Re: gatwick - hilton info?

2001-07-31 Thread Lyndon Nerenberg

 Arriving late Sunday (10pm arrival scheduled) at Gatwick and going from there
 to the Hilton Metropole.  The transportation web page gives lots of hype about
 how convenient the hotel is to just about everything, but precious little
 detail.  Would someone who knows this sort of thing recommend the Gatwick
 Express and then a taxi from Victoria Station?  (I'll have luggage, so the
 underground isn't appealing.)

Take the Gatwick Express to Victoria Stn. (30 minutes *iff* it's running
on time.) If you're quick about it you should still be able to take the
underground to Paddington (check at Victoria to see if it's still running
when you get there). From Victoria underground, take the Circle Line
westbound to Edgware Road station, which is right across the stret.

--lyndon (who made the trip yesterday)




Re: gatwick - hilton info?

2001-07-31 Thread Lyndon Nerenberg

 Express and then a taxi from Victoria Station?  (I'll have luggage, so the
 underground isn't appealing.)

Sorry, I missd the luggage bit. Yes, you'll want to take a taxi from
Victoria.




Re: Any value in this list ?

2001-07-31 Thread H. Szumovski (via secureshell)

Well, though this may not be a topic for this list, I also want to add my
2 eurocent here (:-) .  First, I'm neither a MS hater nor a MS lover.
Actually this company is responsible for a lot of fun I had especially in
the last 12 months when I red their comments about open software and
especially Linux (please don't let us enter the philosophical discussion
here, if Linux and/or Linux/390 is open software or not).
  However, the problem here is NOT a MS problem. If we assume that 20,000
people are subscribed to this list, then 20,000 computers have to run
senseless filters to get rid of the crap mail.  My opinion is, if only
one (1) computer runs this filters (the listserver itself), this is
much much more efficient than anything else.  You may say, this doesn't 
help against spam and viruses mailed directly to you.  Though you are
right, this is a completely different quality of disturbing people at work.
Sending just ONE mail to a list may disturb and waste time of 100,000's
of people and waste CPU-time of 100,000's of computers.  This is definitely
not necessary, because the listserver itself could easily throw away this
crap.  Therefore I still say: this is NOT Microsofts fault, this is a
bad behaviour of the listserver, and again EVERY listserver's default behaviour
should be:
.) Throw silently away mails containing viruses,
.) Throw silently away mails containing the string [spam in the subject.
This would save lots of bandwidth for the Internet, and save lots of CPU
cycles of computers all over the world.
My 2 ec, Herbert

At 23:18 30/07/2001, Mark Durham wrote:
Theodore Tso wrote:

 On Mon, Jul 30, 2001 at 08:17:48AM -0700, Mark Durham wrote: I'm doing
  the same. This is situation is absurd, and an embarrassment to the
  IETF. Those I've mentioned it to (some of whom are *very* active in
  WGs) just shook their heads in amazement.

 Personally, I'd say it's an embarassment to *Microsoft*.  Let's
 allocate blame where it properly belongs.  They were the ones who made
 the mail reader which made these sorts of viruses possible

 - Ted

Well, yes, and point taken. For that matter, you can take it even further
upstream and blame Satan for all the world's evils, thereby washing your
hands of the whole mess. Obviously, Redmond is ultimately culpable here
(along with those who exploit their little loopholes); and, on the
downstream side, list subscribers must ultimately watch out for their own
interests. But moral superiority and libertarian ethics aside, the list
manager seems to be in an excellent position to solve this problem. Still,
if that's an unacceptable infringement of recipients' autonomy, so be it.
Some people make a strong argument for running an open relay, too (though
I don't buy that one either).

In any case, embarrassment was probably the wrong word, though I still
think absurd fits.

But I do agree re: Microsoft. And my apologies for being so ill-tempered.




RE: Any value in this list ?

2001-07-31 Thread CARDOSO Jorge Miguel


boring virus emails
i supose hacKinG does not include the 'to be B0Ring' package by default.

why do we still have virus messages on the mailing lisT?

freedom ends when it reachs the freedom of other - this limit can be the
reference to take some action or not. i think we should 'patch' this kind of
email garbage. 


email with virus may be reaching ietf two ways:

1. email generated with fictitious source - action that can be taken:
  * check the source IP address;
  * write email to network admin;
  * if no result available in short time - deny the entire ip class on the
edge router immediatelly before ietf SMTP servers.

