Subject: Re: Any value in this list ?

From: "Venkateswar Reddy Melachervu" <[email-masked]>
Date: Tue, 31 Jul 2001 11:45:19 +0800

I completely agree with Ian.
Just to quote him back -
It's not as if Outlook or any other MUA
automatically launches these viruses - people who evidently live in a
complete vacuum and have never heard warnings about executable content,
blissfully double-click on the clearly-identified package, and it blows
up in their (our) faces
- If only we prevent ourselves opening rather double-clicking the so-called
affected attachments....

Regards,
M.Venkateswar Reddy

--------------------------------------------------------------
Huawei Technologies,
Shenzhen, China
Off : +86 755 6540476/77
Hotel :+86 755 6602222 Room No:540
* The opinions expressed are purely personal*
--------------------------------------------------------------
----- Original Message -----
From: Ian King <[email-masked]>
To: Randy Bush <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, August 01, 2001 2:45 AM
Subject: RE: Any value in this list ?

> Randy,
>
> People wanted to do more than just exchange text messages, and Microsoft
> (and other companies) built products to help them do that.  Microsoft
> also produces a lot of information on how to secure its products.  I do
> not have the data at hand, but I have read several times that when
> Microsoft servers are compromised, it is often because they are
> misconfigured.  The argument then becomes, "Why aren't they easier to
> configure?"  Go back to premise #1, that people want to do more than
> just exchange text messages - they want collaboration and forwarding and
> rich attachments and scheduling and all the rest of it.  The bells and
> whistles require lots of knobs and switches....
>
> I would also point out that NONE of this class of viruses can infect
> unless the user executes them!  It's not as if Outlook or any other MUA
> automatically launches these viruses - people who evidently live in a
> complete vacuum and have never heard warnings about executable content,
> blissfully double-click on the clearly-identified package, and it blows
> up in their (our) faces.
>
> BTW, internally our mail servers are configured to strip anything that
> looks remotely like an executable.  Sometimes this is a pain (I can't
> mail a legitimate script to a colleague), but that's the world in which
> we live - more openness means more opportunity for sabots in the gears.
>
>
> In any event, blaming any one company for viruses because its products
> are abused, seems way too much like e.g. blaming automobile
> manufacturers for reckless driving.  Sure, no one really needs a car
> that can do 150 MPH when the limit is 60 or 70, but the majority of
> customers demand a vehicle that *could* do twice the limit, regardless
> of whether they take advantage of the capability -- or those vehicles
> wouldn't sell.  Bottom line: blaming the instrumentality is easy, but
> futile.  Human beings are responsible for their own actions, although
> some wish to evade or abuse that responsibility.
>
> Again, this is my own opinion, no one else's -- Ian
>
> -----Original Message-----
> From: Randy Bush [mailto:[email-masked]]
> Sent: Tuesday, July 31, 2001 10:07 AM
> To: Ian King
> Cc: [email-masked]
> Subject: RE: Any value in this list ?
>
> from the outside, it appears as if microsoft consciously decided to
> distribute software with everything enabled so that their product
> would be perceived as very easy to use.  the problem is that this
> means it is also easy to abuse.  so the net is now paying for them
> having a more salable product.  who gains, who is bearing the cost?
>
> randy

---

From: Randy Bush <[email-masked]>
Date: Tue, 31 Jul 2001 20:54:22 -0700

> people who evidently live in a complete vacuum and have never heard
> warnings about executable content

oh you mean 98% of microsoft's customer base.  yup, that's they.  and ms
loves to sell to the naive.

randy

---

From: "Venkateswar Reddy Melachervu" <[email-masked]>
Date: Wed, 1 Aug 2001 13:07:15 +0800

Randy,
I do not mean to support MS neither am I blaming others.
What I'm trying to say and agree in Ian's mail is that - it's not that
software is automatically opening the Pandora's box. Additionally, it's
finally some of us who are trying to derive fun by creating such havoc. It's
some individual/group who is responsible for the havoc.
If we can do some thing to prevent this in recurring, we have to find
effective ways as already some mails have been exchanged and some ideas are
voiced in this list.
Regards,
M.Venkateswar Reddy

--------------------------------------------------------------
Huawei Technologies,
Shenzhen, China
Off : +86 755 6540476/77
Hotel :+86 755 6602222 Room No:540
* The opinions expressed in this mail are personal *
--------------------------------------------------------------

---

From: Randy Bush <[email-masked]>
Date: Tue, 31 Jul 2001 22:14:23 -0700

it may come down to whether or not one believes in gun control.  99% of net
users are innocent children.  should we ship guns that are loaded and with
the safeties off?

randy

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 1 Aug 2001 12:09:57 +0200

Randy writes:

> oh you mean 98% of microsoft's customer base.
> yup, that's they.  and ms loves to sell to the naive.

All vendors try to sell to as many customers as possible.  And today, 98% of all
customers are technically unsophisticated.  So any vendor that wants to seel to
the average person has to be willing to "sell to the naive."  I don't really
understand why you talk about Microsoft as though it were a special case.

---

From: Keith Moore <[email-masked]>
Date: Wed, 01 Aug 2001 17:25:55 -0400

> misconfigured.  

perhaps because they are shipped that way?
(I don't know about the servers, but it's true of mail clients)

> unless the user executes them!  

Right.  But do you really expect a user to understand that when he
clicks on something that is apparently (to him) an image, or even
a word procesor document, that it's going to *execute* something
that can potentially infect his system?

MIME implementors are supposed to safeguard their users against
such hazards, at least by default.  Microsoft deliberately ignored
this advice and chose to make their users vulnerable - not just by
making the content "executable" with a single click, but also by
bypassing the safeguards in the content-type registration system.

> we live - more openness means more opportunity for sabots in the gears.

Maybe you should put the fix where it belongs - in your mail clients -
rather than trying to put a stopgap fix into your network where it
severely limits your flexibility.

Or are you saying that Microsoft employees are no smarter than the
average user (whom you expect should know better than to "execute"
a virus)?

> manufacturers for reckless driving.  

no, it's more like blaming automobile manufacturers for producing
cars whose brakes fail when used normally.

>  Human beings are responsible for their own actions, although

Presumably, that includes the actions of those at Microsoft who chose 
to make their customers unnecessarily vulnerable.

Keith

---

From: Lloyd Wood <[email-masked]>
Date: Wed, 1 Aug 2001 23:11:40 +0100 (BST)

On Tue, 31 Jul 2001, Ian King wrote:

> wouldn't sell.  

I like that car analogy. In fact, I think it can be extended further.

Microsoft: unsafe at any speed. That would make Outlook the exploding
Pinto of software; blame the driver for putting the car in a situation
where it could explode.

> Bottom line: blaming the instrumentality is easy, but

Children are human beings. Children are generally not considerd
responsible for their own actions.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: Bill Selmeier <[email-masked]>
Date: Wed, 1 Aug 2001 18:18:56 -0700 (PDT)

Yes but to follow that analogy and again show things are usually near
black or white, in the US the Government on behalf of consumers forced car
manufacturers to install seat belts starting back in the '60's.  It then
took a decade or more to convince consumers to wear them.  But they
evolved and no doubt many people are alive today that wouldn't be
otherwise.  Each side has to move away from the extreme position that it
is all the other viewpoints fault!

*********************************************************************
Bill Selmeier		20720 Maureen Way	voice  (408)257-7670
President		Saratoga, CA 95070	mobile (408)655-3400
RightNet, Inc.	     http://www.right-net.com	[email-masked]
	   Equipping you to do business on the Internet!

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 2 Aug 2001 07:29:03 +0200

> perhaps because they are shipped that way?

Microsoft ships servers with most security features set to low security, because
customers whine and complain otherwise.  Customers buy on the basis of features
and ease-of-use, not security, no matter what they might claim to the contrary.
Put a product on the shelf that is configured secure by default, and it will
still be on the shelf ten years later.

> But do you really expect a user to understand
> that when he clicks on something that is apparently
> (to him) an image, or even a word procesor
> document, that it's going to *execute* something

Yes.  It only takes a few seconds to learn.

And consider this:  If a user cannot understand that he should not click on an
attachment, how do you expect him to ever understand how to deal with a truly
_secure_ system?  One reason customers do not buy secure software is that their
end users refuse to deal with it.  People hate to type passwords and hate having
any restrictions at all on what they can or cannot do with a machine.

> Microsoft deliberately ignored this advice and
> chose to make their users vulnerable - not just by
> making the content "executable" with a single
> click, but also by bypassing the safeguards in
> the content-type registration system.

Microsoft's objective is to stay in business, and to do that, it has to give
customers what they want.  Companies that adhere to some noble ideal even when
this prevents them from actually selling anything aren't around for long.

If you want these standards adhered to, then I suggest you educate and persuade
users so that they demand them from vendors.  Right now, it's just the opposite,
and so that's what vendors provide.

> Or are you saying that Microsoft employees are
> no smarter than the average user (whom you expect
> should know better than to "execute" a virus)?

Microsoft employees who are not IT specialists are no smarter than the average
user when it comes to opening attachments.  There are lots of non-IT people
working at Microsoft nowadays, since it is a large company.  Indeed, as it grows
larger and deadwood in management accumulates, even people who should probably
no better (based on their positions within the company) start to make these
stupid mistakes.  This has become apparent many times, and I'm sure that other
software vendors have exactly the same problems internally.

> no, it's more like blaming automobile manufacturers
> for producing cars whose brakes fail when used normally.

No, it's more like blaming automobile manufacturers for brakes that don't apply
themselves when the driver is too stupid to apply them himself.

> Presumably, that includes the actions of those
> at Microsoft who chose to make their customers
> unnecessarily vulnerable.

It's not unnecessary.  If that isn't done, nobody will buy the products.

It's convenient to blame Microsoft, but it's simplistic.  All successful vendors
get that way by providing what customers want; if you don't like what they are
producing, then I suggest you look at their customer base, not at their
engineering teams.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 2 Aug 2001 07:32:51 +0200

Lloyd writes:

> Children are human beings. Children are generally
> not considerd responsible for their own actions.

That explains why debunking of Microsoft bashing seems to have so little effect
on the bashers.

---

From: [email-masked]
Date: Thu, 02 Aug 2001 02:23:13 -0400

> themselves when the driver is too stupid to apply them himself.

It's more like blaming the users for failing to put chocks under
the tires because they fail to realize that just because the
stick is in the PARK position, the car may shift to DRIVE under
some circumstances not under direct obvious control of the
driver (say, if 3 red pickup trucks in a row drive by).

And *ANY* system that attempts to  interpret 'image/jpeg' as *ANYTHING* other
than image data is just WAITING to pop into DRIVE.

/Valdis

---

From: Ari Ollikainen <[email-masked]>
Date: Wed, 01 Aug 2001 23:46:40 -0700

At 6:18 PM -0700 8/1/01, Bill Selmeier wrote:
>black or white, in the US the Government on behalf of consumers 
>forced car manufacturers to install seat belts starting back in the 
>'60's.  It then took a decade or more to convince consumers to wear 
>them.  But they

	Really? Then why did the government mandate passive systems such
	as the "motorized" seatbelts of the early 90s prior to driver
	side and then passenger side air bags? Could it have been because
	voluntary use of seatbelts wasn't sufficiently high?

	And your point was what?

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 2 Aug 2001 11:43:47 +0200

Valdis writes:

> It's more like blaming the users for failing
> to put chocks under the tires because they fail
> to realize that just because the stick is in
> the PARK position, the car may shift to DRIVE
> under some circumstances not under direct
> obvious control of the driver (say, if 3 red
> pickup trucks in a row drive by).

Someone concerned with safety will _always_ block the tires with chocks.  You
see that done with aircraft all the time.  Of course, people who own and operate
aircraft are a lot more concerned with safety than people who own and operate
cars, but the point is that safety is not Someone Else's responsibility, but
yours.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 2 Aug 2001 11:46:06 +0200

Ari writes:

> Then why did the government mandate passive systems
> such as the "motorized" seatbelts of the early 90s
> prior to driver side and then passenger side air bags?

Because some people felt that the government should think on behalf of citizens,
instead of letting them think for themselves.  I tend to prefer individual
freedom of thought and action, myself.

> Could it have been because voluntary use of
> seatbelts wasn't sufficiently high?

Sufficiently high for whom?  And if it's not "sufficiently high," what makes it
"voluntary"?

---

From: Lloyd Wood <[email-masked]>
Date: Thu, 2 Aug 2001 11:58:56 +0100 (BST)

On Wed, 1 Aug 2001, Bill Selmeier wrote:

> black or white, 

surely 'never'?

> in the US the Government on behalf of consumers forced car
> otherwise. 

Eh?

Evolution would involve selective pressure - killing off the people
too stupid to wear seatbelts (and giving them posthumous Darwin awards
if they meet the qualifying conditions) to slowly evolve the human
race into a bunch of smug cautious seatbelt-wearing risk-averse
stayathomes who would go around pointing out the selective pressure of
not wearing seatbelts as an indication of their advanced state of
evolution before getting killed crossing the road.

And your point was what?

L.

has been failing to discover a method to selectively kill people
stupid enough to drive those ultra-safe idiot-proof SUVs.

---

From: Keith Moore <[email-masked]>
Date: Thu, 02 Aug 2001 11:15:06 -0400

> Microsoft ships servers with most security features set to low security,
> because customers whine and complain otherwise. 

for the case of clients, it's more subtle than that.

Microsoft chose the security settings in such a way that low security
was too low, and anything higher was too cumbersome to use, because
they didn't want people to turn off proprietary features like ActiveX
that they believed would give them a competitive advantage.  They 
provided the appearance of flexibility and fine-grained control, but 
not the reality.

Keith

---

From: "Meritt James" <[email-masked]>
Date: Thu, 02 Aug 2001 12:47:07 -0400

Opinion, based upon shipping status of  other systems:  They are shipped
from the manufacturer with maximum networking and access  enabled so
that the recipient can do whatever it was they bought the system to do. 
Also, some apparent holes were in place for final testing.

And then, after the  user buys the system they LEAVE it like that, in
spite of documentation  and a warning being shipped along with the
equipment.

