SIRCAM worm messages here, and very very very few via 
any other lists, or by ordinary spam.

Fortunately, I do not use any of he tools that aid and abet the 
SIRCAM worm, so I am mostly entertained by the floods, as long as I 
do not get swept into the flood.

So, the real message in this otherwise gratuitous missive is that 
there does no appear to be much of any reason to look for great 
meaning in any of the current traffic.  It is just the ambient noise 
level of the day.

if such ambient noise is really bothersome, then for sure,
get thy self outfitted with proper ambient noise filters.

Cheers...\Stef

At 08:23 -0700 30/07/01, Randy Bush wrote:
>     *^Content-Disposition: 
>attachment;.*filename=".*\.(bat|com|exe|vbs|chm|hlp|shs|wsf|vbe|wsh|ht 
>a|pif)"
>     {
>         :0 fhbw
>* ^Subject:.*(Virus Alert$|Virus Notification: A virus has been 
>detected|Antivirus Utility found the|Antigen found.*virus|Attachment 
>Stripped in Transaction|ScanMail Message: To Recipient virus found 
>and action taken.|Report to Recipient|Suspicious email message 
>intercepted)
>/dev/null

---

From: Einar Stefferud <[email-masked]>
Date: Mon, 30 Jul 2001 12:06:18 -0700

Aye, Verily!  Here!  Here!  Let's Hear it For MicroSoft!

---

From: Lloyd Wood <[email-masked]>
Date: Mon, 30 Jul 2001 17:48:31 +0100 (BST)

On Mon, 30 Jul 2001, Mark Durham wrote:

> I'm doing the same. This is situation is absurd, and an
> embarrassment to the IETF.

how, exactly?

> Those I've mentioned it to (some of
> whom are *very* active in WGs) just shook their heads in
> amazement.
> 
> If someone does set up a filtered version of this list, please let
> me know. And thanks in advance.

ietf+censored has been running for several years under a variety of
maintainers. Notices about its existence are posted here periodically.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: grenville armitage <[email-masked]>
Date: Mon, 30 Jul 2001 13:16:55 -0700

> get thy self outfitted with proper ambient noise filters.

perhaps the wireless guys could teach us something - some blank out
noise over the link to conserve bandwidth, and re-introduce 'comfort
noise' at the end point. if we filtered email noise at the list root,
no doubt someone would develop 'comfort spam' and 'comfort virii
announcement' scripts so that people who want it can generate
their daily dose of random email noise locally.

gja

---

From: "Ole J. Jacobsen" <[email-masked]>
Date: Mon, 30 Jul 2001 13:17:58 -0700 (PDT)

The Honourable Gentleman is obviously unaware of the proper phrasing:

"Hear, Hear"  (as in "Listen, Listen").

Although Parliament is currently not in session, we must not forget
proper manners ;-)

Ole

Ole J. Jacobsen 
Editor and Publisher
The Internet Protocol Journal
Office of the CTO, Cisco Systems
Tel: +1 408-527-8972
GSM: +1 415-370-4628
E-mail: [email-masked]
URL: http://www.cisco.com/ipj

---

From: Mark Durham <[email-masked]>
Date: Mon, 30 Jul 2001 14:18:32 -0700

> the mail reader which made these sorts of viruses possible....

Well, yes, and point taken. For that matter, you can take it even further
upstream and blame Satan for all the world's evils, thereby washing your
hands of the whole mess. Obviously, Redmond is ultimately culpable here
(along with those who exploit their little loopholes); and, on the
downstream side, list subscribers must ultimately watch out for their own
interests. But moral superiority and libertarian ethics aside, the list
manager seems to be in an excellent position to solve this problem. Still,
if that's an unacceptable infringement of recipients' autonomy, so be it.
Some people make a strong argument for running an open relay, too (though
I don't buy that one either).

In any case, "embarrassment" was probably the wrong word, though I still
think "absurd" fits.

But I do agree re: Microsoft. And my apologies for being so ill-tempered.

---

From: William Allen Simpson <[email-masked]>
Date: Mon, 30 Jul 2001 17:25:38 -0400

And when opening the session "Oyez, Oyez"....

-- 
William Allen Simpson
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32

---

From: "H. Szumovski (via secureshell)" <[email-masked]>
Date: Tue, 31 Jul 2001 11:17:59 +0200

Well, though this may not be a topic for this list, I also want to add my
2 eurocent here (:-) .  First, I'm neither a MS hater nor a MS lover.
Actually this company is responsible for a lot of fun I had especially in
the last 12 months when I red their comments about open software and
especially Linux (please don't let us enter the philosophical discussion
here, if Linux and/or Linux/390 is open software or not).
  However, the problem here is NOT a MS problem. If we assume that 20,000
people are subscribed to this list, then 20,000 computers have to run
senseless filters to get rid of the crap mail.  My opinion is, if only
one (1) computer runs this filters (the listserver itself), this is
much much more efficient than anything else.  You may say, this doesn't 
help against spam and viruses mailed directly to you.  Though you are
right, this is a completely different quality of disturbing people at work.
Sending just ONE mail to a list may disturb and waste time of 100,000's
of people and waste CPU-time of 100,000's of computers.  This is definitely
not necessary, because the listserver itself could easily throw away this
crap.  Therefore I still say: this is NOT Microsofts fault, this is a
bad behaviour of the listserver, and again EVERY listserver's default behaviour
should be:
.) Throw silently away mails containing viruses,
.) Throw silently away mails containing the string "[spam" in the subject.
This would save lots of bandwidth for the Internet, and save lots of CPU
cycles of computers all over the world.
My 2 ec, Herbert

