Re: Eliminating Virus Spam
On Wed, 03 Jan 2001 23:57:53 -0500 (EST), you wrote: 1. Should the IETF elist messages be scanned for viruses? This would require that appropriate virus detection software exist in the environment that the mail list is operated. Are you aware of eg an Acorn Archimedes virus scanner that runs in a vax/vms environment? 2. Should the IETF elist restrict the type of content that can be submitted? I see no reason that the IETF list(s) should not be restrictd to plaintext[1], with either a remove-the-attachment or even drop-the-message approach (possibly with an automated unsubscribe) to non text attachments / content. Anyone who wants to distribute non plaintext can post it on a website or ftp directory somewhere for collection by those who actually want it. Rgds Denis [1] Text based markup eg html is *NOT* plaintext in this context. -- Denis McMahon Usenet: Trim quotes Mobile: +44 7802 468949Reply at the end Email: [EMAIL PROTECTED] Don't use html I trim ng when posting! Email domain blocking in use
Re: Eliminating Virus Spam
Vernon, I fully agree with you: there is no reason to get multipart messages in technical discussion mailing lists. Even if your solution seems drastic this is the way we should go. Thanks! [EMAIL PROTECTED]
Re: Eliminating Virus Spam
In message [EMAIL PROTECTED], Francis D upont typed: Vernon, I fully agree with you: there is no reason to get multipart messages in technical discussion mailing lists. Even if your solution seems drastic this is the way we should go. i'd prefer to see us develop a more 21st century solution first, we should register mime types that we DO allow on a list second, if someone must send an executable attachment , then we have a signing server that signs the attachment as trustworthy - most of the stupid atachments come from places who wouldnt be part of my trust chain. cheers jon
Re: Eliminating Virus Spam
"James" == James M Galvin [EMAIL PROTECTED] writes: James On the other hand, I think it's a feature to be able to send documents James (even text-based documents) as attachments as opposed to inline and I James further consider it a feature that Internet Draft announcements and RFC James announcements are multipart with functional pointers to the Emphasis on *pointers* Sending of IDs to the WG lists is a terrible practice. :!mcr!:| Solidum Systems Corporation, http://www.solidum.com Michael Richardson |For a better connected world,where data flows fastertm Personal: http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED]
Re: Eliminating Virus Spam
fwiw, ietf+censored currently has the following set of filters in taboo_body: /^Antigen for Exchange found/ /^Virus Notification: A virus has been detected/ /^Antivirus Utility for Exchange found .* infected/ /^Content-Type: application\/x-msdownload/i the last one is ONLY included because I got so very tired of scanning the virus notifications trapped by the first 3 lines (23 caught at last count). It is my arbitrariness, not a virus-scanning service. -- Harald Tveit Alvestrand, [EMAIL PROTECTED] +47 41 44 29 94 Personal email: [EMAIL PROTECTED]
Re: Eliminating Virus Spam
Please point to an example of a useful multipart message seen in this list or that might someday be useful in this mailing list. I have sent to wg lists a multipart containing a preamble and an internet-draft or similar file. This makes it easy for recipients to save the draft as-is. Sometimes I have made the file a content/external-body to avoid stuffing O(100kB) into many mailboxes where it wouldn't be wanted. You said "this list", but the above scenario would apply if the document were pertinent to a BOF or brand-new working group.
Re: Eliminating Virus Spam
This distinction between filtering content and virus scanning is confusing because they are not the same thing. To choose to filter content (restrict it to text/plain or some other limited set) would be changing the policy of this elist. That is more than an operational decision and probably deserves more debate, although not here. To choose to scan for viruses is an operational decision. I never said anything about safety. You can not do virus scanning principally for safety reasons. To be sure that's a contributing factor but the truth is you're only as safe as your last virus description update. We're all whining about vacation and virus notices and how we want them filtered off the elist and I just don't see how filtering for viruses in the first place is any different. This is about being a "good net citizen". Sending a virus to me (the royal "me" because like Ted T'so viruses are irrelevant to me personally since I use a UNIX box, a safe MUA, and my email system scans for viruses) is only going to teach me that you know how to contribute to the abuse of the Internet. The source of the problem is not me for letting you send me a virus. The source of the problem is the originator who sent the message and the IETF elist is being used like an open email relay is used by spammers. The IETF elist is irresponsibly contributing to the waste of resources and abuse of the Internet. Send the problem back to the originator, not to me. Unsubscribing them may make you feel better but it doesn't give you the chance to chastise them, again and again if you're lucky. And the argument about virus scanning being platform specific is specious. Your vulnerability to a virus is directly proportional to how well you protect yourself. Software developers/suppliers contribute to this problem but if you were protecting yourself they wouldn't be in business. Microsoft Windows may be the predominant OS that supports applications that contribute to the development and distribution of viruses, but it is the application data that is the virus not the OS. Microsoft Word macros can be run on UNIX and text/html with javascript runs virtually anywhere. A virus scanner scans content, a sequence of bytes. It can do this on any platform, regardless of the intended destination platform of the content. The virus may be platform specific but that is irrelevant. Jim
