Subject: RE: Any value in this list ?

From: "Ian King" <[email-masked]>
Date: Tue, 31 Jul 2001 09:41:50 -0700

The "folks who caused it" are the sociopaths who would rather use their
not inconsiderable technical skills to hurt other people.  I'm not aware
of any software that comes out of the box with a "launch nasty virus"
option; irresponsible people seek out and exploit weaknesses that are
unfortunately present in any non-trivial software product.  (Sendmail,
as a relevant example, has had its share of security issues over the
years; having been around for a long time in substantially the same
form, many of its problems have been discovered and patched.)  

You want true network security?  Unplug your net cable.  Otherwise, it
always has been and always will be a battle to stay ahead of the
barbarians, who will attack any structure simply because it's there.  --
Ian 

DISCLAIMER: Yes, I work for Microsoft.  No, I'm not speaking on behalf
of Microsoft, only myself.  So there.  

-----Original Message-----
From: Keith Moore [mailto:[email-masked]] 
Sent: Tuesday, July 31, 2001 8:33 AM
To: H. Szumovski (via secureshell)
Cc: Keith Moore; Theodore Tso; [email-masked]; Mark Durham
Subject: Re: Any value in this list ? 

> I especially don't like the way one
> company is lynched for every software problem in the world.  

you'd rather put the burden of responsibility for solving the
problem on somebody besides the folks who caused it?

---

From: Randy Bush <[email-masked]>
Date: Tue, 31 Jul 2001 10:06:33 -0700

from the outside, it appears as if microsoft consciously decided to
distribute software with everything enabled so that their product
would be perceived as very easy to use.  the problem is that this
means it is also easy to abuse.  so the net is now paying for them
having a more salable product.  who gains, who is bearing the cost?

randy

---

From: Keith Moore <[email-masked]>
Date: Tue, 31 Jul 2001 14:01:21 -0400

> not inconsiderable technical skills to hurt other people. 

No doubt that those people are also culpable.

But when we designed MIME we went to considerable trouble to understand 
the dangers of shipping around arbitrary content and making it easy to 
present aribtrary content, and to warn implementors of those dangers.  
Since that time there has been ample experience to indicate that our 
concerns were justified, and which should further inform implementors of 
the dangers.

It's hard for implementors to claim they weren't aware of the risks.

> I'm not aware
> option; 

It's not called "launch nasty virus", of course.  
It's called "launch arbitrary content with a single click from 
inside a mail user agent".  "nasty virus" just happens to be a 
(very common) special case of "arbitrary content".

The risk of virus transmision would be there in any case, and 
other systems have fallen victim to similar attacks even when 
launching was not so easy (anyone remember CHRISTMA EXEC ?).  
However the design choice to allow arbitrary content to be launched 
in a single click makes the probability of infection *much* greater.

It's not as if Microsoft is the only party guilty of shipping
product that makes systems so vulnerable to infection.  But the
more customers you have, the more systems you make vulnerable
when you make a mistake, and the greater your liability - not just
to your own customers but to everyone else on the net.

Keith

---

From: Edward Lewis <[email-masked]>
Date: Tue, 31 Jul 2001 19:03:25 -0400

Isn't this what Cliff Stoll wrote about Unix vendors in the Cuckoo's Egg? ;)

>having a more salable product.  who gains, who is bearing the cost?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

You fly too often when ... the airport taxi is on speed-dial.

Opinions expressed are property of my evil twin, not my employer.

---

From: Greg Minshall <[email-masked]>
Date: Tue, 31 Jul 2001 17:40:52 -0700

(bias indicator: i'm a microsoft basher; hate them, hate them!)

here's what i think...

when Ted said:
----
Personally, I'd say it's an embarassment to *Microsoft*.  Let's
allocate blame where it properly belongs.  They were the ones who made
the mail reader which made these sorts of viruses possible....
----
i thought, "well, *i* can't complain; i'm certain there's at least one CERT 
advisory on buffer overflow in, say, telnetd, that's my fault."

and, it occurred to me (as it has to many, i'm sure) that microsoft is 
targeted so much because, in the immortal words of Milo Medin, they have a 
larger ballistic cross-section (i think i got that expression right).

Randy said:
----
from the outside, it appears as if microsoft consciously decided to
distribute software with everything enabled so that their product
would be perceived as very easy to use.  the problem is that this
means it is also easy to abuse.  so the net is now paying for them
having a more salable product.  who gains, who is bearing the cost?
----
and i think, well, to be fair, that's been a problem almost *all* companies 
getting into networking have had, even (i think) the early router companies.  
at kinetics (an early [mostly macintosh] router company), we constantly had 
tension between "plug and play" for home/small office users and "it ain't on 
the net till i bloody well say it's on the net" from sysadmins in large sites. 
 (someone quoted Cuckoo's Nest as saying the same about mid-1980's Unix boxes 
and that might be true, too; certainly i think ``ipforwarding'' was set to 1 
by default for a long time.)

again, in fairness, i think this is an issue that takes a while for a 
corporate culture (*any* not-already-heavily-internet-imbued corporate 
culture) to incorporate.  so, i can't blame microsoft for not getting it (but, 
it would be good for them to get it as soon as possible!).

now, maybe there are many subtleties i don't see (undoubtedly there are).  
but, as much as i like bashing Microsoft, on this particular point i am "first 
stone inhibited".  and, know that whatever is the biggest target is going to 
take the most (in number and in sophistication) shots.

(i also, in total ignorance, have a tinge of wonder as to whether something we 
haven't yet defined in MIME, or something we defined incorrectly, might have 
some bearing on this.  i can't define that any better than that, though it 
seems maybe there could be some way of marking "this part will be executed".)

cheers,  Greg Minshall (happy FreeBSD user)

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 1 Aug 2001 02:44:05 +0200

All vendors do it, because no matter what customers say, they really do prefer
ease of use and fancy features to system security.  If you try to sell a truly
secure system that is configured by default in a secure mode, nobody will buy
it.  Any vendor that wants to stay in business, including Microsoft, rapidly
comes to understand this.

---

From: Keith Moore <[email-masked]>
Date: Tue, 31 Jul 2001 21:11:18 -0400

> i also, in total ignorance, have a tinge of wonder as to whether something 
> we haven't yet defined in MIME, or something we defined incorrectly, might 
> have some bearing on this.  i can't define that any better than that, 
> though it seems maybe there could be some way of marking "this part 
> will be executed".

Part of the problem is that the predecate "can be executed" (or more
precisely, "can have harmful side-effects if evaluated/presented on 
your computer") evaluates to "true", under some circumstances, for
essentially everything - including plain text if being viewed on 
a terminal with a programmable answerback sequence.   It's certainly
true for most word processor documents, spreadsheets, presentation
formats, etc.    These formats were designed for maximum flexibility
rather than maximum security.

MIME content-type registration rules tried to deal with this by requiring
the person registering a content-type to analyze and document security 
considerations of that type.  That was intended to serve as a warning to
implementors to allow them to provide effective countermeasures.

Unfortunately, one major vendor decided to disregard the content-type and 
make dispatching decisions based primarily on the filename suffix - thus 
bypassing MIME's carefully crafted compromise between security and 
flexibility.

Keith