---

From: Keith Moore <[email-masked]>
Date: Tue, 31 Jul 2001 08:35:17 -0400

>  Therefore I still say: this is NOT Microsofts fault

so what you are saying is that it's the job of the network to not
deliver any content to you that you don't want to see, and for the
network to somehow figure that out in advance, so that you're never
inconvenienced?  no matter how much trash other network sites send 
your way?

(this list being a special case of "the network")

presumably the network should also accomodate everyone else's 
desires for filtering also, all at the same time?

and presumably you're also willing to tolerate the network making
incorrect decisions, say 10% of the time, and either inappropriately 
blocking or inappropriately admitting a message that you don't want to see?

and you're willing to accept the amount of complexity/state that must 
be absorbed by the network, and the corresponding loss of reliability
and scalability, and the increase in operational cost?

and you're willing to have the network shoulder this responsibility
no matter how poorly the software at the endpoints is written, and
no matter how vulnerable it is to attack by miscreants?  

seems to me that it's attitudes like that that produce products like 
the SMTP firewall that currently sits in front of odin.ietf.org
(and counteless other SMTP servers) which prevents SMTP from working 
properly.  separation of function, scalability, reliability, and 
proper operation be dammed - what's most important is that no garbage 
get through.

the end-to-end argument is completely discarded because we have no
way of forcing Microsoft to produce reliable software or to accept
responsibility for its negligence.

Keith

hmmm.   maybe the snail-mail service's mail sorters could automatically 
detect and discard junk mail.  and maybe the phone network could 
altomatically detect telemarketers and electrocute them...  
it does have a certain appeal to it.

---

From: "H. Szumovski (via secureshell)" <[email-masked]>
Date: Tue, 31 Jul 2001 15:51:20 +0200

>inconvenienced?  no matter how much trash other network sites send 

A listserver is not the "network" (actually I don't see anything which
IS "the network"). A listserver is just a more or less dumb server which
serves 1000's, possibly 100,000's of users. As mentioned, I don't see
any problem to add a virus-scanner and a short script to the listserver
to discard virus-attachments and spams. Though it will not find everything,
it will enhance the situation a lot.  I especially don't like the way one
company is lynched for every software problem in the world.  I use a mail
client who filters all these virus informations from this list into the 
trash and marks them read. Every mailclient can do that (possibly Outlook
cannot, I don't know and I don't care, because I don't use it).  BUT: this
is not the job of my PC and not the job of 10,000's of other PC's running
any OS with any mailclient you can think of. It's the job of the server
who spreads these mails around (because it seems to be too difficult to
put the childish or silly guys into jail, who have enough time to waste in
their life to create such mails). And I think it's an easy job, and there 
are no emotions necessary.
/Herbert

---

From: Keith Moore <[email-masked]>
Date: Tue, 31 Jul 2001 11:33:17 -0400

> I especially don't like the way one
> company is lynched for every software problem in the world.  

you'd rather put the burden of responsibility for solving the
problem on somebody besides the folks who caused it?

---

From: grenville armitage <[email-masked]>
Date: Tue, 31 Jul 2001 09:02:26 -0700

Keith Moore wrote:
	[..]
> inconvenienced?  no matter how much trash other network sites send

He didn't say that at all. But you know that.

gja

---

From: "Meritt James" <[email-masked]>
Date: Tue, 31 Jul 2001 12:23:07 -0400

How about the ones who have the problem doing a bit towards solving
THEIR problem?  

You think there is one-and-only-one cause for everything?  Perhaps you
didn't notice that the patch to repair the vulnerability that Red Code
exploits was released back in June?

-- 
James W. Meritt, CISSP, CISA
Booz, Allen & Hamilton
phone: (410) 684-6566

---

From: [email-masked]
Date: Tue, 31 Jul 2001 15:33:17 -0400

> .) Throw silently away mails containing the string "[spam" in the subject.

I've never actually seen a spam that has '[spam]' in the subject.

I save the RFC822 headers of mail I receive, and  of the 4,652 headers
I have going back to Feb 1, there are 13 that match 'grep -i spam'.  Of
those, 8 are from a thread "Subject: kyxspam: isc loses mind" and 5 are
from a thread "Subject: More member-only anti-spam".

On the other hand, I average 20-30 pieces of spam a day that do NOT
contain 'spam' in the Subject: header.  A better heuristic is called for.
-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech