Death To Virus Writers

davemie writes: "Looks like everyone is out to get the virus writers now!. But it sure is funny when a friend double-clicks on that latest virus and sends everyone in the company a copy. You get to slag him/her off for the rest of the week :-) 'Virus writers are the lowest form of life. AnchorDesk's David Coursey says we should put them out of their misery with a quick, permanent solution. Why waste time and money with due process?' I spent a total of an hour and forty minutes on hold making two different calls to the ISP which serves my mail. Both times the polite phone reps I eventually reached were shocked to find that there was an Outlook-borne nastiness filling up customers' mailboxes.

Comments

Re:Better solution

[Anonymous Coward]

Put virus writers and spammers into gladiator contests. Once they've whittled down to one surviving spammer or virus writer, shoot him.

If you want a real party, invite trolls too.

Re:What's ironic is that...

[Anonymous Coward]

I left a DNA sample in the last virus I wrote. Boy, do I feel dumb.

_the_ lowest form of life

[Anonymous Coward]

The author makes the argument that, on the grounds that they perpetrate an economic crime of huge proportions, it's OK to kill virus writers.

By the same argument, would it be OK to kill off the lawyers, too?

Re:_the_ lowest form of life

[Hanzie]

yes

Lowest form of life?

[Anonymous Coward]

What about MSCEs?

Re:Lowest form of life?

[Nykon]

BAHAHA yes Id have to agree on the evolutionary scale virus programmers are still much higher then MCSEs

Re:You'd think outlook would filter this by now.

[dshadow]

Actually, no, they're part of the metadata stored in the filesystem (along with creation/modification date, etc).

Re:You'd think outlook would filter this by now.

[shogun]

They are part of the resource fork.

That sounds like an intelligent way to do it. With this I imagine you can't confuse users by just putting a fake extension on the filename in the hopes that someone will click on it and run it.

Better solution

[ptomblin]

Put virus writers and spammers into gladiator contests. Once they've whittled down to one surviving spammer or virus writer, shoot him.

--

Re:Better solution

[ninewands]

Pardon my rude language, but BITE YOUR FUCKING TONGUE ... how do you know spammers don't read /.

All we NEED is to create a tech-savvy spammer ...

Do not meddle in the affairs of sysadmins,

Re:Better solution

[sstrick]

How do you know that I'm not a spammer?

Seriously though there is one major thing wrong with this plan. End of the day spammers normally have to give some kind of website or mailing address that is tied to them. This would give the feds an easy way to track them.

Also they are suddenly not just spammers but cyber terrorists, making it worth the while to track them down. I would like to see spammers try this as they would soon end up in court/jail.

Re:Better solution

[sstrick]

Why has no one done this before? Viral Spam. Send a piece of spam to one person and in hours it is all over the internet.

No need to gather mail addresses.
No need to pay for bandwidth.

Excuse me while I get scripting....

Re:You'd think outlook would filter this by now.

[tzanger]

Office XP goes even further than that. I was thrilled to find that the default installation completely blocks a lot of types of attachments, including exe's, vbscripts, etc. You can't even open them if you want to!

See that is exactly the wrong thing to do! I know what the hell I'm doing and I want the ability to save attachments if I want, regardless of extension!

Prevent me from running direct, I don't mind that. But preventing me from saving an attachment because of its extension? Come off it!

Re:You'd think outlook would filter this by now.

[tzanger]

If you need to send an exe then put it in a zip file, not really that difficult to get around...

wrong answer. There is no technical reason to require such action. Sure you could do that. You could also avoid the problem by not using outlook. It's not really that difficult to get around...

The solution lies in either not allowing execution (but saves), proper sandboxing, or doing something like the old Thunderbyte days: heuristics!

• MAPI functions...check
• Addressbook access...check
• Unusual Recycle Bin access...check

There's enough there to raise a flag that this attachment may be doing something funky. Maybe let the user know that the program is going to access the email subsystem and let them make the choice.

Re:Man...

[tzanger]

Viruses have just lost their mystique. I remember my Dad telling me about Michelangelo back in the 80's. I remember being so impressed that something so devilish and evil could really exist.

Actually Michelangelo wasn't all that ...evil... just thorough. It started wiping at 0,0,1 and kept going. If you caught it in time you could recover from it. I actually made a bit of money back then with a partition scanner program I wrote (I was 12-ish at the time and way into assembly and viruses).

Now a virus that intrigued me at the time... Whale.

Re:wrong problem

[SJS]

Ah. In other words, "suck it up".

One *could* hold the view that viruses (virii?) are a sort of public service. They can be considered an attempt to discourage live data (i.e. shipping around executables and expecting the receiver to run it), to promote good backups, to practice safe computing (do I *really* want to click on this link?), and so on and so forth.

Considering the MicroSoft has, apparently, successfully trained the average user to accept buggy software (that crashes the system, demonstrates many security and privacy holes, etc.), it is reasonable to desire some sort of countermeasure for breaking such habits.

Use them for food...... ?

[bobalu]

Whoops, guess I read that wrong, but hey it seems to work anyway...

Re:wrong problem

[Evangelion]

And it doesn't make sense to have complex vb macros in word processor documents.

Yup, and it would never make sense to write complicated elisp macros and store them in a document (you can do this, btw - the auto-execution is disabled, however).

Your opinion that scripting what is a glorified edtior is useless belies a complete lack of computing maturity.

--

Outlook is...

[dsfox]

a swimming pool without a fence around it, next
door to a public elementary school...

If you're so smart

[dsfox]

how do they manage to cost *you* time? They don't
cost me any of mine...

Re:If you're so smart

[isomeme]

how do they manage to cost *you* time? They don't cost me any of mine...

The first few cost me time because I hadn't heard about the worm, and was trying to figure out why friends were sending me these large random attachments which my virus scanner didn't like.

The next few dozen cost me time as I got alerted that an email had arrived, went to check it, and deleted it.

Then I had to spend five minutes or so adding a procmail rule to dump sircam mail into a holding pen folder. Since then, I've had to spend a few additional minutes making sure the filter wasn't accidentally eating 'real' mail, and bulk-deleting the holding pen emails now and then.

In addition to all that, I administer a couple of mailing lists, and I had to respond to user inquiries about sircam both on- and offlist.

All told, the sircam worm has probably cost me half an hour. No huge thing on the cosmic scale, of course. But still, it's half an hour that was stolen from me, during which I would have prefered to work on something else. Multiply that by all the techies out there dealing with the effects of sircam, and it gets pretty significant.

--

Re:wrong problem

[spitzak]

The fact that Emacs does this does not mean it is a good idea. Wrong ideas are everywhere, MicroSoft does not have a monopoly there!

Anybody actually use the imbedded elisp code in Emacs for anything useful?

Re:David Coursey is a fool

[thulldud]

I never looked at AnchorDesk more than once every other month when Jesse Berst was there. Maybe less. This was the first look I have had at Coursey. And it's going to be the last, unless he learns not to spout verbiage such as this:

Perhaps if we let a certain former Texas governor order the killing of virus writers, he might refrain from killing retarded adults, people who committed their crimes as juveniles, truly repentant offenders who'd happily spend the rest of their lives behind bars giving church services, a disproportionate number of people from ethnic minority groups, and the occasional potentially innocent person.

I doubt that Coursey actually made that paragraph up. It sounds as if he lifted it whole from some other rag, or maybe from a political pamphlet that somebody handed him in the elevator. But, as I skipped over this gush of babbling rhetoric, I ran head-on into that incomprehensible concluding phrase, "the occasional potentially innocent person."

I think that this is supposed to mean, "wrongly convicted person", but, if so, why not say so? "Potential" means, "not actual, but could become so", and the mind boggles imagining how someone could be "potentially innocent." This would have to mean, "currently guilty, but able or about to become innocent." I can understand going the other way, in that "I am potentially guilty of shooting David Coursey for propagating inane English, more dangerous in its way than any number of email viruses."

Hmph. The guy is just duckspeaking to fill a column. His words are strung together the way they are because he's heard them that way somewhere, not because they represent actual thoughts. Charity would allow a possibility that he does have actual thoughts to represent. However, I'm not that charitable.

Re:The real issue

[Glytch]

I feel your pain, Mr. Vice President.

Re:Hmmm. Might not take much, either.

[alumshubby]

I can just see it now -- one Navy SEAL to another: "You mean we made it through BUD/S so we can snuff pimply-faced pencil-necked geek kids??"

Hmmm. Might not take much, either.

[alumshubby]

I can just see it: A "Special Presidential National Security Finding" or some such that gets virus writing equated with more conventionally understood varieties of terrorism. Somewhere, late one evening, four black-clad operators slip silently into a house, shoot the dog with a suppressed .22, and disable the house security system. Down the hall, in a bedroom, a teenage boy is working on uploading his latest bit of MS Word or Outlook hell. The plastic bag full of ether-soaked paper towels descends swiftly and soundlessly over his head. His body is never found...

Re:wrong problem

[astrashe]

I agree with 90% of what you're saying here. But I believe MS deserves special credit for the virus plagues we've seen.

Why? Because the vulnerability of MS machines to viruses is a direct result of business considerations colliding with technical/security ones, and the business considerations rolling over the others.

MS's whole schtick is to leverage dominance in one product to another. That's why they're so into integration. It just doesn't make any sense to have an email program automatically open a file that someone sends you -- at least not for many kinds of files. And it doesn't make sense to have complex vb macros in word processor documents.

Think about how much pain office macro viruses have caused, and how little benefit the average person gets from them. One user in 10,000 probably writes vb code to manipulate office documents. I'm not saying don't make word scriptable -- let people program it through COM. But that would put Delphi on an even footing with VB.

Despite the flames you read here, MS has some of the smartest tech people on the planet. Plenty of people inside of MS knew it was stupid to make an email system that would run programs that come in through the email. People outside of MS complained about it from the start. But the business logic won.

As far as I'm concerned, they don't get nearly enough grief for this stuff. It's different from a buffer overflow in IIS. That's an honest mistake, and you're right, there are plenty of those in Linux.

MS's decision making process about security is corrupt. You can see it in these macroviruses, and you can see it in their lame explanations for why they're pulling Java out of the OS. The security policy dances to the tune of the business logic people. They don't care about the billions it costs their customers.

I know they fixed the outlook hole. And I would even say that they have the right to leave java out, as long as OEMs have the freedom to put it in. (Whether or not they really do -- contract aside -- remains to be seen. If I were at Dell, I'd be afraid of po'ing MS, no matter what their press releases say.) They are getting better on security. After years of outlook viruses they plugged the hole -- for the small percentage of users smart enough to dl the patches.

Let's roast them for their real problems. Because when the press gets bad, they do respond, and that will make the world a better place. As everyone who uses the product knows, the MS-SQL Server story was BS, a cheap shot. This is proof that there are still plenty of fair shots to go around.

Re:You'd think outlook would filter this by now.

[Griim]

They do have this, however, you have to upgrade to Office Security Patch 1/1a, and then possibly apply Office Service Pack 2. However, most people never bother doing this, and their website doesn't exactly make it easy to obtain these (let alone figure out what exactly it is that you need).

Re:You'd think outlook would filter this by now.

[Sethb]

The easiest way to update installations of Office 2000 and Office XP is to go to http://office.microsoft.com/ and click on Product Updates in the upper right hand corner.

It will scan your machine and tell you what updates you need to install, much like Windows Update does. It's a very handy tool, especially for those of us in IT, when we can't remember exactly what patches were put on which disk images...
---

Re:You'd think outlook would filter this by now.

[Pig Hogger]

Apparently Apple's MacOS 10.1 (due in September) has an option to turn off filename extensions.

Er... Since 1984 (when the Mac was introduced), the Finder/MacOs already hides the extensions (Macintrash files actually have two 4 character extensions - one for the file type and one for the creator application).

And those extensions are quite invisible, unless you use a special file utility to see/change them.

--

Re:You'd think outlook would filter this by now.

[mitheral]

Or heaven forbid we could just use email for mail and ftp for file transfers

lil destruction stops big destruction

[MikeFM]

I always take this time to remember why when you are fighting a big fire you burn little fires to make a fire break.. it uses up all the fuel a big fire could use to cause mass destruction and helps steer it away from the important things. All these little hacks, viruses, and so forth are responsible for most the security improvements made and are offering at least some protection against massive netwar attacks and various other nasties.

The fact that many companies refuse to protect themselves even after many threats just goes to show how stupid they are and how much they deserve to be the grass that burns to protect the others. I never feel sorry for such idiots.

In the decade or more I've been online I've only had one machine catch a virus and that is because I had the urge to install a few thousand on one pc and see how they'd effect each other. In all the time I've been running networks only once did I have one get cracked and that was due to the companies refusal to change their method of doing things in order to be more secure.

Re:Another reason to use Linux?

[gorgon]

A: Because Linux does not run a stable, feature-complete Internet browser You haven't tried mozilla recently, have you? Nevermind netscape 4.7x and others which are both stable and feature-complete for reasonable definitions of the term.

or office suite;

StarOffice is overly feature complete. Many of the other free alternatives are also feature complete for the average user.

a full-featured version of AOL Instant Messenger;

What is Gaim lacking that you need? I don't use IM, so I wouldn't know.

Quicken or a feature-complete variant thereof;

What features that you need are missing from GNUcash or Kapital?

any of the games that have come out in the last six months;

Hasn't Tribes 2 been out less than 6 months?

programs to interface with many of the peripheral devices that I bought.

Any specific examples? Support for new hardware in Linux is probably as good as in Windows 2000 or NT.

--
I hope we shall crush in its birth the aristocracy of our monied corporations ...

It's the Users, Stupid--no, wait, reverse that...

[Robotech_Master]

...it's the Stupid Users.

Who on earth would believe that in this day and age, after all the big viruses like Melissa and I Love You and Anna Kournikova and Naked Wife and I don't know what all, that got major media coverage . . .

. . . people would still be stupid enough to open files attached to an ungrammatical message from someone they didn't even know? I mean, what's up with that? Obviously, peole aren't getting the message. If they were getting the message, I would not have gotten at least two dozen random document files in my emailbox in the last few days, all of them asking for my advice. (I always reply, "My advice is to run a virus checker, and not to open any more strange attachments"--so far I haven't heard back from anyone; I wonder if the emails even get through?)

I mean . . . what can you say? I never got any I Love You emails. I get a new SirCam almost every time I check my email. If I were to draw a conclusion just from strength of numbers, I would have to guess that people are getting more stupid as time goes by!

Yes, it's easy to blame the virus writers; yes, it's easy to blame Microsoft for the security singularity that is Outlook. But none of these viruses would get very far at all if people would just use a little common sense about what files they opened! I mean, geez, I knew not to open strange files just from BBS days, before I even made it to the Internet. Why don't more people these days?

Sigh. I suppose I shouldn't be so surprised by this. I see enough rampant stupidity in my part time job as a K-Mart cashier already to realize the truth of that old George Carlin line. But it seems like every time I turn around, someone else is reminding me . . .

"You know how dumb the average person is? Well, by definition, half the entire population is even dumber than that!"

--

Re:You'd think outlook would filter this by now.

[Hanzie]

With all due respect, and not wishing to inspire a flamewar, I'd just like to advance my opinion.

I don't believe hidden extensions are acceptible in a windows environment.

hanzie

Take the bullets out of the gun?

[Wee]

Or wear a bullet-proof vest? I'd rather not get shot than try to protect myself during a shooting.

Why not just stop using Windows and/or (especially) Outlook? Keep trying to protect yourself against MS products, you have a life-long uphill battle ahead of you. Jeez, if you can't give up Windows, use Eudora. It works better than Outlook and it's reasonably safe.

I can't believe people are still willing to get hit with this kind of crap over and over and over...

-B

Re:Take the bullets out of the gun?

[Compenguin]

Or just dont execute attachments. 90% of these "viri" have to be manually executed and are quite odvious that they are viri.

-Compenguin

Short skirts?

[Pope]

That'd be a damn shame if she had no BUTT as you say... :)

Re:Short skirts?

[ninewands]

If I had mod points right now, I'd be willing to spend at LEAST two of them modding this crap down ... it is SO inappropriate ...
Do not meddle in the affairs of sysadmins,

Re:Liable

[Pope]

I personally think it's much worse when some group of idiots declare war on abortion-providing doctors in the name of "God" and start killing them.

Person(s) responsible for virus-writing should be held in jail for an amount of time to make them think twice about it. But actual killing is silly, but makes for humourous articles.

Re:wrong problem

[Black Parrot]

> I'm not sure viruses are any different -- we just need to secure our damned software.

Right. As someone pointed out yesterday, the federal idea about making software more secure is to fund an army of prosecutors. But what the heck do lawyers have to do with software security?

I suggest the opposite: legalize cracking. The h@x0rz would have a field day for about a month, but after that the world would be running (fairly) secure software, and sysadmins who don't have a clue will be sacking groceries.

--

Re:Linux as an antivirus tool.

[JBettis]

I use MIMEDefang with Sophos antivirus for linux, and it works great. To keep the dat files up to date I subscribed to the new virus announce mailing list, and when procmail sees an email from Sophos, it downloads the new dat file.

It has stopped all of the Sircam mails that we have received here.

Re:You'd think outlook would filter this by now.

[Brento]

You would think that MS would have put in something to stop this by now. Maybe a "are you really sure?" "are you really really sure?" type nested dialog boxes...

Office XP goes even further than that. I was thrilled to find that the default installation completely blocks a lot of types of attachments, including exe's, vbscripts, etc. You can't even open them if you want to! The only way around it is to edit the registry. Now, don't get me wrong, I don't want the junior users editing the registry either, but at least it's a step in the right direction.

GUID, not email

[delmoi]

Each word doc has a GUID attached with it. The author of the Melisa virus didn't remove his, making him very easy catch (same GUID on documents on his website)

I've never heard of anyone including an personal email address, though.

Re:You'd think outlook would filter this by now.

[JatTDB]

A corporate organization should have a more extensive virus solution than just protection on the client desktops.

I can assure you that the Norton AV Corporate Edition plugins for Exchange Server caught and quarantined quite a few messages in our site and those we manage. We've seen no evidence of infection on any of the PCs. I feel that anything less than virus scanning at every level you can afford is irresponsible in a corporate environment. For the example of mail server protection, programs exist for most major mail server software packages to handle this.

I know you want to say that this doesn't help the home user, and you're right...it doesn't. But, a locked-down corporate setup was your example.

On a related note...

[Hobart]

AnchorDesk writer David Coursey probably also advocates that Ralph Nader shouldn't have gone after Ford about the Pinto, and instead should have written an article called "Death to Bad Drivers who Rear End People!"

Give me a break. It's not the virus writers that are the problem -- it's a shortcoming of the infrastructure in place that allows them to happen. We've got to focus on working to fix that, and it'll take time to do.

If the new Ford Focus has a remote keyless auto-starter that can crash and leave the car unstartable by any kid with an RC car controller, who's at fault then?

(For that matter, if someone started a chain letter telling people to first mail copies to 10 of their friends and then to pour a bag of sugar into their gas tank to reduce emissions, who's to blame then?)

"The first fact to face is that UNIX was not developed with security, in any realistic sense, in mind; this fact alone guarantees a vast number of holes. (Actually the same statement can be made with respect to most systems.)"
-- Dennis Ritchie, 1979

Re:On a related note...

[steveha]

It's not the virus writers that are the problem -- it's a shortcoming of the infrastructure in place that allows them to happen.

No, it's both. If I leave my front door unlocked, and someone steals my stuff, I am dumb... but that person is still a thief.

steveha

Re:The Armys' response

[wiredog]

I'm so scared I'm shaking in my jungle boots.

Re:The Armys' response

[wiredog]

It's an official use. You'd be surprised how many .mil people, and contractors, read slashdot. They need to know this.

That's my story, and I'm sticking to it.

Re:Hmmm. Might not take much, either.

[wiredog]

It is interesting to note that virii and trojans are a part of cyberwar. So a Presidential Finding sending out the assassins is not that far fetched.

The Armys' response

[wiredog]

This came recently...

From: NISA CIRT

Sent: Thursday, July 19, 2001 8:04 PM

Subject: CIRT ALERT: Web Traffic Limited to Military Sites Only

** Unclassified - For Official Use Only **

As of 1900 hours, 19 July 2001, the Joint Task Force-Computer Network
Operations (JTF-CNO) has ordered that the DoD gateways be disconnected
from the Internet on TCP port 80 (protocol http) from now until a time to
be announced. The reason for this outage is the proliferation of the Code
Red worm.

All traffic between military installations will continue without
interruption. However, access to domains other than *.mil will be
limited. This restriction means that connections through a commercial
ISP, such as AOL or Earthlink, will not be available. Your military
organizations web-based Outlook will not be accessible from a commercial
ISP. Furthermore, if you are connecting from your office, you will not be
able to access *.com, *.net or other non-mil domains.

Any questions regarding this outage should be directed to the agency or
service CERT or JTFCND.

** Unclassified - For Official Use Only **

Re:The Armys' response

[Frank T. Lofaro Jr.]

I hope not. If their servers are slower than Slashdot it is a wonder we didn't get defeated by Iraq. ;)

Re:The Armys' response

[baptiste]

FOUO - please.

ABC News reported on this yesterday (I submitted it to /. but of course was rejected)

Key quote from a military spokesperson:

"To protect our DoD [Department of Defense] Web sites from being compromised, DoD organizations have been told to review the status of the Internet information servers ⦠to make sure that all the patches that were previously installed had been installed"

The last part of that statement makes me feel REAL warm and fuzzy about the technical readiness of our military - even if he is just a spokesperson.

Re:The Armys' response

[rampant poodle]

I think you will find that all traffic was stopped Thursday night. By sometime Friday only incoming HTTP requests were blocked. You can still read Slashdot from work but you can't get to your Exchange server from home.

Re:The Armys' response

[Dolly_Llama]

** Unclassified - For Official Use Only **

What part of FOUO did you not understand?

Re:The Armys' response

[Dolly_Llama]

Actually it's not. FOUO means distribution to government only. Public access of FOUO is through Freedom of Information by request only.

Re:The Armys' response

[Dolly_Llama]

See also: http://www.mbay.net/~heuer/S2unclas/Fouo.htm

Re:The Armys' response

[Dutchie]

It's an official use. You'd be surprised how many .mil people, and contractors, read slashdot.

Nooooo! Tell me this isn't happening! Mwahaha, the army uses slashdot now to broadcast messages to employees, what, is the Exchange server uhhh a bit slow or something? I'm going to write a virus and kill myself before I die laughing :) :)

• Imagination is more important than knowledge.

Re:The Armys' response

[ihawk]

This must make Code Red about the most effective DoS attacke ever.

Not /just/ death for virus writers.

[devphil]

Not even /just/ death for virus writers /and spammers/.

Instead, death after a year of torture. Recorded on film, and shown to teenagers on the first day we give them access to Visual Basic. Sorta like driver's ed class.

Re:Not /just/ death for virus writers.

[Nihilanth]

(i may have repeated myself a bit here, since my earlier post -appeared- to have errored out, and did not appear in searches later on) Hardly any way to thank the people who expose sloppy programming and the "our users are stupid so they dont need well-written programs" mentality that today's corner-cutting implimentation processes inhabit. Of course, If i were uneducated about computers, and had a propensity to using them irresponsibly and foolishly (say, for example, infecting myself with a virus), i would probably try to cover this up with a lot of loud, angry ranting, calling for the virus' creator to be violently punished. Seeing as that's not the case, i'm horrified at the unenlightened comments by the person mentioned in the article here on slashdot. Who's to say that the next development in virus implimentation won't lead to advancements in remote-administration (as an example)? Only when complex systems are challenged and forced to innovate can they truely be improved. Complacent users who don't care enough to educate themselves as to the proper use of the equipment they've been priviliged to use are getting what they deserve. Likewise, Businesses who allow uneducated users to use company resources also get what they deserve. Viruses help promote education and innovation, and while i'm not arguing that people who malliciously attack computers should -not- be punished to the full extent of the law, that certainly does not include torture and execution. The fact that authors of virii are being verbally attacked is equally horrifying. More and more precident is being set for computer programming being protected as free speech (DeCSS comes to mind, although i think the media is strongarming the reasonable away from justice regardless), and this seems like a BIG step in the wrong direction. Imagine what kinds of software and logic innovations we would be missing out on, if a computer scientist trashed his work files for fear of criminal prosicution? We don't murder gun manufacturers when a shooting takes place, therefore it would be foolish to propose that a programmer be killed for writing a program that is used irresponsibly by someone else, or even to propose that a user be violently punished for using a peice of software maliciously. I can use SMS (a useful remote administration tool used by many businesses to automate and remotely perform administration tasks) to spy on people, crash systems, and steal information. Does that mean SMS's author should be held accountible? SMS, after all, is nothing but a trojan with a large footprint.

Re:Another reason to use Linux?

[Asgard]

Winmodems, scanners, and funky all-in-one printer type things still are lacking in Linux. Quicken still rules the personal finance manager market -- GNUcash may be getting up there in the straight accounting category, but it can't connect to E*trade to download information, show as many nice graphs, etc. If quicken was fully ported to linux it'd bring linux significantly closer to the desktop market. Games would help alot too, but I understand that there are many more technical issues there.

Man...

[Palshife]

Viruses have just lost their mystique. I remember my Dad telling me about Michelangelo back in the 80's. I remember being so impressed that something so devilish and evil could really exist.

I suppose that's why I became a programmer.

No, wait. It was for the babes.

Freakin script kiddiez.

Re:Man...

[BlueUnderwear]

> You learn alot about assembler writing a second virus to kill off the first.

Yeah, right. Make that "your learn alot writing another one which won't be caught as easily as the first, and which does even more fun stuff".

Btw, Sircam is fun. It indeed succeeds at mailing out interesting stuff: tax filings, business proposals (including pricing/special favors), etc. Does it have a heuristics algorithm to pick out the juicy stuff, or is it just being lucky?

Re:Man...

[Cplus]

It is plus 2 because in the past Mr. Isaacs has either proven himself to be insightful, funny, or a Karma whore. Someday you too may post at plus two as he and I do.

Re:Man...

[jgerman]

That's cuz these outlook things are not really viruses. Coding and examining viruses in the eighties was a good way to learn to code. It took skill and knowledge to fool around with them. You learn alot about assembler writing a second virus to kill off the first.

Re:Man...

[MyopicProwls]

The first thing I thought was "WOW was that really the 1980s? I was NINE when that thing hit?" SO I went and looked it up. That particular virus spread in the "early 1990s" from what I can find -- still a long time ago but maybe I was twelve or something.

I saw Dan Rather talk about that virus on the news back in the day and got all scared that my Macintosh LC III would get infected. That's literally the day I learned that virii were platform dependant.

Thank God, because I've gotten like three or four Word docs mailed to me in the past few days from this damn virus, but I have neither Word nor Windows nor do I know the wags the emails come from so I'm not really scared.

MyopicProwls

Re:Man...

[pallex]

Probably luck. Paranoia is a powerful force. I remember a friend being convinced the rocks were aiming for him in Asteroids. They dont. It just seems like they do!

Re:Man...

[daniel_isaacs]

Believe it or not, I've been each at various times. When I got to 15 Karma points, I started to crave them. After 35 or so, I stopped caring. When I hit the cap, I started posting whatever I felt like posting, without consideration for finicky moderators.

BTW, You're a poet, and you were not aware of it.

Re:Man...

[Skuld-Chan]

Man you make me feel old - however I don't think the Michelangelo Virus came out in the 80's :). Try the early 90's :).

Re:Ritchie Quote

[romco]

"It's like having a pharmaceutical company releasing a plague so that they can sell you medicine."

About 15 years ago I worked for a company that
"fixed" cable TV boxes. One branch of the company modded boxes after exploits where found and the
other branch made and released exploits into communities. It's a real profitable business
model.

Re:punishment...

[vrt3]

Someone always has to be first. If the first 42 don't post and/or get killed, you are the first and you will get killed. Sorry, it was nice to know you.

Re:Dismount from high horse.

[yellowstone]

What is, of course, the bigger crime, is that more posters are not punished for comments that are undeserving of a Score of 2

<dr-evil>You can have my +1 score bonus... for one million dollars! </dr-evil>
--

Re:wrong problem

[flyfisher]

This is about as idiotic a reply as any I've ever read here. This is akin to saying that a thief isn't responsible for stealing because your house isn't protected well enough, and gee, he really needed that 20th TV.

The fact that security holes exist in software is NOT the problem, unethical, destructive criminal behavior IS the problem. Virus writers are responsible for their choice to inflict the results of their actions on millions of potential victims, causing millions of dollars in lost work time to companies (owned and staffed by people, this raises the price of the goods and services YOU pay for) and governments (paid for by YOUR taxes, raising the cost of our already very expensive government).

Virus writers ARE THIEVES on a much grander scale than the amateur who breaks into your house and takes your TV. It just isn't as personal a violation. The tendency to off-load the blame for bad (in this case criminal) behavior onto society (in this case the authors of non-secure software) is one of the most wrong headed notions of our time.

Re:The real issue

[cdrudge]

Sadly though, I have co-workers who whould write a sentence similiar to that line.

Sircam victims violate the DMCA

[bwt]

The DMCA bans distribution of TPM circumvention devices absolutely, without regard to knowledge or intent. It treats circumvention devices on par with stolen property in this regard. Since Sircam forwards one file off of your computer it circumvents login and read permissions that control access to a copyrighted work.

Thus everyone who executes (falls victim) to the sircam virus is guilty of a 1201(b) violation for distributing circumvention devices.

Obviously anyone who receives the trojan email has a cause of action, but actually anyone who uses the TPM in questions does too. That is, everyone who uses a computer that is susceptible to sircam can sue anyone who fell victim to it (in addition to the person who wrote it).

Anybody know anyone at the MPAA, RIAA, or Adobe that got hit?

Re:Sircam victims violate the DMCA

[ninewands]

Actually, no ... it might well fly with a proper set of jury instructions ... and, in addition to punishing the guilty virus writer, It would give the fast-click artist one hell of a scare ... while at the same time, pointing out SERIOUS flaws in DMCA.

Fact of the matter is, I LIKE that line of reasoning.

Do not meddle in the affairs of sysadmins,

Re:Sircam victims violate the DMCA

[gagganator]

no, but i did get one from m$ this morning

cant wait to look at the file when i get off work!

Re:lame...

[pogle]

Yup, I agree. Poor quality, low budget humor, stealing badly from Swift's writings, glossed over some political commentary on the death penalty. Must be nice to have such a big audience to bitch to, most of us just have coworkers and family.

Don't get me wrong, I appreciate lots of humor, including a lot of bad movies and such. I have a soft spot for a lot of bad movies and books. But this one didn't even evoke a grin, just a disgusted shake of the head.

Whatever

[Jailbrekr]

Don't kill the virus writers. Kill the people responsible for writing "productivity" software that can be easily exploited by the virus writers......

Re:virus writers are the lowest form of life?

[orangesquid]

Hmm.. senseless crimes? Hah.
Things like random acts of violence are senseless crimes, right?

Ever seen a hurricane? tornado? flood? lightning?

I think our primary target should be nature. Virus writers can come second! :D

Re:What about GPL?

[SaDan]

Given the GPL is called viral, would not GPL code writers ALSO be subject to this death option?

Only if you truely believe every word MS utters, in which case I'd say you need to be put out of your misery.
Interested in weather forecasting?

Re:Hmmm. Might not take much, either.

[mrogers]

Don't joke about it. In the UK, virus writing is already defined as terrorism because it is an action "designed to interfere with or seriously disrupt an electronic system". Studying viruses is also terrorism, since "a person commits an offence if he collects or makes a record of information of a kind likely to be useful to a person committing or preparing an act of terrorism, or he possesses a document or record containing information of this kind". By downloading an article about the SirCam virus into your browser's cache, you may have inadvertently committed an act of terrorism. But don't worry, the police won't bother to arrest you unless you do something to piss them off. Better keep your head down from now on, terrorist.

--

Re:It's the Users, Stupid--no, wait, reverse that.

[awaterl]

The witticism of concern would be more accurate, though perhaps less funny, if it read:

"You know how dumb the median person is? Well, by definition, half the entire population is even dumber than that!"

If the following were a distribution of IQs:

200 200 200 5

the average is: 151.25

and only 1/4, rather than 1/2, of the persons are dumber than the average.

Re:You'd think outlook would filter this by now.

[MrKevvy]

You would think that Norton AntiVirus 2001 7.0 would filter it as well. After all, that's what it's designed to do.

Yet, if you have a look at Symantec's Discussion Forums you will see many NAV2001 users complain that their e-mail scanner does not pick up SirCam attachments. Detaching those same attachments and running a manual scan of them then does find SirCam. Thois has been an issue since day 1 of SirCam (six days now) and Symantec still has yet to acknowledge it.

So you're a corporate user. You have a locked-down image with hidden extensions. Your NAV templates are up-to-date. E-mail scanning is active. You receive an e-mail from your boss with the title and attachment as a .DOC Word file that you know he's been working on, and he's usually too busy to check his spelling and grammar for every quick note. Your NAV scanner clearly checks it (there is an animated system tray icon that shows it working.) So you open it...

Sometimes it's not always the user's fault.

Re:You'd think outlook would filter this by now.

[iso]

I don't want to get this thread too off topic but the practise of extension-hiding has come up recently on a lot of Mac boards. Apparently Apple's MacOS 10.1 (due in September) has an option to turn off filename extensions. Why they're doing this I don't know (it has cause so many problems in the Windows world) but if anybody here is all concerned about this you may want to send Apple some feedback.

- j

God Bless Microsoft!!!

[toupsie]

If it weren't for the shoddy products released by Microsoft and the people that abuse the holes in those products, I wouldn't be able to put food on my table. I never get upset when a new virus/worm or security hole is found in Windows or Outlook. To me its a happy day because I get to hear my favorite sound, "Cha-Ching!".

The last thing in the world I want is Linux/BSD/Mac OS to become the mainstream operating system of choice. With Microsoft ruling the roost, I will never be poor. Instead of punishing these virus/worm writers and the script kiddies, I would like to erect a monument to praise their work. Without them, I would be destitute.

Re:God Bless Microsoft!!!

[jlanng]

Destitution is the last resort. It ruins lives

Re:God Bless Microsoft!!!

[IronChef]

That's only funny because it's so true.

I need to get some worthless certifications and cash in on this MS thing as well!

Another reason to use Linux?

[rsmith]

Q: Why do you use Linux?

A: It does not run Outlook.

Should be a requirement for a reliable OS, really :)

Re:Another reason to use Linux?

[groomed]

Q: What are "stable, feature-complete, office suite, full-featured"?

A: Pompous marketing-speaks designed to soothe self-important losers who couldn't come up with a single original thought if they had their whole life to do it.

Re:Another reason to use Linux?

[Weh]

What features that you need are missing from GNUcash or Kapital?

is it seriously called "Kapital" with a K ? That would make me feel uneasy...

Re:Another reason to use Linux?

[pmz]

A: Because Linux does not run...

This argument is losing validity every day. Within a few years, all of the applications that tie us to Windows will be mature and useful under Linux. I long for the day that my household can be truly free of M$. That day will come; it is just a matter of time.

Re:"Viruses" can be funny...

[Dirtside]

I think virii (I insist that's the plural...)

Why do you insist that? The plural of "virus" is, and has always been, "viruses". Check any (respectable :)) dictionary or pathology papers that discuss viruses. People think that the plural of "virus" is "virii" only because some clever 12-year old asshole fifteen years ago went, "Hey, radius becomes radii, therefore virus becomes virii!"

Neglecting, of course, the fact that English is a fucked-up language and we do not always use Latin pluralization for words. Even IF the plural of "virus" was Latinized, it would be "viri", as follows:

Singular: radi-US
Plural: radi-I, hence radii

Singular: vir-US
plural: vir-I, hence viri

The "us" becomes an "i", not "ii". However this is irrelevant because the plural of "virus" is "viruses". Claiming that any word that ends in "us" pluralizes to "i" (or "ii" for those who missed my previous point) is disingenuous. "Bus" does not become "bi" or "bii" (it's "buses"); the plurals of "plus" and "minus" are not "pli" or "plii" or "mini" or "minii" (they're "pluses" and "minuses").

I'm sick to death of people perpetuating this stupid fallacy of language. And don't give me that "common usage" bullshit; the only people who say "virii" are undereducated computer neophytes. </RANT>

Re:"Viruses" can be funny...

[Dirtside]

You're incorrect. The plural of virus is not "viri", even though that would be the correct pluralization if "virus" used Latin pluralization. But it does not. Every dictionary I've looked in that has a plural listed for "virus", listed "viruses" as that plural. Not one listed "virii".

This page explains, again, all about the plural of "virus", telling us (among other things) that in Latin, "viri" was NOT a proper plural of "virus":

http://language.perl.com/misc/virus.html

So, next time you feel like pulling something out of your ass, how about making sure it's shit and not linguistics?

Re:Viruses and bad software

[RedHat Rocky]

At a Microsoft-hosted seminar for Microsoft Solution Providers to help get them ready for the Windows 95 rollout, the opening comment from the speaker was:

"Folks, we are going to make you a whole lot of money."

In a past life I worked for an MSP. Woe! The shame!

Careful...

[DrCode]

...I know this is supposed to be funny, but what if that teenager is just working on his open-source MP3 player, and his name was phoned in by one of his classmates who didn't care much for computer geeks.

Or what if MS tries to convince the public that Linux is a primary hacker tool, and gets it declared illegal. They already have been making noises about it being communist and un-American. If you think the notion of the police breaking in your door to confiscate your Linux system is preposterous, try growing a couple pot plants in your living room.

Re:Careful...

[szomb]

Or what if MS tries to convince the public that Linux is a primary hacker tool, and gets it declared illegal. They already have been making noises about it being communist and un-American. If you think the notion of the police breaking in your door to confiscate your Linux system is preposterous, try growing a couple pot plants in your living room.

Linux:

• decreases interest in other operating systems and motivation to use them
• causes the computer to behave in ways that normal users just don't understand
• linked in its users to delusions of power and even God-like status (BOW BEFORE ME, FOR I AM ROOT)

Obviously, we are dealing with one dangerous narcotic of an operating system. Deploy the infra-red Linux scanners immediately.

But seriously folks. Since the pot analogy came up, Du Pont and friends did this to the cannabis plant in 1938 and their legacy is still with us and going strong. What's going to stop Microsoft and company from accomplishing the same thing, should they find themselves a modern day Harry Arslinger and give it a good try? Surely today's better, smarter sheople populace will learn the lessons of history and not let that happen...oh wait...this is the SECOND prohibition we're in now...hmmm.

Guess you need a gooder spellchecker

[sparcy]

And my advice to you is this: Learn to write more gooder, as this message makes you look like a dope, and please kill yourself.

ummm, and this person if criticizing the writer of the virus? Guess someone needs some gooder spellchecking software.

Re:Guess you need a gooder spellchecker

[IvyMike]

"Oh, it's a joke. I get jokes! Bwahahahahaha!" -- Homer Simpson.

Re:Guess you need a gooder spellchecker

[GMFTatsujin]

Unfortunately, you didn't go look far enough - the entire quote is:

And my advice to you is this: Learn to write more gooder, as this message makes you look like a dope, and please kill yourself. Just not in that order. See you later. Thanks. What bugs me most about virues isn't just that they exist, but that most of them are so stupid. Like this one.

First paragraph, sarcasm. Second paragraph - dumbfuck arrogant reporter bee-yatch. Cripes, he writes like a /.r :) Tatsujin

Re:Guess you need a gooder spellchecker

[tb3]

Flip the sarcasm bit, and re-read it.

Dismount from high horse.

[kannen]

It is plus 2 because in the past Mr. Isaacs has either proven himself to be insightful, funny, or a Karma whore. Someday you too may post at plus two as he and I do.

What is, of course, the bigger crime, is that more posters are not punished for comments that are undeserving of a Score of 2. Posters that automatically post at the 2 level should be punished by moderators for failing to provide any humor, insight, or whatever, but the moderators are only able to penalize posters for being OFFTOPIC, FLAMEBAIT, or TROLLing.

Of course, I'll get OFFTOPIC or FLAMEBAIT for this li'l puppy, because it has nothing to do with the larger discussion, namely, "Death to Virus Writers".

Re:Dismount from high horse.

[kaiidth]

Moderators can also penalize posters just by calling them OVERRATED, as far as I know. Which covers a multitude of sins.

'Scuse the off-topicness.

Re:Dismount from high horse.

[11223]

Like being a coward, or not wanting to have your moderation meta-modded?

The reason nobody posts at 1 when they have the bonus is that the abuse is already too widespread and it's just too much effort to hit the little box.

Re:Dismount from high horse.

[daniel_isaacs]

I'd mod you up. I wish more discussion of the modding system would come up. Whenver I try to complain about it it get's modded down. The same happens to anyone else. Tis a viscious cycle. Moderation is a hrash mistress. Yada Yada.

BTW, I posted @ 1 for you. I'd always do that, but it takes effort (you need to click a box that says "No Score +1 Bonus". You should have to click to post @ 2, not 1.

Re:wrong problem

[AirP]

You may not get anything from insurance... cough cough... but I think if the person who took the car is caught they're still prosecuted against. The WHOLE problem is exactly what you said... not only are you suppose to buy the car, you're suppose to PROTECT it. Shouldn't it be enough to actually OWN it? In a perfect world... yeah... but our judicial system sucks... after spending some time over in Saudi Arabia, where if you steal you lose body parts... the risk of stealing is too great, here you get the slap on your hand. You don't know how amazed I was to walk the streets in Saudi Arabia and have gold out in the open on tables with the owners not even worried that it could be stolen... that's the way it should be... stricker laws only hurt the ones who are breaking them.

Re:wrong problem

[AirP]

What? That's like saying... she was wearing a short skirt, she had that rape coming... And the thing of leaving the door open.. you could also say... we'll you didn't have enough security on that door, you only had 5 padlocks on it... that's easy enough for a burgular/hacker to get thru. The thing is this... it isn't their property... so they shouldn't be messing with other people's stuff. Hell, if we went with your logic... I could train a monkey to just go and open unlocked windows... steal everything and it's all fine because the window wasn't locked. Damn... no matter what.. IT ISN'T THEIR PROPERTY... NO IFs ANDs or BUTTs!

Is a virus worse?

[bill_kress]

Is a virus that starts some second process on your computer actually so much worse than a website that pops up hammer-the-gopher adds?

I don't have a problem with the viruses, I can avoid them. It's sites like the authors that start new advertising popups for every page I visit that bothers me.

How is this not a virus? It's just not persisted.

So, can we kill these guys too? Please???

Re:Is a virus worse?

[IronChef]

start using a hosts file that routes ad servers to 127.0.0.1. I've been doing it for a while and it really helps. Got started with hosts files from some web sites, added new servers as I found them.

Here is my current hosts file. Mac users, you need to reformat the info... Apple just HAD TO BE DIFFERENT.

Anyway, this is no cure-all but it does bust a lot of ads. I've been lazy about keeping it updated but it should help a bit.

Virus Writers

[cybercuzco]

Wouldnt this mean wed have to Kill Linus? After all, Mundie says that the GPL is a "viral" Liscense. Logically, everyone who writes under the GPL is writing viruses, and therefore, a witch! Throw her into the pond! ::shakes head:: sorry, MP flashback.

wrong problem

[egomaniac]

Tempting as it might be to go after the virus writers when something like this happens, the real problem is the buggy insecure code which lets it happen in the first place.

I'm not just picking on Microsoft - open-source projects have had their fair share of security holes as well.

But the fact is that Outlook, ISS, and various other products didn't even have security as an afterthought, it was just no thought at all. The charge shouldn't be "kill the virus writers", it should be "stop buying unsecure software".

After all, if you left your front door open for a week, and someone made off with your stereo, I'd argue that you had it coming. I'm not sure viruses are any different -- we just need to secure our damned software.

Re:wrong problem

[ninewands]

The same is true with a computer connected to a network. It's just not possible (or highly unlikely) that you will stumble onto my machine without having intended to break and enter.

I remember, back in the old days of the internet ... before it was the "Next Big Business Opportunity"TM ... when it was expected that if you partook of the resources available, you were sort of expected to contribute something. Connecting to the 'net with ports opened carried, at minimum, implied consent that people were welcome to connect to those ports, if they could, and use any services that might be listening there. It was expected that if connections were unwelcome, the ports would either be closed or significant obstacles to connecting would be in place (Thank you for TCPWrappers, Wietse).

My personal opinion (and my boss's, who is an OLD-time Unix and internet (white-hat) hacker) is this ... "secure the hosts ... if they're tight, we don't NEED no steenking firewalls ... ".

It's obvious to everybody but a certain small segment of 'hackers'. Guess what? The majority get to make the rules.

It's obvious to everyone but a Republican that the Constitution exists to protect the minority from the tyranny of the majority. Your rules are subject to judicial review ... and I would respectfully submit to you, before you flame back, that the U.S. Supreme Court has held that the Fourth Amendement protection against unreasonable search and seizure requires a "reasonable expectation of privacy", and that, if I were called as an expert witness in a criminal case involving evidence gathered from someone's PC over the internet, I would have to testify that, in my professional opinion, connecting an insecure host to the public 'net exhibited a total lack of "reasonable expectation of privacy".

All the crackers aren't criminals ... think about it ... can you spell E-c-h-e-l-o-n?

Regards

Do not meddle in the affairs of sysadmins,

Re:wrong problem

[ninewands]

I believe (actually, I KNOW) that it was no less of an authority on the subject of "the original intent of the founders" than Benjamin Franklin who wrote, "Those who would sacrifice essential liberty for a little temporary safety deserve neither."

Do not meddle in the affairs of sysadmins,

Re:wrong problem

[ninewands]

"Melissa" was an HTML e-mail that contained an tag ... it went out on the 'net, DL'd and autoran the activeX control as soon as the message was opened ... an ActiveX control can easily open an attachment ... ActiveX is EVIL ... it is, basically OLE2 over the 'net. The only fix I am aware of is to close the preview pane and set Outlook to treat e-mail as an "Untrusted zone". That way, NO executable content can run without your express permission.

Do not meddle in the affairs of sysadmins,

Re:wrong problem

[ninewands]

SOMEBODY MOD THIS UP ... I wish I could get this point across to those I've dealt with who are in the "decision maker" position ...

Do not meddle in the affairs of sysadmins,

Re:wrong problem

[Master Bait]

Right. I've got Linux on this side, and a Mac on that side. Why should I shed a tear for those Microsoftian victims?

They're just the self-perpetuating IT underclass. They have their little virus problem, we don't. We get things done, they're busy reinstalling their system.

Some are at the top of the pyramid, and the unwashed masses are at the bottom.

Aside from that, Microsoft is (maybe) going to face a REAL problem selling their new .NET Centralized Virus Repository & Enabler infrastructure to a millions of scared clients. Surely there is a Horatio Alger story in there somewhere for those who see the light.

blessings,

Re:wrong problem

[Master Bait]

Damn... no matter what.. IT ISN'T THEIR PROPERTY... NO IFs ANDs or BUTTs!

Haven't you read the Microsoft License Agreement? It's all Microsoft's property!

blessings,

Re:wrong problem

[jallen02]

Sorry,

I think your wrong about ms word(read: office) being scriptable.

Scripting applications is the way it will be for some time. It has ultra convenience for power users and there are so many business uses for it so that is why it is there.

Perhaps there needs to be a way to plug in other scripting langauges but no don't take away the scriptability of the applications.

I am an author for an unnamed company and they use word templates and a ton of VBA so that you can easily format text for documents that will be printed en masse. And you know what it is nice! No COM components or messy overhead. Just a quick vba installation of a Macro. The default setting is to turn macros off from anyhow.

There is a balance and taking an extreme is not always smart. Delphi might be ok for scripting word but dont make it harder for the sake of competition. Its not even competition if you have to make something more difficult to use just so the competition can compete! They arent even competition!

I think maybe something like pythin in word is practical but extending and programmatically controlling word via COM? Ugh! That raises the knowledge barrier to high for most people. Granted most users can give a care about programmability of their document processor it is still handy for customizing and benefits more than it harms IMO.

Thanks

Jeremy

Re:wrong problem

[NecrosisLabs]

Your first sentance could go like this..

"Tempting as it might be to go after the killers when something like this happens, the real problem is the soft human body which lets it happen in the first place."

"Tempting as it might be to go after the burglars when something like this happens, the real problem is the fragile window which lets it happen in the first place."

Yes, there are holes that are easy to exploit and should be fixed, but it comes down to the tautology that without virus writers, there would be no viruses.

Re:wrong problem

[geekoid]

no one has it coming. It may be prudent to lock your house, but it is still your house. All people deserve to live in a place where they don't need locks, the only problem is not all people strive for that goal.
same thing with computers. No one deserves to get a virus, or have someone trespass into your system.
Criminals are not there because of locks, locks are there because of criminals. a subtle yet critical point.

Re:wrong problem

[LilGuy]

Amen brotha!

Re:wrong problem

[kerrbear]

But the fact is that Outlook, ISS, and various other products didn't even have security as an afterthought, it was just no thought at all. The charge shouldn't be "kill the virus writers", it should be "stop buying unsecure software".

According to your logic, shouldn't the charge be instead "kill the makers of unsecure software?"

Re:wrong problem

[cthugha]

One user in 10,000 probably writes vb code to manipulate office documents.

You're wrong about that. Ever used Outlook to automagically arrange a meeting? It does that by sending VBA macros with the notification messages so that if the recipients click "I Accept" (or whatever the button label is), their calendar is automatically updated and a confirmation message is sent with more VBA code to update your calendar to show that they're coming.

This is actually a Neat Idea, BUT the implementation is lousy. You can argue it should be hard-coded, but that restricts organizations' capacity to customize their setup. Instead, the problem is simply that the security model hasn't been thought through. There's no reason why, if you're using Outlook to automagically schedule meetings, you should allow messages from outside your internal network to automatically run their attached VBA code. And why should any mail message you receive have the ability to zap your files? It's also quite difficult to centrally administer the configuration to make sure some luser doesn't fat-finger his/her own config and open up a gaping hole in your security. This is what prevents this Neat Idea from becoming a Good Thing.

That, and the fact that you have to have an all-Outlook shop for the whole thing to work.

Re:wrong problem

[sfe_software]

Let's expand your analogy a bit. Getting hit by a virus is like getting your car stolen. So yes, the criminal is at fault in both cases. What I don't agree with is that you, the car owner, have no responsibility to prevent theft. In both cases preventative measures could have been taken, knowing that your valuables are at stake.

You can't just use a weak protection, and hide behind a law in hopes that the legal aspect of it will protect you <cough>CSS</cough>.

Outlook is like a shiny new car with no alarm and a very simple lock. It's a very popular car, and like the 1986 Camero it is a commonly stolen car. Put it on the internet, and you just parked it in a very bad neighborhood. Sure, if it's broken into, the thief is the one at fault. At the same time, however, you could have done more to avoid the situation (as could the car manufacture). Maybe with better locks or an alarm system, the 12 year old car theif would have moved on to an easier target. The determined thief would have to work much harder to get your car.

If you are unwilling to take some responsibility by, say, getting an alarm system, you shouldn't be parking your car here. Likewise, if the car manufacturer doesn't want to learn how to prevent theft or break-ins, they shouldn't be making cars. Or at least we shouldn't buy them. Especially when everyone else has the same damned car and it runs like shit (Outlook, not the Camero ;)

Just ask your insurance company...

- Jman

Re:wrong problem

[sfe_software]

I fully agree that it's sad we must protect ourselves against thieves. Sad but true.

My problem is with people using that as an excuse for not protecting themselves. You certainly wouldn't leave the keys in your car, saying "I shouldn't have to take the keys out. Stealing is illegal and wrong!" It's true you shouldn't have to; but you do have to. Nobody said life was fair.

Likewise, one shouldn't run executable code on their computer that was blindly mailed to them. Doing so is asking for trouble. A tiny bit of education goes a long way, and it doesn't take much. Remove the keys, lock the doors, arm the alarm. Likewise, don't run attachments. Don't use mail programs that run attachments automatically. With a minimal amount of effort, an average PC user can avoid most any virus infection.

The default settings in Outlook (as an example) could be better. Some cars' doors automatically lock. Some alarms automatically arm. Some seatbelts are automatic.

BUT, just because your particular car doesn't automatically lock doesn't mean you can blame the manufacturer when it gets stolen. It might mean that next time you're car shopping, you look for these features; or, it might mean that you remember next time to lock the doors. In either case, you learned something.

But I've already taken this analogy way too far, I promise to stop now ;)

- Jman

Re:wrong problem

[doug363]

It is possible to attach a form and/or VB Script to a message and have it run automatically when someone receives it. (I don't think this works to the same extent in Outlook 2000 after the security update is applied, though.) As was pointed out somehwere else in this thread, Outlook does this itself to do things like organise meetings.

Personally, I don't see the point of having this "feature". In my experience, VBScript is incredibly un-powerful and only useful in a limited number of situations (like organising meetings, or writing virii ;)). Furthermore, I don't see why Outlook ever should automatically run unsigned macros or (signed) macros from someone you don't know.

Re:wrong problem

[magi_caspar]

Yes, the security issues on Alpha (the International Space Station) are certainly quite severe, what with the airless void outside. If you're going to complain about other people's lack of attention to detail, why not try proofreading your posts?

Re:wrong problem

[tb3]

let people program it through COM. But that would put Delphi on an even footing with VB.

It is a COM object; I've programmed Word, Excel, and Outlook through the COM interface. But you still need some kind of record-and-playback keystroke macro system for eend users. Those things have been around since the DOS/WordPerfect/Lotus 1-2-3 days

MS has some of the smartest tech people on the planet

I need to see some proof of that one. Their top people have been 'retiring' in droves, and the major incentive to working at Microsoft has always been the stock options. Now that the stock isn't doubling every year, and the pay is still way below industry average, I wonder how many really bright people are left.

the MS-SQL Server story was BS, a cheap shot

Read the supporting documents, look at the code samples and the responses from the Microsoft tech support person, then come back here and say that. They screwed up, big time.

Re:wrong problem

[szomb]

Don't you remember what mommy told you about taking executables from untrusted strangers?

Re:wrong problem

[s20451]

Tempting as it might be to go after the virus writers when something like this happens, the real problem is the buggy insecure code which lets it happen in the first place.

Right! Attack the problem at its source, and kill all programmers. That'll solve both problems, since virus authors are programmers by definition.

The charge shouldn't be "kill the virus writers", it should be "stop buying unsecure software".

So since (as you yourself argued) all software is prone to security holes, we should stop using all software. Then destroy all computers and return the world to an agrarian utopia. Then I'll solve all my security problems with the customs devised under the feudal system -- with a mace to the head.

Re:wrong problem

[Computer!]

Outlook is merely a programmable email client. Just as programmable as Word, Excel, and, IIRC, The GIMP. The problem was people running executables sent to them without checking the file extensions. This could have just as easily been done with VB, C++, etc, using pipes to send email. Outlook only provided an object model to make it easier for less experienced programmers.

We can't be responsible for other people's crimes. Leaving your car parked outside is not the same as dropping a $20 bill on the ground. You are right in that you have some responsibility to protect your property, but it's a shame that you do. That "responsibility" costs Americans $1000s annually in insurance, security systems, and, yes, computer security consultants.

Re:wrong problem

[blang]

Wrong. It spreads because people are dumb enough to write email clients that autorun attachments, and because people are dumb enough to buy software from a company that makes such dumb software.

So, we're talking about the CTO's and the IS departments. THEY are the ones supposed to be smart and educated about computers and security. They need to assume that their USERs are like 3 year olds when it comes to computer security, or educate the users to be as smart as they are.

By purchasing and using such inherently insecure software, the IS departments and CTO's are doing the same as a parents handing loaded guns to their infants.

Re:wrong problem

[MolecularBear]

Also, one could argue that viruses play an important role in software quality control. The more security holes that are found via some CIS major's virus, the better. This forces software companies to correct current security problems and think about future security issues. The fact that MS has provided fertile earth for so many worms is an indication that they need to raise their security bar.

Re:wrong problem

[Swaffs]

I thought we had this all sorted out. This worm/virus does not spread because of insecure software, it spreads because people are dumb enough to run attachments.

--

Re:Death to virus spreaders

[ninewands]

This is a message that needs to get out more ... in fact, it's really a question of being a good netizen ... and it's also the reason my e-mail client is set to send out plain-text mail, ONLY. I don't know what client my correspondents use, so I assume they are using Outlook ... sending the mail as plain-text at least stops Melissa-type autoruns ...

I remember a time (back in my pre-exclusively-Linux days) when a friend sent me an e-mail that was infected with an autorun version of Happy99.exe ... she is a programmer, and was VERY embarrassed when I told her what she'd done ...


Do not meddle in the affairs of sysadmins,

Re:You'd think outlook would filter this by now.

[archmedes5]

The attachments are downloaded and saved, you just can't open them in outlook.

He is obviously an idiot with wreaked logic.

[aralin]

He is preaching for clearing the gene pool and asks for bombing universities and killing hackers instead of retarded adults who even commited some serious crimes. This seems to me like a good contribution to Darwin theory.

Economic crime?

[aralin]

When the viruses cause so much problems and economic damage, why not punish in first place the company that came with operating system that created the whole anti-virus business and keep most people using their wrecked OS in places where such virus can result in economic harm?

And why do not kill the admis that deploy such OS anywhere where its infection based on core insecurity of the operating system can cause economic harm?

The C.O.O. of the last company I worked for would

[Robber Baron]

Send messages with asinine, ungrammatical subjects that is, say nothing of the body of his message. He also cracked open 'I love you' (and a few others) not once but twice!

Maybe this has something to do with why the company went tits up... ahhh Darwin!

Re:rehabilitation may sometimes be possible

[notfancy]

A classic example of the cart not knowing how to pull the horse. I'd rather kill the writers of that filthy email client, who in their infinite wisdom decided that putting VBScript and attachment autorun on it was a Good Thing

Re:You'd think outlook would filter this by now.

[MadMorf]

I can assure you that the Norton AV Corporate Edition plugins for Exchange Server caught and quarantined quite a few messages in our site and those we manage. We've seen no evidence of infection on any of the PCs.

That might be a false sense of security you've got there...

Our NAV Gateway has been letting copies through on a random basis, trapping only about 10% of the virus', and Symantec has admitted they know about this problem to us, on the phone.

So, don't be so sure you're protected.

As a precaution, we've limited our attachment sizes to 64K, this seems to stop 100% of the virii...

Re:You'd think outlook would filter this by now.

[MadMorf]

Thois has been an issue since day 1 of SirCam (six days now) and Symantec still has yet to acknowledge it.

Not true.

They may not have acknowledged it on the forum, but on the phone with them yesterday they told me they knew about the problem and were working to fix it.

In the meantime, we have limited our attachment sizes to 64K, which will not allow the Worm to be transtitted by email.

Let the virus writers -stay- this stupid.

[pi_rules]

As was mentioned in another aticle on Slashdot the other day in the comments (forget which article it was attachd to): Let the virus writers stay uncreative.

Really... you don't want this to turn into a challenge. Let things stay this easy to write; you'll only end up infecting the people silly enough to double-click random binaries from their Outlook client.

There's no good reason that they can't implement some really creative worm that would work cross-platform and cross-client. Yes, it would be hard but you don't want a worm running out, downloading C compilers for the specific platform, compile worm, link itself, run as a background process, and go on finding hosts around it to infect. Make the bugger look for common Linux services holes, email it self to people in your inbox who run Outlook (Just look at the message headers)... infect an IIS webserver nearby, begin propogating... then unleash some unholy attack to DoS networks everywhere.

Nope... I'd rather we just left it nice and easy for them to write a trojan that's Win32 only, and requires human intervention to activate it.

Death? Certainly!

[RevAaron]

My my! Our little timothy spent an hour and forty minutes on the phone! SHEESH! That certainly does warrant taking someone's life. I mean, just think- I bet there were people who had to spend *ghasp* 3 HOURS! on the phone! Someone's gotta tell me why this guy isn't dead already! Let me at 'em! Man, I had to wait in line at the store the otherday- anyone want to join me in a mob lynching?!

Re:Death? Certainly!

[pmz]

It's not just him. Think of the many millions of people spending this time over the same problem. Think of the many millions of administrators wasting their time with anti-virus software that shouldn't even exist. Think of the many millions of people who can't work because the many millions of administrators are still trying to fix their computers.

There are huge industries, such as anti-virus software companies, that exist only to prop up a flawed OS and its applications. When I see how much of our world's resources are wasted over these unnecessary and preventable problems, I wonder where we would be if there resources were put to real use.

Re:Death? Certainly!

[pmz]

Each of us is addressing a slightly different issue. Encryption and intrusion countermeasures are necessary, because so many computers are connected to the anything-goes public Internet. I prefer to use encryption for the same reason I seal the envelopes I send in the mail. I prefer to stay behind a firewall and limit the services offered on my workstation for the same reason I lock the doors and draw the blinds in my house.

However, the piss-ant viruses that proliferate on the most popular OS in the world are just wasting our time and effort. They aren't elegant or smart; they are just a pain in the ass. This isn't just about sloppy programming in the mail daemon or the web server, it is about a cronic illness that is entrenched in the whole platform. These things just shouldn't be! Anti-virus software attempts to band-aid these cronic inadequacies. It shouldn't exist because the underlying problems in the platform should have been addressed long ago.

If developers prosper by not cutting corners, then how did this OS become so popular? Was it sheer technical prowess or was it the naivete of and the subsequent choke collars wrapped around our planet's business people?

The good operating systems of the world are implemented well enough that I don't have to worry about these piss-ant viruses. I am left with the luxury of only worrying about real people--real criminals--who want to attack my computers. This is where encryption and intrusion countermeasures come back into the picture. This arena is where the innovation should be occurring--and it is for those people who have made better choices about their OS.

Re:Death? Certainly!

[Nihilanth]

Although it's true that antivirus expenditure wouldnt be nessisary without viruses, viruses challenge an important aspect of modern computing: Security. Do you think security is important at all? I mean, it would be nice if we didn't need things like encryption and intrusion countermeasures, but the fact of the matter is, we have a -right- and an -obligation- to utilize software to protect our privacy. If people don't exploit sloppy programming, it will remain sloppy, and have no reason to innovate or improve.

Your ISP succumbed to a virus attack? Switch to one not operated by morons. Your business was hit by a virus? Either fire the dumb users or force them to educate themselves. Your home computer was trashed by a virus? Learn rudimentary computer principals.

I'm thankful for virus attack's propensity for weeding out the weak software, hardware, AND wetware in modern computing. It allows software developers who are dilligent and don't cut corners to prosper by having a superior product, and it gives the advantage to the users who are responsible enough to educate themselves and others.

These supposed millions of manhours wasted on cleaning up after virus attacks are worth the price to continue the evolution of software and user-education.

As for where we would be without advances in anti-virus and security software, i would suspect:

1) No one but theoretical computer scientists would know what "Heuristics" are, and why they're useful
2) We would be using laughable encryption (if any at all)
3) Anyone with a telnet client and opposable digits would be able to steal your funds and identity

A well written computer virus (as opposed to a script) can be a sparkling example of code optimisation and ingenuity. Without the freedom to explore every algorithm, push every button, and Test every Case, the envelope cannot be pushed.

Although perhaps it's a stretch to imply that software development as a whole would simply lie stagnant if viruses never occured, every innovation, every well written algorithm prooven and plastered in plain view somehow advances software development as a science.

Re:Death? Certainly!

[Nihilanth]

Surely the two paths of development and research are related, scientific paralellism's a real thing. Of course these script-generated viruses aren't elegant or smart...but they're a shapeless yet powerful force that exploits user stupidity, something i aplaud. If -your- time is being wasted by these viruses, you are either doing business with the wrong people (if they are the ones being hit by these virii), or you need to be educated (if you are the one infected). The exploits viruses use to infect machines are security issues. Period. They need to be adressed. If viruses didn't exploit them, no one would notice them, and they would be used over and over until the damage got great enough for them to be fixed. Companies don't fix security issues like this until it becomes a problem. I never said developers didn't cut corners. quite the opposite. They do, and viruses take advantage of that fact, leading to improvements in development paradigms. OS choice has little to do with the kinds of virus problems we're talking about. Sure, lots of viruses exploit microsoft-specific vunerabilities...but there STILL has to be a sucker at the other end not keeping their software up to date or running willy-nilly downloading software attachments like some kind of idiot. these people simply dont deserve computers. bandwidth is too good for them, it should be conserved for the educated.

David Coursey is a fool

[bildstorm]

I subscribed to Anchordesk back before David Coursey took over. At that point it was a reasonable publication that had some neat tips and such.

David Coursey writes his Anchordesk stuff every day with lots of extremely pro-MS and dummied down PC tips. He thinks PCs only run Windows, so you can tell his grand intelligence. With the way he talks about it, I'd swear he used to be a Mac user (Mac vs. PC) who was then brainwashed by MS to talk about PCs.

Anyway, I don't generally have any problems with receiving viruses. My friends aren't that dumb. Most use webmail, Eudora, or Linux. I have Outlook because I've used it in an office situation, but I'm not really interested in the latest fake pic of Anna Kournikova or whatever.

Can we shoot idiots like David Coursey and his friends instead? Running a computer is NOT like taking an SAT (which isn't hard either).

Re:David Coursey is a fool

[CalcMan]

Damn straight, if people are that stupid they deserve it. and the SAT really isn't that much of a challenge. Basic algebra and geometry. and a computer well that is just point, click, crash, BSOD

Virii != skill (not anymore anyway)

[M_Talon]

I remember back in the days when I first started messing with computers. A virus back then was a nasty piece of work that lived on an EXE file or in the boot sector of the disk. It jumped from program to program, or disk to disk, and could wreak all sorts of havok to the unsuspecting person. They were tiny bits of code with a purpose, engineered especially for the job at hand. It didn't matter what mail program you were running. Some of the things attacked on the first read of the infected disk in the floppy drive. While a certain level of gullibility was required, it certainly took a lot less dumbness to pass a virus around (don't have updated AV software and pass an infected file on disk or over a network).

Nowadays, most of the virus attacks are merely variations of the same thing. Hide an attachement in email and let it do its damage by mailing itself to the world via a particular mail program. They even make kits for people to download to mutate these worms (I hesitate to put them in the same context as the virus of old). It takes no programming skill to make one, and requires such a high level of ignorance on the recipient's part. There's no glory in it.

"Look at me, I fooled a bunch of ignorant MS users into spreading my hacked version of ILOVEYOU with a header of Britney Spears on it"

Yeah, real cool. That's why everyone calls them "kiddies". You want real respect, make a boot virus or something like that. Something that doesn't require the user to be a total technophobe to spread. Then you might get an ooh or an ahh.

Re:Death to virus spreaders

[geekoid]

Actually the penelties can be very high(to high in some cases, but thats foranother time). However getting caught is where the difficulty lies.

lame...

[No Such Agency]

What a pointless piece. We're all frustrated about how quickly virii can waste time and money, abetted by dumb users, but death? Silly and obnoxious. It's not like many virus writers are that different from your average hacker: they are not gang raping babies, or beating up old ladies for their social security cheques. They are writing code! Granted, it's the code equivalent of spray painting obscenities on public buildings, or slashing people's tires in the parking lot, but I seriously doubt a computer virus , trojan or worm has ever caused a death or serious bodily injury (I don't count bruised fists from pounding on desks, or pulled-out hair here). It's vandalism, just of a type that's very hard to police and prosecute.

Re:The real issue

[Cheetah86]

Usualy by going to a antivirus site(like symatec or mcafee) you can get fixes for a lot of viruses. They usualy reccomending only downloading from that site, and if you do not get it from their site, to signature verify it. If they don't have a program for it, they will at least have removal instructions.

Re:The real issue

[Rimbo]

Seems like a good way to get rid of not just the virus, but your friends, too. No, they won't be dead, but they sure won't be talking to you again. :)

Re:You'd think outlook would filter this by now.

[Arcanix]

If you need to send an exe then put it in a zip file, not really that difficult to get around...

Re:Linux as an antivirus tool.

[Sonicboom]

Xibby wrote:

It's been said by many many times: Linux makes an excellent antivirus tool. Why? Well, because...it's Linux.

What kind of logic is this??? Linux (like any OS) is susceptable to virii. It's just that the people writing the malicious code are designing their app to work on MS Outlook because it's a common mail client. If there was a growing TREND towards the use of another mail cleint, they'd find the exploitables of said client and write their code to accomodate the exploitables.

How about taking it a step further and having you Linux box scan all incoming e-mail for virisus? See Amavis and others.

Platform aside - whether you're using Linux/BSD/*NIX, NT or Netware... whatever... proactivity of the network admin is the key. A proactive admin would have scanners in place and have libraries updated on a frequent basis to help stop these incidents from happening.

Unfortunately, most companies will not give money to a budget for a PROACTIVE network admin... but they're the first to CRY when their PC's been whiped out...

It's all about knowing your operating environs and being proactive... not about just putting linux on an old PII and using it as a mailserver. If an admin doesn't know squat about Linux and puts an "out of the box" Redhat w/Qmail install online - they'll have more problems to worry about than a virus.

Re:The real issue

[mrgoat]

Nah, it would say:

"We are ordering free pizza tomorrow in the break room. Click on the link to confirm."

Nothing gets folks like free pizza...


mrgoat

Its not the virus's fault

[jessh]

I know it cant acount for every situation but if people would just put some thought into the design of their mail clients and operating systems then there wouldnt be much these virus's could do. If you dont give random applications the ability to screw up your system then you dont really even need a virus scanner. That is why i run a real Operating system (and a real distribution of it for that mater SLACKWARE!!!!!!! (sorry i jsut had to use this chance to shamelessly promote my favorite distro))

Re:Its not the virus's fault

[jessh]

DONT TAKE ME SO SERIOUSLY!!!!!!! I am not saying that it is okay to write a virus to destroy a system just because the hole shouldnt have been there. Wha ti am saying is that the software makers should make SOME atempt at keeping it from hapening. Which microsoft doesnt seem to do very well. They include features that let things like word documents execute code, and dont put any protection to make sure the user knows what is going to happen.

Re:Exploitable

[jessh]

I do not think that there are no security holes in my system. But i do know that there has been an atempt to make it secure. I also know if that i was to download something that contained malicious code and then run it there would be a lot less it could do than if i was running windows. I also know that it would be a lot harder to write something that i wouldnt know was being run.
My OS may be far from invincible but as we have seen the OS that requires lots of support does sell more copies.

Death for this guy

[JonesBoy]

Funny how this article comes up with a wonderfully informative popup for an X10 camera. I vote death to popup hosters!

Re:Death for this guy

[rohdem]

webwasher

Wrong OTHER problem

[PingXao]

Dude, the ISS is the International Space Station.

I think you meant IIS - Internet Information Server. In fact, I'm sure that's what you meant, er, uh, ... right?

RUN FOR THE HILLS! THE SPACE STATION IS CRASHING WITH MUTANT VIRUSES ON BOARD!

AAAARAARRRRGGGGGGHHHHH!

Re:Viruses keep the economy going

[Kandy Neko]

Well, sometimes that makes me wonder is who writing most of these viruses and how much they get paid.

Flag Your Friends....Write Viruses

[dthable]

At least I know which friends I will not accept disks or files from. ;o)

Re:You'd think outlook would filter this by now.

[IronChef]

The file type/creator codes are certainly NOT stored in the filename. They are part of the resource fork.

Re:You'd think outlook would filter this by now.

[Meech]

Outlook 2002 is so strict now, that remotely syncing a palm pilot is really hard to do. You have to accept a number of "do you want to do this" type messages, when before you could go on vacation and dialup to sync your palm, now someone has to be at the machine to accept the sync. This is a big pain in the ass.

The fact that ".exe" can not be opened is a good thing for the general idiot MS Office users, but to the advanced user it is a little too much.

"Viruses" can be funny...

[EvlPenguin]

Here.

While not a "virus", that worm did provide a great amount of entertainment. Stupid people should not be allowed to use computers. But if that was so, Microsoft would still be writing code for Amigas.
--

Re:"Viruses" can be funny...

[groomed]

The one time somebody writes an fierce and distinguished comment on /. he is told to "calm down"?! A brave new world, indeed!

Re:"Viruses" can be funny...

[H310iSe]

no, really, they can be funny. I think virii (I insist that's the plural...) have a couple useful and worthwhile reasons for being. First, a friend in UChicago law school was in a large lecture with the 9th fed circuit judge as prof., big, somber lecture hall. One person on their legal-eagle laptop had apparently been checking email ... in the middle of class their laptop volume was turned up full blast and a recording started looping

'hey everybody, I'm looking at porn!'

I think that kind of virus is a high form of human pathos and should be encouraged, always.

Now I've had to deal with weeks and weeks worth of anti virus and anti anti virus (yea, McAfee is worse than the virii sometimes) crap but virii remind all of us that computers are, well computers and we're, well, the people. Do you understand? They reinforce the roles so often blurred or ignored, we must be the responsible, semi-cognizant ones in the relationship, we can't rely on them to think for us, etc. Basic hacker ethos. Virii are like big snow storms (or rolling blackouts), they shut things down, disrupt the normal clean flow of days and power and make people look around their momentarily decontextualized surroundings and maybe, think with some perspective.

Besides, with out the Anna virus we'd never know how many top executives are *eager* to look at tennis porn. Right?

I'm actually serious. Yes, they suck and yes they're mostly written my morons and yes PE infectors at least require a modicum of computer knowledge and yes destructive and yes. But I'd rather have them, at this stage in the game.

Re:"Viruses" can be funny...

[Argnarf]

'hey everybody, I'm looking at porn!'

I used to send that to people across the floor from me all of the time!! You're right, it turns your volume all of the way up. I can't find it anywhere. Someone post a link?

Re:"Viruses" can be funny...

[Argnarf]

I guess I could've looked myself!

here

I wonder if it's going to throw a blankspace in the link.

Re:"Viruses" can be funny...

[morcego]

I totaly agree.But my example would have been The AOL Virus.
Boy, that made my stomach hurt from laughting.

---

Re:"Viruses" can be funny...

[Anomynous Cowerd]

Actually, "viri" is the correct plural for the word. The word virus comes from the Latin word.... virus. In the 2nd declention (sp?) in Latin, the plural is formed by substituting an "i" for the "us". That's the same reason that radius' plural is radii. The "i" is substituted for the "us". This rule doesn't apply to words like bus, because there were no buses in ancient times. The Romans did not need a word for bus, so they did not make one. But just to be complete, the word bus is derived from Latin. In the early days of mass transportation, there were vehicles called omnibuses. An omnibus was basically a smaller version of a modern bus, drawn by horses. Omnibus is a Latin word meaning "to or for anybody" An omnibus was literally transportation for everybody. As the vehicle evolved into the modern bus, its name was shortened. I'm sick to death of people perpetuating the stupid fallacy of thinking that English is the only language that ever was or will be. The only people who don't know Latin are undereducated computer neophytes.


~The Moron

Re:"Viruses" can be funny...

[Anomynous Cowerd]

I recant and concede that I am, indeed, a moron. This will be the last thing posted with this Slashdot account.


~The Moron

The logic doesn't work...

[FortKnox]

If you look at the logic of the article, it talks about the hours and money lost by the viri (even deleting the email costs money). Now if you think that time and money are reasons to kill, then /. should be removed from the 'net. Think about it. The millions of nerds that spend hours reading it at work. That's some serious time and money. Economic tragedy? Nahh....

--

Re:You'd think outlook would filter this by now.

[txsable]

They do nested confirmation dialogs with Win32 installation programs. It shouldn't be too hard to implement the same thing for other protections! Just make sure that at least one of the boxes defaults to "NO" or "CANCEL"!

Re:You'd think outlook would filter this by now.

[MrBogus]

Ignoring the controversial subject on whether blocking executable attachments is a good idea, I have to say the way that they implemented the "Object Guard" on the Outlook API is pretty lame.

You get this message that "Some unspecified program is trying access your address book" prompt, whether it's a VBScript virus or you are trying to use routing features from MS Excel etc. Meaning there is no way to have trusted code which actualy does office automation features without annoying the users to hell and just giving them another prompt to ignore. I figure the Virus Writer club will be back to their old tricks of sending Word or Excel-based viruses pretty quickly.

Not that it really matters -- The only think that "Melissa" and ilk prove is that a 12 year old can write a mail worm without warezing a copy of VisualBasic. It's not like reading the address book off disk or sending mail directly using MAPI or even the winsock is too difficult for the advanced 14 year old.

Death to virus spreaders

[isomeme]

I can understand where Coursey is coming from, certainly. Virus (and worm) writing is a blatantly antisocial activity with huge costs and light (if any) penalties, and it would be viscerally satisfying to shoot a few of the perpetrators.

Oddly, though, with this SirCam outbreak, I find more of my wrath landing on those who help spread the stupid thing. Every single one of the hundreds of emails I have received thanks to SirCam resulted from some otherwise intelligent person being incredibly negligent about network security. I have spent significant amounts of my own time paying for their lack of caution.

I have taken to sending a standard reply to each person from whom I receive SirCam, pointing out that connecting to the net without proper precautions in place is both silly and rude. I'm hoping to trigger a shame response that will motivate people to think about security enough to avoid being so rude again.

If we can foster a culture in which abetting the spread of a virus or worm though lax security is considered a serious social faux pas, we may have be able to contain them better. People are motivated by considerations of power, prestige, and group acceptance; push those buttons properly, and you can sculpt behavior as you will.

--

Re:Death to virus spreaders

[bitrott]

Typical... "Silly ignorant (l)uzer, you've cost me precious nanoseconds out of my exceedingly efficient life, I spite thee in the name of torval, beowulf and the holy pengiun. Be gone from mine sight and sin no more."

Solution? Educate people, castigate not their lack of l33t skillz. You may find you have more friends, less ulcers and more ICQ numbers of hot babes. Yes, it takes smart people to make the worst mistakes, but you're never going to avoid this... even with all the playground names at your disposal.

Re:Its all getting easier

[CalcMan]

Note to you: POP is for recieving e-mails port 110 while SMTP is for sending outgoing mail port 25 just thought you should get terms right when u rant

Killing is too easy...

[Nos.]

That doesn't make them suffer, we should force virus writers (at least those that release them) to work tech support at AOL!

Virus Writers?

[Archangel Michael]

Windows is a virus. It infects everything. I wonder what this means for Bill Gates?

Re:Virus Writers?

[lposeidon]

hell ya. most people pay to get this virus... and they dont even know it.

Viruses and bad software

[Alien54]

y'know, between viruses and bad software, Microsoft has made many consultants very well off.