2. email sent by someone infected with 'auto-spread' virus:
  * contact the user and advice about action to be taken.


my mouse would be happy if i don't have to click it such amount of times
without any life consistent purpose.



thank you



j0rge card0sO


-Original Message-
From: Keith Moore [mailto:[EMAIL PROTECTED]]
Sent: Terça-feira, 31 de Julho de 2001 13:35
To: H. Szumovski (via secureshell)
Cc: Theodore Tso; [EMAIL PROTECTED]; Mark Durham
Subject: Re: Any value in this list ? 


  Therefore I still say: this is NOT Microsofts fault

so what you are saying is that it's the job of the network to not
deliver any content to you that you don't want to see, and for the
network to somehow figure that out in advance, so that you're never
inconvenienced?  no matter how much trash other network sites send 
your way?

(this list being a special case of the network)

presumably the network should also accomodate everyone else's 
desires for filtering also, all at the same time?

and presumably you're also willing to tolerate the network making
incorrect decisions, say 10% of the time, and either inappropriately 
blocking or inappropriately admitting a message that you don't want to see?

and you're willing to accept the amount of complexity/state that must 
be absorbed by the network, and the corresponding loss of reliability
and scalability, and the increase in operational cost?

and you're willing to have the network shoulder this responsibility
no matter how poorly the software at the endpoints is written, and
no matter how vulnerable it is to attack by miscreants?  

seems to me that it's attitudes like that that produce products like 
the SMTP firewall that currently sits in front of odin.ietf.org
(and counteless other SMTP servers) which prevents SMTP from working 
properly.  separation of function, scalability, reliability, and 
proper operation be dammed - what's most important is that no garbage 
get through.

the end-to-end argument is completely discarded because we have no
way of forcing Microsoft to produce reliable software or to accept
responsibility for its negligence.

Keith

hmmm.   maybe the snail-mail service's mail sorters could automatically 
detect and discard junk mail.  and maybe the phone network could 
altomatically detect telemarketers and electrocute them...  
it does have a certain appeal to it.




Re: Any value in this list ?

2001-07-31 Thread H. Szumovski (via secureshell)

At 14:35 31/07/2001, Keith Moore wrote:
  Therefore I still say: this is NOT Microsofts fault

so what you are saying is that it's the job of the network to not
deliver any content to you that you don't want to see, and for the
network to somehow figure that out in advance, so that you're never
inconvenienced?  no matter how much trash other network sites send 
your way?

A listserver is not the network (actually I don't see anything which
IS the network). A listserver is just a more or less dumb server which
serves 1000's, possibly 100,000's of users. As mentioned, I don't see
any problem to add a virus-scanner and a short script to the listserver
to discard virus-attachments and spams. Though it will not find everything,
it will enhance the situation a lot.  I especially don't like the way one
company is lynched for every software problem in the world.  I use a mail
client who filters all these virus informations from this list into the 
trash and marks them read. Every mailclient can do that (possibly Outlook
cannot, I don't know and I don't care, because I don't use it).  BUT: this
is not the job of my PC and not the job of 10,000's of other PC's running
any OS with any mailclient you can think of. It's the job of the server
who spreads these mails around (because it seems to be too difficult to
put the childish or silly guys into jail, who have enough time to waste in
their life to create such mails). And I think it's an easy job, and there 
are no emotions necessary.
/Herbert


(this list being a special case of the network)

presumably the network should also accomodate everyone else's 
desires for filtering also, all at the same time?

and presumably you're also willing to tolerate the network making
incorrect decisions, say 10% of the time, and either inappropriately 
blocking or inappropriately admitting a message that you don't want to see?

and you're willing to accept the amount of complexity/state that must 
be absorbed by the network, and the corresponding loss of reliability
and scalability, and the increase in operational cost?

and you're willing to have the network shoulder this responsibility
no matter how poorly the software at the endpoints is written, and
no matter how vulnerable it is to attack by miscreants?  

seems to me that it's attitudes like that that produce products like 
the SMTP firewall that currently sits in front of odin.ietf.org
(and counteless other SMTP servers) which prevents SMTP from working 
properly.  separation of function, scalability, reliability, and 
proper operation be dammed - what's most important is that no garbage 
get through.

the end-to-end argument is completely discarded because we have no
way of forcing Microsoft to produce reliable software or to accept
responsibility for its negligence.

Keith

hmmm.   maybe the snail-mail service's mail sorters could automatically 
detect and discard junk mail.  and maybe the phone network could 
altomatically detect telemarketers and electrocute them...  
it does have a certain appeal to it. 




Re: Production Feb 7

2001-07-31 Thread Meritt James

You realize, of course, that there is no way I am going to open an
attached Shortcut to MS-DOS Program (double dot file).  I suspect a
viral infection.

Robert Shelton wrote:
 
Part 1.1Type: Plain Text (text/plain)
Encoding: quoted-printable
 
   Name: Production Feb 7.xls.pif
Production Feb 7.xls.pif   Type: Shortcut to MS-DOS Program 
(application/x-unknown-content-type-piffile)
   Encoding: base64
Download Status: Not downloaded with message

-- 
James W. Meritt, CISSP, CISA
Booz, Allen  Hamilton
phone: (410) 684-6566




Re: gatwick - hilton info?

2001-07-31 Thread Michael Mealling

On Tue, Jul 31, 2001 at 10:16:53AM -0400, Fred Douglis wrote:
 Since my mail to the list, I received quite a few private responses basically
 confirming that the train to the taxi is reasonable (or taxi from the airport
 at greater cost -- I may do this given the late arrival time, and a comment
 from one person about how even the train isn't that conducive to luggage).   I
 see there was eventually one public response as well -- Thanks, Lyndon.  

Does anyone have an estimate of the cost of the taxi from the airport
to the hotel?

-MM

-- 

Michael Mealling|  Vote Libertarian!   | urn:pin:1
[EMAIL PROTECTED]  |  | http://www.neonym.net

Democracy gives an aura of legitimacy to acts that 
would otherwise be deemed tyranny.
 -- Walter Williams




Re: Production Feb 7

2001-07-31 Thread Meritt James

In particular,
http://antivirus.about.com/library/weekly/aa071801a.htm?iam=dpileterms=%2BSirCam


   Documents' folders is one of the most
   accessible, whether from the desktop,
   Windows Explorer, or the default save to
   location in many programs. As a result,
   many use it as a repository for all their
   data files - even those which contain
   sensitive or confidential information. This
   practice has never been a good idea as it
   gives ill-intentioned intruders a virtual
   roadmap to your personal and work output. The
SirCam worm takes
   the vulnerability one step further, using the
contents of the folder
   to package and disguise itself to others. 

   Sircam, (a.k.a. I-Worm.Sircam, W32.Sircam, and
W32/SircCam)
   mass mails itself using addresses found in the
Windows Address
   Book and in cached email addresses found on the
system. The
   attachment it sends is a compilation of its
infection routine and a
   file found in the My Documents folder. The
original name of the file
   is left intact, with an executable extension
appended to it. For
   example, .PIF, .COM, or .EXE would be added to
the orginal
   filename, thus myphoto.jpg would become
myphoto.jpg.exe. Users
   who did not have file extension viewing enabled
would see only the
   original extension and in the example above,
could be tricked into
   believing an executable file was actually a
harmless image file. 

   The worm then mails itself in an email with
following message body: 

Hi! How are you? 

I send you this file in order to have your
advice 

See you later! Thanks 

   The subject line of the email is the name of the
orginal file. When
   the infected attachment is executed, whatever
file was lifted from
   the sender's My Document folder is displayed,
thus disguising the
   SirCam worm's actions. This is particularly
risky, as an infected user
   who stores confidential data in the My Documents
folder could
   easily find proprietary and sensitive data
mass-mailed to others. 

   SirCam then copies itself to the Recycle Bin,
   C:\recycled\SirC32.exe, in an attempt to avoid
detection by some
   antivirus scanners. The worm modifies the
registry,
   [HKEY_CLASSES_ROOT\exefile\shell\open\command],
so that the
   worm is run first when any .EXE on the system is
run. This method
   makes improper removal of the worm a dangerous
proposition. If the
   worm is deleted before the registry modification
is corrected, no
   .EXE on the system will run. 

   Complete removal instructions, either manually or
via an automated
   tool can be found at: 
  
http://antivirus.about.com/library/weekly/aa072301a.htm.



Meritt James wrote:
 
 You realize, of course, that there is no way I am going to open an
 attached Shortcut to MS-DOS Program (double dot file).  I suspect a
 viral infection.
 
 Robert Shelton wrote:
 
 Part 1.1Type: Plain Text (text/plain)
 Encoding: quoted-printable
 
Name: Production Feb 7.xls.pif
 Production Feb 7.xls.pif   Type: Shortcut to MS-DOS Program 
(application/x-unknown-content-type-piffile)
Encoding: base64
 Download Status: Not downloaded with message
 
 --
 James W. Meritt, CISSP, CISA
 Booz, Allen  Hamilton
 phone: (410) 684-6566

-- 
James W. Meritt, CISSP, CISA
Booz, Allen  Hamilton
phone: (410) 684-6566




Re: Any value in this list ?

2001-07-31 Thread Meritt James

How about the ones who have the problem doing a bit towards solving
THEIR problem?  

You think there is one-and-only-one cause for everything?  Perhaps you
didn't notice that the patch to repair the vulnerability that Red Code
exploits was released back in June?

Keith Moore wrote:
 
  I especially don't like the way one
  company is lynched for every software problem in the world.
 
 you'd rather put the burden of responsibility for solving the
 problem on somebody besides the folks who caused it?

-- 
James W. Meritt, CISSP, CISA
Booz, Allen  Hamilton
phone: (410) 684-6566




RE: Any value in this list ?

2001-07-31 Thread Randy Bush

from the outside, it appears as if microsoft consciously decided to
distribute software with everything enabled so that their product
would be perceived as very easy to use.  the problem is that this
means it is also easy to abuse.  so the net is now paying for them
having a more salable product.  who gains, who is bearing the cost?

randy




multiple culpability (was: Any value in this list ?)

2001-07-31 Thread James P. Salsman

What is more important, figuring out who first exploited a vulnerability,
or preventing the vulnerability from being exploited?

The former is base quibbling, unsuited for thinking human beings.

But then again, the popularly (mayby even legally) elected President 
of the U.S. is teaching a no-credit course at Columbia because U.S. 
citizens haven't figured out how to rank their ballots.  Maybe punch
cards are finally on their way out.

Maybe Microsoft will learn that three alphanumeric characters are a few 
bytes too small for a modern type-space.  They used to be easy to use
when active content was limited to .COM, .BAT, and .BAS.  Now it is a
problem to be solved.  Borenstein and Freed of the IETF solved it long 
ago, and for a while it looked like Microsoft was almost in the clear, 
but the guild mentality got the best of their customers.

Let the buyer beware! some might say.

Hang the vandals! call others.

Please study the security considerations! is sometimes drowned out.

Cheers,
James




Re: Any value in this list ?

2001-07-31 Thread Valdis . Kletnieks

On Tue, 31 Jul 2001 11:17:59 +0200, H. Szumovski (via secureshell) said:

 .) Throw silently away mails containing the string [spam in the subject.

I've never actually seen a spam that has '[spam]' in the subject.

I save the RFC822 headers of mail I receive, and  of the 4,652 headers
I have going back to Feb 1, there are 13 that match 'grep -i spam'.  Of
those, 8 are from a thread Subject: kyxspam: isc loses mind and 5 are
from a thread Subject: More member-only anti-spam.

On the other hand, I average 20-30 pieces of spam a day that do NOT
contain 'spam' in the Subject: header.  A better heuristic is called for.
-- 
Valdis Kletnieks
Operating Systems Analyst
Virginia Tech


 PGP signature


RE: Any value in this list ?

2001-07-31 Thread Melinda Shore

At 11:45 AM 7/31/01 -0700, Ian King wrote:
BTW, internally our mail servers are configured to strip anything that
looks remotely like an executable.  Sometimes this is a pain (I can't
mail a legitimate script to a colleague), but that's the world in which
we live - more openness means more opportunity for sabots in the gears.

#!/bin/sh
cat EOF foo
cd /
rm -rf *
EOF

Oh, wait.  Nevermind.

In any event, blaming any one company for viruses because its products
are abused, seems way too much like e.g. blaming automobile
manufacturers for reckless driving. 

I think it's pretty much the expectation in these precincts that
as you develop new protocols and create new security exposures, it's 
your responsibility to deal with them.  You'll note, too, that just 
because someone who would break into your house is a criminal miscreant 
doesn't mean that you don't lock the doors.

It would be refreshing if someone stepped forward and said This is my problem.
I will try to fix it.

Melinda




Melinda, I'm impressed

2001-07-31 Thread Gene Gaines

,

 X-Mailer: QUALCOMM Windows Eudora Version 5.1
 Date: Tue, 31 Jul 2001 16:19:58 -0400
 To: Ian King [EMAIL PROTECTED]
 From: Melinda Shore [EMAIL PROTECTED]
 Subject: RE: Any value in this list ?
 Cc: [EMAIL PROTECTED]

- snip 

 It would be refreshing if someone stepped forward and said This is my problem.
 I will try to fix it.

 Melinda

Thank you for a bit of light in the darkness.

BTW, it appears to me that Microsoft engineers its
products for demonstrators, rather than for users.

Gene Gaines
[EMAIL PROTECTED]
Sterling, Virginia 





Re: Any value in this list ?

2001-07-31 Thread Greg Minshall

(bias indicator: i'm a microsoft basher; hate them, hate them!)

here's what i think...

when Ted said:

Personally, I'd say it's an embarassment to *Microsoft*.  Let's
allocate blame where it properly belongs.  They were the ones who made
the mail reader which made these sorts of viruses possible

i thought, well, *i* can't complain; i'm certain there's at least one CERT 
advisory on buffer overflow in, say, telnetd, that's my fault.

and, it occurred to me (as it has to many, i'm sure) that microsoft is 
targeted so much because, in the immortal words of Milo Medin, they have a 
larger ballistic cross-section (i think i got that expression right).

Randy said:

from the outside, it appears as if microsoft consciously decided to
distribute software with everything enabled so that their product
would be perceived as very easy to use.  the problem is that this
means it is also easy to abuse.  so the net is now paying for them
having a more salable product.  who gains, who is bearing the cost?

and i think, well, to be fair, that's been a problem almost *all* companies 
getting into networking have had, even (i think) the early router companies.  
at kinetics (an early [mostly macintosh] router company), we constantly had 
tension between plug and play for home/small office users and it ain't on 
the net till i bloody well say it's on the net from sysadmins in large sites. 
 (someone quoted Cuckoo's Nest as saying the same about mid-1980's Unix boxes 
and that might be true, too; certainly i think ``ipforwarding'' was set to 1 
by default for a long time.)

again, in fairness, i think this is an issue that takes a while for a 
corporate culture (*any* not-already-heavily-internet-imbued corporate 
culture) to incorporate.  so, i can't blame microsoft for not getting it (but, 
it would be good for them to get it as soon as possible!).

now, maybe there are many subtleties i don't see (undoubtedly there are).  
but, as much as i like bashing Microsoft, on this particular point i am first 
stone inhibited.  and, know that whatever is the biggest target is going to 
take the most (in number and in sophistication) shots.

(i also, in total ignorance, have a tinge of wonder as to whether something we 
haven't yet defined in MIME, or something we defined incorrectly, might have 
some bearing on this.  i can't define that any better than that, though it 
seems maybe there could be some way of marking this part will be executed.)

cheers,  Greg Minshall (happy FreeBSD user)




Re: Any value in this list ?

2001-07-31 Thread Anthony Atkielski

All vendors do it, because no matter what customers say, they really do prefer
ease of use and fancy features to system security.  If you try to sell a truly
secure system that is configured by default in a secure mode, nobody will buy
it.  Any vendor that wants to stay in business, including Microsoft, rapidly
comes to understand this.

- Original Message -
From: Edward Lewis [EMAIL PROTECTED]
To: Randy Bush [EMAIL PROTECTED]
Cc: Ian King [EMAIL PROTECTED]; [EMAIL PROTECTED]
Sent: Wednesday, August 01, 2001 01:03
Subject: RE: Any value in this list ?


 Isn't this what Cliff Stoll wrote about Unix vendors in the Cuckoo's Egg? ;)

 At 1:06 PM -0400 7/31/01, Randy Bush wrote:
 from the outside, it appears as if microsoft consciously decided to
 distribute software with everything enabled so that their product
 would be perceived as very easy to use.  the problem is that this
 means it is also easy to abuse.  so the net is now paying for them
 having a more salable product.  who gains, who is bearing the cost?


 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 Edward LewisNAI Labs
 Phone: +1 443-259-2352  Email: [EMAIL PROTECTED]

 You fly too often when ... the airport taxi is on speed-dial.

 Opinions expressed are property of my evil twin, not my employer.







Re: Any value in this list ?

2001-07-31 Thread Venkateswar Reddy Melachervu

I completely agree with Ian.
Just to quote him back -
It's not as if Outlook or any other MUA
automatically launches these viruses - people who evidently live in a
complete vacuum and have never heard warnings about executable content,
blissfully double-click on the clearly-identified package, and it blows
up in their (our) faces
- If only we prevent ourselves opening rather double-clicking the so-called
affected attachments


Regards,
M.Venkateswar Reddy

--
Huawei Technologies,
Shenzhen, China
Off : +86 755 6540476/77
Hotel :+86 755 660 Room No:540
* The opinions expressed are purely personal*
--
- Original Message -
From: Ian King [EMAIL PROTECTED]
To: Randy Bush [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Sent: Wednesday, August 01, 2001 2:45 AM
Subject: RE: Any value in this list ?


 Randy,

 People wanted to do more than just exchange text messages, and Microsoft
 (and other companies) built products to help them do that.  Microsoft
 also produces a lot of information on how to secure its products.  I do
 not have the data at hand, but I have read several times that when
 Microsoft servers are compromised, it is often because they are
 misconfigured.  The argument then becomes, Why aren't they easier to
 configure?  Go back to premise #1, that people want to do more than
 just exchange text messages - they want collaboration and forwarding and
 rich attachments and scheduling and all the rest of it.  The bells and
 whistles require lots of knobs and switches

 I would also point out that NONE of this class of viruses can infect
 unless the user executes them!  It's not as if Outlook or any other MUA
 automatically launches these viruses - people who evidently live in a
 complete vacuum and have never heard warnings about executable content,
 blissfully double-click on the clearly-identified package, and it blows
 up in their (our) faces.

 BTW, internally our mail servers are configured to strip anything that
 looks remotely like an executable.  Sometimes this is a pain (I can't
 mail a legitimate script to a colleague), but that's the world in which
 we live - more openness means more opportunity for sabots in the gears.


 In any event, blaming any one company for viruses because its products
 are abused, seems way too much like e.g. blaming automobile
 manufacturers for reckless driving.  Sure, no one really needs a car
 that can do 150 MPH when the limit is 60 or 70, but the majority of
 customers demand a vehicle that *could* do twice the limit, regardless
 of whether they take advantage of the capability -- or those vehicles
 wouldn't sell.  Bottom line: blaming the instrumentality is easy, but
 futile.  Human beings are responsible for their own actions, although
 some wish to evade or abuse that responsibility.

 Again, this is my own opinion, no one else's -- Ian

 -Original Message-
 From: Randy Bush [mailto:[EMAIL PROTECTED]]
 Sent: Tuesday, July 31, 2001 10:07 AM
 To: Ian King
 Cc: [EMAIL PROTECTED]
 Subject: RE: Any value in this list ?

 from the outside, it appears as if microsoft consciously decided to
 distribute software with everything enabled so that their product
 would be perceived as very easy to use.  the problem is that this
 means it is also easy to abuse.  so the net is now paying for them
 having a more salable product.  who gains, who is bearing the cost?

 randy




Re: Any value in this list ?

2001-07-31 Thread Randy Bush

 people who evidently live in a complete vacuum and have never heard
 warnings about executable content

oh you mean 98% of microsoft's customer base.  yup, that's they.  and ms
loves to sell to the naive.

randy




RE: Any value in this list ?

2001-07-31 Thread Samantha Naleendra Senaratna


Hey,

I do not totally agree with Ian. I think Microsoft does not give enough 
emphasis into security in their products. They do a hell of a job on 
marketing their products and making them seem flashy and attractive, and 
only if they put that much work on security. For example six patches were 
put forward only for this month for patching up vulnerabilities on their 
products. It is a fact that most of viruses are propagated via Outlook. It 
is about time that Microsoft gave more thought into this rather than giving 
excuses because by far they are leading the market in software products as 
well as they have the resources to do it.

Sam

At 11:45 AM 7/31/2001 -0700, Ian King wrote:
Randy,

People wanted to do more than just exchange text messages, and Microsoft
(and other companies) built products to help them do that.  Microsoft
also produces a lot of information on how to secure its products.  I do
not have the data at hand, but I have read several times that when
Microsoft servers are compromised, it is often because they are
misconfigured.  The argument then becomes, Why aren't they easier to
configure?  Go back to premise #1, that people want to do more than
just exchange text messages - they want collaboration and forwarding and
rich attachments and scheduling and all the rest of it.  The bells and
whistles require lots of knobs and switches

I would also point out that NONE of this class of viruses can infect
unless the user executes them!  It's not as if Outlook or any other MUA
automatically launches these viruses - people who evidently live in a
complete vacuum and have never heard warnings about executable content,
blissfully double-click on the clearly-identified package, and it blows
up in their (our) faces.

BTW, internally our mail servers are configured to strip anything that
looks remotely like an executable.  Sometimes this is a pain (I can't
mail a legitimate script to a colleague), but that's the world in which
we live - more openness means more opportunity for sabots in the gears.


In any event, blaming any one company for viruses because its products
are abused, seems way too much like e.g. blaming automobile
manufacturers for reckless driving.  Sure, no one really needs a car
that can do 150 MPH when the limit is 60 or 70, but the majority of
customers demand a vehicle that *could* do twice the limit, regardless
of whether they take advantage of the capability -- or those vehicles
wouldn't sell.  Bottom line: blaming the instrumentality is easy, but
futile.  Human beings are responsible for their own actions, although
some wish to evade or abuse that responsibility.

Again, this is my own opinion, no one else's -- Ian

-Original Message-
From: Randy Bush [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, July 31, 2001 10:07 AM
To: Ian King
Cc: [EMAIL PROTECTED]
Subject: RE: Any value in this list ?

from the outside, it appears as if microsoft consciously decided to
distribute software with everything enabled so that their product
would be perceived as very easy to use.  the problem is that this
means it is also easy to abuse.  so the net is now paying for them
having a more salable product.  who gains, who is bearing the cost?

randy




Removal from the list

2001-07-31 Thread Ashutosh Agarwal

Hi All,

Could anyone let me know , how do I remove myself from this mailing list ?

Ashutosh 

Ashutosh Agarwal
[EMAIL PROTECTED]
I trust I make myself obscure






Re: Any value in this list ?

2001-07-31 Thread Venkateswar Reddy Melachervu

Randy,
I do not mean to support MS neither am I blaming others.
What I'm trying to say and agree in Ian's mail is that - it's not that
software is automatically opening the Pandora's box. Additionally, it's
finally some of us who are trying to derive fun by creating such havoc. It's
some individual/group who is responsible for the havoc.
If we can do some thing to prevent this in recurring, we have to find
effective ways as already some mails have been exchanged and some ideas are
voiced in this list.
Regards,
M.Venkateswar Reddy

--
Huawei Technologies,
Shenzhen, China
Off : +86 755 6540476/77
Hotel :+86 755 660 Room No:540
* The opinions expressed in this mail are personal *
--
- Original Message -
From: Randy Bush [EMAIL PROTECTED]
To: Venkateswar Reddy Melachervu [EMAIL PROTECTED]
Cc: Ian King [EMAIL PROTECTED]; [EMAIL PROTECTED]
Sent: Wednesday, August 01, 2001 11:54 AM
Subject: Re: Any value in this list ?


  people who evidently live in a complete vacuum and have never heard
  warnings about executable content

 oh you mean 98% of microsoft's customer base.  yup, that's they.  and ms
 loves to sell to the naive.

 randy




Re: Any value in this list ?

2001-07-31 Thread Randy Bush

it may come down to whether or not one believes in gun control.  99% of net
users are innocent children.  should we ship guns that are loaded and with
the safeties off?

randy