BTW:  Everyone else getting a massive number of viri-infected email
through the ietf mailing list?  Not a good sign...

-- 
James W. Meritt, CISSP, CISA
Booz, Allen & Hamilton
phone: (410) 684-6566

---

From: "Henning G. Schulzrinne" <[email-masked]>
Date: Thu, 02 Aug 2001 13:47:32 -0400

> cars, but the point is that safety is not Someone Else's responsibility, but

The usual problem with this type of argument is that the consequences of
one's actions are not just borne by the lazy or careless person. In the
case of seat belts or motorcycle helmets, society bears the cost of
caring for invalids. In the case of ill-designed software, everybody
else pays for the traffic (and other effects). Thus, for a truly
free-market libertarian that doesn't just want to privatize the profits
and socialize the costs, there are only a few solutions that seem to
have worked elsewhere:

- make people pay for bandwidth by the bit; in no time flat, people will
either fix up their machines, buy secure operating systems or sue the
makers of insecure operating systems for negligence.

- introduce computer drivers licenses; most societies don't allow
equipment that can cause significant harm to others (personal or
economic) to be operated by laymen (let's ignore guns and the US for a
moment).

- require bonding: operating a computer requires a deposit; actions that
damage somebody else's property lead to forfeiture, just like bonds are
used to hold a home owner harmless if the roofer absconds with half the
roof incomplete (plus many other uses).

- require insurance: same thing, with the insurance premium scaled to
represent the danger caused by a particular device. Pick a secure OS,
pay less money.

All of these are ridiculous, but, unlike the current situation, they
actually attach a cost to irresponsible behavior and, through the court
system, would presumably pass on the incentives to those that can fix
the underlying problems.
-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 2 Aug 2001 21:48:17 +0200

Keith writes:

> Microsoft chose the security settings in
> such a way that low security was too low,
> and anything higher was too cumbersome to
> use, because they didn't want people to turn
> off proprietary features like ActiveX that
> they believed would give them a competitive
> advantage.

No.  Security is set as low as it is because users can't stand anything higher.
Why do you think people put their passwords on Post-It notes next to their
monitors?

You conjecture sounds a bit paranoid to me.  People who work at Microsoft are
just like everyone else; they do not meet in caves around an altar at the stroke
of midnight to plot world domination, no matter what rumors you've heard around
campus.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 2 Aug 2001 21:51:26 +0200

> BTW:  Everyone else getting a massive number
> of viri-infected email through the ietf mailing
> list?

Yes, hundreds over the past week or so.  I have a rule for incoming mail that
just directs them to the trash.  But it does make one wonder about the
participants on the list--I don't have this problem on other lists.

> Not a good sign...

Agreed.  So much for "experts."

---

From: [email-masked]
Date: Thu, 02 Aug 2001 17:19:35 -0400

> of midnight to plot world domination, no matter what rumors you've heard around

OK.. So the Halloween memo was written at the local Denny's, not in a cave.

---

From: [email-masked]
Date: 03 Aug 2001 07:44:58 -0400

> Agreed.  So much for "experts."

The Code Red virus doesn't just use addresses from the infected users
address book - it also uses addresses culled from the web browser
cache.  Not too surprising that this list address would show up a lot.
Since this list does not require one to be subscribed to post, it gets
more than its share of junk.

Frankly, I find the endless (and very repetitive)
discussion/complaining about the viruses and warnings even worse than
the viruses and warnings - they easy to filter.  Isn't the general
idea that once a topic reaches a certain traffic level it should be
taken to another list, or a face to face session?

-- 
Scott Lawrence                            [email-masked]
Virata Embedded Web & UPnP Technology    http://www.emweb.com/

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sun, 5 Aug 2001 13:40:11 +0200

Scott writes:

> The Code Red virus doesn't just use addresses
> from the infected users address book ...

I was talking about fallout from the SirCam virus, which is still filling my
mailbox.  As far as I can tell, it's all coming from people subscribed to this
list, but I'm not really sure.

As for Code Red, I'm not worried about that, as I'm not running a Web server of
my own.

> Isn't the general idea that once a topic reaches
> a certain traffic level it should be taken to
> another list, or a face to face session?

I don't know, is it?  Does that apply to Microsoft-bashing, too, which seems to
follow just about any complaint about any problem on the Net?

---

From: [email-masked]
Date: Sun, 05 Aug 2001 16:34:40 -0400

> As for Code Red, I'm not worried about that, as I'm not running a Web server of

Hint to the rest of you:  We've found a number of users who were quite surprised
to find that they had been hit with CodeRed, because they didn't *know* that
their box had IIS installed.

If you're using a Microsoft system, this would be a good time to go and *CHECK*
that IIS isn't installed if you're not using the box for web serving.
-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech