Skip to Content.
Sympa Menu

internetworkers - Re: Virus

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Michael S Czeiszperger <czei AT webperformanceinc.com>
  • To: "InterNetWorkers" <internetworkers AT franklin.oit.unc.edu>
  • Subject: Re: Virus
  • Date: Thu, 20 Sep 2001 10:29:06 -0400


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wednesday 19 September 2001 08:10 pm, you wrote:
> I have two points. First, without implying that Microsoft products are
> "better" in any sense, one has to admit that due to their prevalence, they
> are targeted with much higher frequency. As a result, you can't just assume
> that MS products are inherently less secure just because they suffer more
> attacks. I grew up with Unix and have there's no shortage of security issues
> in that world either.

You're right, there's security problems with all software. The difference is
that most UNIX systems have traditionally been servers sold to professionals,
where there is a reasonable assumption that they will manage security, while
MS products such as Outlook are shipped by default on most computers sold to
consumers, where it is reasonable to assume that the user does not have the
ability to manage security. Because of their target audience, therefore, MS
has an increased responsibility to ship software that is secure by default.

> Personally, I think this is like suing your home
> builder because a thief exploited the weakness of the glass in your
> windows. (Sorry about the pun). I mean, you might have a case, but you
> better be prepared to be held to the same standards. Security is a tough
> issue.

I'm not sure I understand the analogy. Who's the builder, and who made the
glass in this case? As far as I know, people are complaining about security
holes in Microsoft products, and are holding the same responsible. This is
not to say that other software doesn't have security problems. Its just in
this case MS has made a point of loudly pointing out security problems in
competitor's products, while at the same time shipping products like Outlook
with no security protection at all as the default, which has been the cause
of a large number of attacks.

> OK, I have a third point. I noticed several posts about people redirecting
> dubious requests on to Microsoft. That's bad for two reasons, if it has the
> intended effect. One, it clogs the 'Net for everyone, not just Microsoft.
> Two, such activity hardly reflects positively on the moral disposition of
> people who do it. It's like complaining that you don't like being shot
> while deflecting the bullets to some other guy because you don't like him.
> How is that better?
>

I'm not sure of this analogy. In this case I think they're reflecting the
bullets back at the perpetrator. MS wrote IE to generate extra HTTP requests
back to IIS, not taking into account that IE users just might browse sites
using competing web server software. The IE design both clogs up the net at
large, and loads down non-MS servers with extra HTTP requests, and forces
every webmaster using non-Microsoft software to either conform to their
standard, or put up with log errors. In this situation, redirecting MS's own
requests back to their web site, causing MS to spend some of their own
bandwidth on the problem, seems like a fair protest.

Personally I think the problem is annoying, but small, as the errors are but
a very small percentage of the errors in my logs.

- --
Michael S Czeiszperger
czei AT webperformanceinc.com

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8

iQA/AwUBO6n9MlgOl/a4Fw2AEQLOOACgqyoTUQMX51VjNw2uufEKs/TiLUAAoKXe
s4zUu8MvzLBjCXEmygLneNuM
=mBw8
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page