Re: Eliminating Virus Spam
On Wed, 3 Jan 2001, James M Galvin wrote: I think this discussion needs to separate at least two distinct issues. 1. Should the IETF elist messages be scanned for viruses? 2. Should the IETF elist restrict the type of content that can be submitted? Bear this in mind when you say that - I am running (in the spirit of inclusion) an operating system / mailservice that I wrote myself. My system is set up such that, upon receiving an e-mail which contains any sort of attachment it does not recognize (and it doesn't recognize anything but 7-bit ASCII text), it immediately replies to every address mentioned in the e-mail, including every attachment, and throwing in a virus for every other system for which one is known. Please be certain to include virus-scanning which respects the fact that to my system, all attachments are viruses. (Naturally, I have configured my system to APPEAR as though I'm just using PINE, but trust me - it works the way I say it does. Really.) -= flail? http://flail.com/ =- -= the online comic strip =-
multipart/signed (was Re: Eliminating Virus Spam )
The fact that very few can/do create/verify multipart/signed email is mostly a statement on the extremely sad state of security on the Internet; to which I guess I'm contributing by not signing my mail :-( The use of authenticating tehcnology (even if it is just to authenticate that two messages came from the same nym) should be encouraged, not blocked. Donald === Donald E. Eastlake 3rd[EMAIL PROTECTED] 155 Beaver Streeet [EMAIL PROTECTED] Milford, MA 01757 USA +1 508-634-2066(h) +1 508-261-5434(w) From: Michael Richardson [EMAIL PROTECTED] Message-Id: [EMAIL PROTECTED] In-Reply-To: Your message of "Wed, 03 Jan 2001 17:03:16 PST." [EMAIL PROTECTED] Date: Thu, 04 Jan 2001 07:55:56 -0500 "hardie" == hardie [EMAIL PROTECTED] writes: hardie Example: hardie A multipart/signed message containing a pgp signature known to hardie some/all members of this list. As, for example, the ietf registrar pgp hardie signature (see http://www.ietf.org/ietf-registrar.asc). Of the subset that can process PGP, a very small number can actually process multipart/signed. I have never got mailcrypt.el to do it, the Euroda and Outlook PGP plug-ins don't do it. The only ones that I know do it are PINE, ELM and EXMH. So, such a message would be better done as a straight clear-signed message. :!mcr!:| Solidum Systems Corporation, http://www.solidum.com Michael Richardson |For a better connected world,where data flows fastertm Personal: http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED]
Re: Eliminating Virus Spam
second, if someone must send an executable attachment , then we have a signing server that signs the attachment as trustworthy and how, and using what criteria, would the signing server evaluate the trustworthiness of the attachment? e.g. I might consider an attachment that installed NetBSD on top of an existing Windows system to be absolutely trustworthy (so long as it did it's job well) and performing a valuable community service, but others might not agree... (they might insist that Linux be installed instead.) Keith
Technical Internet Advancements for White House Internet Strategies
I am looking for a few leading Internet technical experts to contribute their ideas for an online conference on the *use* of the Internet by the next White House. What advancing Internet standards and tools should be considered? What would you do if you were in charge? What could the White House do to filter and respond to the millions of e-mails it receives in a more effective manner? How might syndication and XML strategies be employed? If you'd like to contribute a short essay to the event as described below, please drop me a note [EMAIL PROTECTED] with your suggested topic area. - Steven Clift - Democracies Online - White House 2001 Online Conference Envisioning the Next White House Web Site - Opens with 100 Participants An online event through January 18, 2001 to generate ideas and exchange information on the next White House web site. What should the next White House Web site do? What should it look like? How should the White House use online communications strategically to connect with citizens and govern? How this facilitated and moderated online exchange will work: 1. Idea Bullets - Each participant is encouraged to share one short idea for the next White House web site. 2. Strategic Essays - Internet leaders and netizens are asked to contribute short 400-500 word essays covering a specific Internet *use* strategy the White House should consider. Big ideas and solid advice wanted! These essays should be submitted to the online event facilitator, Steven Clift [EMAIL PROTECTED] for review. 3. General Comments - All participants are encouraged to comment and add to the ideas sent to the forum. All posts will be moderated with a general limit of one or two posts per day per person. To keep message volume in check, some messages may be held one or two days. To JOIN the online conference, simply send an e-mail to: [EMAIL PROTECTED] To messages via the web or choose digest options visit: http://www.egroups.com/group/do-whitehouse To join the 1600 member Democracies Online Newswire moderated announcement e-mail list, get the full details at: http://www.e-democracy.org/do This is a strictly unofficial activity. Content from the online event will be made available to White House officials and the public. Hosted by Steven Clift http://publicus.net with the Democracies Online Newswire http://e-democracy.org/do. If your organization would like to Co-Sponsor this event, all you need to do is bring 20 verified participants to the forum or send information about the forum to at least 1000 people on an e-mail list run by your organization. Contact [EMAIL PROTECTED] to co-sponsor this event.
Re: Eliminating Virus Spam
From: Jon Crowcroft [EMAIL PROTECTED] i'd prefer to see us develop a more 21st century solution first, we should register mime types that we DO allow on a list second, if someone must send an executable attachment , then we have a signing server that signs the attachment as trustworthy - most of the stupid atachments come from places who wouldnt be part of my trust chain. It would be more of a 21st century something to have the IETF join Microsoft in equating authentication (e.g. signing) with authorization (e.g. who gets to run programs on your computers). However, "solution" is not the best word for what it would be. In other words, please consider how little you would need to adapt http://www.cert.org/reports/activeX_report.pdf if you did such a thing. In still other words, do you really think that I should automatically be part of your trust chain? Vernon Schryver[EMAIL PROTECTED]
Re: Technical Internet Advancements for White House Internet Strategies
some of the folks on this list aren't american or US citezens and might think that this is a bit presumptious.but here goes:- the first thing the white house should do is educate its customers and organise voting properly the next thing it should do is apply for membership of the European Union following that, the use of other languages might be a considerably benefit - e.g. spanish, chinese and hopi spring to mind finally, what fee is being paid for this, and in what (stable) currency, and under which tax treaty? :-) In message [EMAIL PROTECTED], Steven Clift typed : I am looking for a few leading Internet technical experts to contribute their ideas for an online conference on the *use* of the Internet by the next White House. What advancing Internet standards and tools should be considered? What would you do if you were in charge? What could the White House do to filter and respond to the millions of e-mails it receives in a more effective manner? How might syndication and XML strategies be employed? If you'd like to contribute a short essay to the event as described below, please drop me a note [EMAIL PROTECTED] with your suggested topic area. - Steven Clift - Democracies Online - White House 2001 Online Conference Envisioning the Next White House Web Site - Opens with 100 Participants An online event through January 18, 2001 to generate ideas and exchange information on the next White House web site. What should the next White House Web site do? What should it look like? How should the White House use online communications strategically to connect with citizens and govern? How this facilitated and moderated online exchange will work: 1. Idea Bullets - Each participant is encouraged to share one short idea for the next White House web site. 2. Strategic Essays - Internet leaders and netizens are asked to contribute short 400-500 word essays covering a specific Internet *use* strategy the White House should consider. Big ideas and solid advice wanted! These essays should be submitted to the online event facilitator, Steven Clift [EMAIL PROTECTED] for review. 3. General Comments - All participants are encouraged to comment and add to the ideas sent to the forum. All posts will be moderated with a general limit of one or two posts per day per person. To keep message volume in check, some messages may be held one or two days. To JOIN the online conference, simply send an e-mail to: [EMAIL PROTECTED] To messages via the web or choose digest options visit: http://www.egroups.com/group/do-whitehouse To join the 1600 member Democracies Online Newswire moderated announcement e-mail list, get the full details at: http://www.e-democracy.org/do This is a strictly unofficial activity. Content from the online event will be made available to White House officials and the public. Hosted by Steven Clift http://publicus.net with the Democracies Online Newswire http://e-democracy.org/do. If your organization would like to Co-Sponsor this event, all you need to do is bring 20 verified participants to the forum or send information about the forum to at least 1000 people on an e-mail list run by your organization. Contact [EMAIL PROTECTED] to co-sponsor this event. cheers jon
Re: Eliminating Virus Spam
From: "Matt Crawford" [EMAIL PROTECTED] Please point to an example of a useful multipart message seen in this list or that might someday be useful in this mailing list. I have sent to wg lists a multipart containing a preamble and an internet-draft or similar file. This makes it easy for recipients to save the draft as-is. Sometimes I have made the file a content/external-body to avoid stuffing O(100kB) into many mailboxes where it wouldn't be wanted. You said "this list", but the above scenario would apply if the document were pertinent to a BOF or brand-new working group. I'm having trouble parsing that. I agree that depending on the I-D and the WG, sending I-D's to working group lists is sometimes a good thing. I don't think MIME is required for that and wouldn't choose it myself, but I agree a working group could agree to tolerate or prefer it. However, sending I-D's to this list is not only not kosher, but an anathema. Sending content/external-body instead of the 100KB thing itself anywhere could be swell, except that the state of word puts it somewhere between irrelevant and a bad idea: 1. many MUA's automatically dereference all pointers they find anywhere, whether in separate MIME attachments or in-line 2. many slimey outfits use that fact with "web bugs" for violating privacy, and have convinced other outfits to help them do that (e.g. my soon-to-be-ex on-line stock broker) 3. so anyone with any sense turns off all automatic dereferencing and uses the manual hooks to #1, and that makes content/external-body irrelevant. In other words, who has the least trouble dereferencing a URL in a 7-bit ASCII message without a single MIME header? ... ] From: James M Galvin [EMAIL PROTECTED] ] ... ] To choose to filter content (restrict it to text/plain or some other ] limited set) would be changing the policy of this elist. That is more ] than an operational decision and probably deserves more debate, although ] not here. Someone should tell Mr. Galvin that this is not a "general elist," although it has been identified by some as a haunt of "elitist legacy programmers." ] ... ] viruses, but it is the application data that is the virus not the OS. ] Microsoft Word macros can be run on UNIX and text/html with javascript ] runs virtually anywhere. That seems to be based on a non-standard definition of "virus." Neither MS Word macros nor text/html javascript are likely to be infectious on reasonable or even most UNIX boxes. Just running MS Word macros on most UNIX boxes is between difficult and impossible. (Yes, I've heard about StarOffice.) ] ... ] A virus scanner scans content, a sequence of bytes. It can do this on ] any platform, regardless of the intended destination platform of the ] content. If wishes were horses then beggars would ride. Or what MIME attachment virus scanners are there for NetBSD? ] The virus may be platform specific but that is irrelevant. That sounds reasonable only to members of the Church of Redmond. Vernon Schryver[EMAIL PROTECTED]
Re: Technical Internet Advancements for White House Internet Strategies
In message [EMAIL PROTECTED], Jon Crowcroft writes: some of the folks on this list aren't american or US citezens and might think that this is a bit presumptious.but here goes:- I think you're over-assuming -- from looking at the Web site, I did not get the impression that this was in any way organized by the White House. It looks like something that Clift is organizing on his own. (Steven Clift, am I wrong on that point? Is this being done by request of the incoming administration?) the first thing the white house should do is educate its customers and organise voting properly Sigh. the next thing it should do is apply for membership of the European Union I doubt they'd want us, though if they did it would end the problem of the Euro dropping with respect to the dollar... --Steve Bellovin
Re: Technical Internet Advancements for White House Internet Strategies
the next thing it should do is apply for membership of the European Union I'm unclear on this concept. Wouldn't it rather make a mockery of the EU (or at least of the name) if countries from outside Europe start joining up? Sort of like admitting Japan into NATO. RGF Robert G. Ferrell, CISSP Information Systems Security Officer National Business Center U. S. Dept. of the Interior [EMAIL PROTECTED] Who goeth without humor goeth unarmed.
Re: Technical Internet Advancements for White House Internet Strategies
following that, the use of other languages might be a considerably benefit - e.g. spanish, chinese and hopi spring to mind Add Dineh (Navaho), don't want to inflame the Joint-Use Area conflict any further, though Hopi do go Republican (those who "vote"), unlike the majority of Dinetah and away-Dineh voters. Bear in mind that the core of claims by Indigenous Peoples in the current and former British North America and their successor states, apply to the English Crown (in Right of Canada, and unsevered by the Treaty of Paris), and do not make reference to theories of (immigrant) civil rights or equity. We'd still like a recount, thanks awfully, even if conducted in English. Kitakitamatsinopowaw, (see you again, probably someplace cold), Eric
Re: Eliminating Virus Spam
Michael Richardson [EMAIL PROTECTED] writes: Sending of IDs to the WG lists is a terrible practice. Sending short IDs to WG lists or longer IDs in parts as the WG goes over them results, in my experience, in more detailed and easier to follow comments than pointers. YMMV. It's not appropriate for every version of the ID, but it's not a bad idea at several points in the process. -- Russ Allbery ([EMAIL PROTECTED]) http://www.eyrie.org/~eagle/
Re: Eliminating Virus Spam
On Thu, 04 Jan 2001 09:40:41 MST, Vernon Schryver [EMAIL PROTECTED] said: It would be more of a 21st century something to have the IETF join Microsoft in equating authentication (e.g. signing) with authorization (e.g. who gets to run programs on your computers). However, "solution" is not the best word for what it would be. Authentication: "Yes, your driver's license, fingerprint, retina, and voice scans all agree you are the *real* Jeffrey Dahmer." Authorization: "Would you like to borrow a steak knife, Mr Dahmer?" Amazingly enough, we tolerate that same exact logical disconnect from a major vendor of system software. Unfortunately, between the even-worse than current shrink-wrap licensing included in UCITA, and the incoming presidential administration, it may take a really creative lawyer making a case of it being a "crime against humanity" and trying the case at The Hague to fix it... ;( Valdis Kletnieks Operating Systems Analyst Virginia Tech