Which is part of the problem. People who sell folks on bad solutions because it also spells job security

;-)

Check out the Vinny the Vampire comic strip

Its all getting easier

[haplo21112]

You think its bad now, Just wait, I have been looking at the asp.net stuff, and C#...wow the nastiness that stuff is going to introduce when XP hits along with this stuff. But don't worry, M$ took out Java becuase it could spread Virus's. I believe though that more fault lies in people and companies that are not running proper virus protection, and don't have proper policies. Half the nastiness that gets in most companies could be stopped if the companies would just have the servers scan for viruses and delete the attachments that are infected before they reached the users. Still further they would be stopped by enforced Virus protection on the desktop. The biggest purveyor of Viruses that is almost unstoppable is the people that have Outlook setup to grab their email from thier ISP. Our servers, and most virus protection never have a chance to look at that mail before they click on that infected document. SHUT OFF the DAMN SMTP port don't let anyone retreive mail from anywhere but the approved company servers. Don't een get me started on the Hotmail/Yahoo, webmail menace, they should get sued if they let a known virus reach your mailbox.

Re:Its all getting easier

[haplo21112]

POP SMTP, they work together, I was thinking rather generically, of Mail servers in general.

Re:You'd think outlook would filter this by now.

[ichimunki]

I think the funniest thing is when people on the same LAN feel they have to attach files to email rather than sending a link to where the file is on a public drive.

Seriously, I like the notion. But I think it is mildly impractical to try and figure out an FTP scheme that is as flexible and user-friendly that would be ultimately any more secure than using email with attachments. You know the first thing every user would want is an "autofetch attachments" or "single click attachment fetch" option, and they'd all be downloading and opening the virus/worm/trojan anyway.

I'd say give general computer education time for the public to get to a basic, solid bedrock of how this stuff all works and the next generation coming up will make things like not opening attachments from strangers seem like second nature.

Re:rehabilitation may sometimes be possible

[linzeal]

The only program that deserves instant death is mass mailers anyways I would rather deal with a nasty virus every once in awhile than spam every god damn day...

Viruses keep the economy going

[NixterAg]

If it wasn't for viruses, all of my company's networking guys would have no clients to service. Faulty software and insecure networks are the bread and butter of the industry.

Re:Viruses keep the economy going

[tb3]

I guess I'm not the only one who noticed the correlation between McAffee's IPO and the proliferation of virii.

Re:Viruses keep the economy going

[hivolt]

And incompetent users are the jelly. Really. People who refuse to learn deserve an "OS" like XP.

Re:Viruses keep the economy going

[Rebelace00]

This reminds me of a Quote from Scott Adams, which I can't fully remember, but it dealt with how companies make money, and involved the line " Tell people they stink, and then sell them deoderant."

Re:punishment...

[dfenstrate]

Actually, I thought it would be funnier the lower the number. But I have no exp. first posting.

punishment...

[dfenstrate]

is the same punishment strong enough for first posters?

Re:punishment...

[mgarraha]

What counts as a FP? Any one-liner posted in the first quarter hour after the article? ;)

Michaelangelo Virus for me is like Kennedy assass.

[HenryFool]

I remember exactly where I was the day of the Michelangelo virus (March 6, 1992).

I was in 8th grade. A classmate and I were working on an extra credit project for Computer Literacy class during study hall. The junior high school had a lab of Apple ][es for Computer Literacy students to use. However there was a class using it during our study hall, so we had to use an extra Apple ][e that was on a cart in the closet of the principal's office. We wheeled the thing out of the closet and plugged it in. As we booted the computer, the vice principal walked out of his office and said "Whoa! What do you think you're doing? The MICHELANGELO VIRUS is today!" made us unplug the thing, put it away, and go back to study hall.

Re:The real issue

[platos_beard]

IMHO, a really effective e-mail virus would have text something like

Yo jerk. You sent me a virus. Please run the attached program to remove it

Anybody done it already?

Re:Linux as an antivirus tool.

[Grishnakh]

Sorry, but there's a big difference between exploiting an obscure buffer overflow vulnerability and writing some simple VBS code which gets auto-executed by Outlook.

This is like someone making fun of a car that has no doorlocks and is constantly robbed, and someone else replying that Wells Fargo armored cars are just as vulnerable because you can open them up with some shaped-charge explosives (after you knock the vehicle on its side by ramming it with a tractor-trailer).

The real issue

[BigumD]

Don't bother killing the writers. Just the people who work in your company who really think that their friends would write them mail with " Hi Friend I need you help" as a subject line.

Re:The real issue

[edwardkung]

Actually quite a few people on DALnet (IRC) are doing that. They msg urls to pages at http://home.dal.net/nick/somefile.exe which is actually user webspace so newbies get tricked into downloading the virus/trojan/whatever

Re:The real issue

[shyster]

Sadly though, I have co-workers who whould write a sentence similiar to that line.

I'm not surprised.

Re:The real issue

[ec_hack]

Remember that at most places it is company policy that: All your email are belong to us.

Re:The real issue

[morcego]

Thats not the worst of it.
Even worst are those people that forward HOAXes e-mail warnings thinking they are making a great service to humankind. And they are so sure of themselves. After all, it gotta be true. They read it on the Web !

---

Re:The real issue

[TheAlmightyQ]

Sadly though, I have co-workers who would write a sentence similiar to that line.

Re:The real issue

[Charm]

Who would have sulfnbk that?

Re: The real issue

[elemental23]

s/pizza/beer

It's the only way to be sure.

--
Have crack, will moderate.

Viruses are bad

[canning]

I'm still trying to open this loveletter and see Kournikova naked. I hate Outlook.

Re:You'd think outlook would filter this by now.

[unicaller]

Maybe next time I'll pppppreview oh well.....

Re:You'd think outlook would filter this by now.

[unicaller]

I think the funniest thing is when people on the same LAN feel they have to attach files to email rather than sending a link to where the file is on a public drive.

Like when someone attaches a 113MB PowerPoint Slide show from a pppppublic drive and sends it to half the company, all of witch have access to the original file. Then 47 people save the file to their user folders. Then the person that sent the E-Mail bitches about E-Mail running slowly!!!!

No what is funny is a month later when every version is diffrent and every one thinks the server isn't saving files anymore.....

Linux as an antivirus tool.

[Xibby]

It's been said by many many times: Linux makes an excellent antivirus tool. Why? Well, because...it's Linux. But really, because of it's immunity to viruses in the first place. (Let's ignore the spread of things like ramen as they work differently than Outlook Transmitted Diseases (OTDs))

Linux as you mail server? Check out Enhancing E-Mail Security With Procmail to send this nasty crap to /dev/null automatically. If the user can't run it in the first place...

How about taking it a step further and having you Linux box scan all incoming e-mail for virisus? See Amavis and others

If you're using Linux as your file server, invest in some linux based antivirus software. Let linux scan away at your uses Windows files and keep them virus free using an OS they can't infect in the first place.

If you're a network admin, and you don't take counter measures from preventing your users from infecting themselves and others, your a part of the problem as the virus writer. Educate your users, use counter measure that prevent your users from getting the virus in the first place, etc. etc. etc.

Re:Hmmm. Might not take much, either.

[bitrott]

Sentinels anyone? Joke today, annoying Slashdot rhetoric tommorrow.

rehabilitation may sometimes be possible

[tim_maroney]

If we'd killed Rich Skrenta, we'd never have had the Open Directory Project.

How many virus writers go on to live normal, productive lives? How many never write another virus?

(Ah, to heck with it. Kill 'em all and let DoS sort 'em out!)

Tim

Re:rehabilitation may sometimes be possible

[tb3]

Yeah, I read somewhere that most virus writers stop and become more civilized when they discover girls....

Hi! How are you?

[Bonker]

Hi! How are you?

I send you this goatse.cx link in order to have your advice

See you later. Thanks

Attachment 1: http://www.goatse.cx

Juvenile mentality:

[Bonker]

From the article:

Perhaps if we let a certain former Texas governor order the killing of virus writers, he might refrain from killing retarded adults, people who committed their crimes as juveniles...

The real kicker here is that most of the viruses out there have been created by... you guessed it... juveniles.

They're juvenile in mind if not in body at least...

There's a reason we call these people 'script kiddies'. Steve Gibson, of grc.org fame beleives that the k1dd3s DOS'ing his site are no older than 12 or 13. I would imagine that most of the people who downloaded this virus creation kit are just about as old.

Re:Kill BILL!!!

[WeirdKid]

The REAL VIRUS is unlimited root access in Windows 95/98/ME.

... which, by the way, is soon to make an unwelcome comeback to a wider audience in XP.

I've got a better idea!!!

[El Camino SS]

Don't encourage anyone to make viruses, genius. You need to get a grip, and write a program that actually does something other than make mayhem. Like hack Tribes 2, and make all of the players look like Kournikova.

Re: Virus - Viruses

[hendridm]

I don't care what y'all argue. Virus may have Latin origin, but so do many other words that don't follow latin rules. If that was true, why don't we all just speak Latin and get it over with. Truthfully, we need a common place to where generally accepted pronunciations and meanings can be found. I look to Webster's for this, which has never let me down, but they are all pretty similar if not the same. If Webster's says "viruses", than by God, so do I.

Exploitable

[hendridm]

It may be safer from virusES, but it's still exploitable. It's foolish to think Slackware, or any other distro for that matter, can be designed to resist all software attacks. Do you honesty think you can't be cracked? Why don't all Linux distro makers design theirs to be invincible? Do they like the money made from support calls, perhaps? I would think an invincible OS would sell more copies than an OS that requires lots of support.

Virus writers vs Spammers

[Nykon]

I think Spammers are much more needy of death then virus writers. I rarely get a virus in my inbox and if I do I think the nakedgirl.jpg.doc.bat extention is a dead ringer not to d/l it:) Besides I have been ummune to most of these "viruses" becuase if I have to use a WIN PC I use netscpae anyway, and use Pine or Netscape on my Solari or Linux boxes. Nykon

virus writers are the lowest form of life?

[xeeno]

funny, most people think that about journalists....

You'd think outlook would filter this by now.

[Opusnbill7]

You would think that MS would have put in something to stop this by now. Maybe a "are you really sure?" "are you really really sure?" type nested dialog boxes... :-D

Okay, you caught me.

[alexmogil]

I'll stop writing viruses, okay? Just don't yell at me any more. Alex

Liable

[Dutchmaan]

What happens when some nut actually goes out and kills some virus writer and sites that article as the reason why he did it...???

Seems to me in this day and age when commericial entities can be held responsible at least in part for criminal acts based on their content, that this article even made it past the editor.
--

Priorities...

[4mn0t1337]

Why devote energy to hunting down and killing virus writers when there are still so many spammers left to cull?

______

What's ironic is that...

[kypper]

many virus writers are dumb enough to put their e-mail in the stupid code.

Screw 3...

Re:What's ironic is that...

[hivolt]

Many lusers are dumb enough to run viruses they can read with Notepad.

Kill BILL!!!

[andres32a]

Dont kill the virus writers... kill BILL!!! He came up with the non-user all root Desktop. If windows were only like linux (user permisions)there is no way in earth that my stupid, stupid, stupid sister could open a virus and actually do any damage with it...

The REAL VIRUS is unlimited root access in Windows 95/98/ME.

Ritchie Quote

[blang]

"The first fact to face is that UNIX was not developed with security, in any realistic sense, in mind; this fact alone guarantees a vast number of holes. (Actually the same statement can be made with respect to most systems.)"
-- Dennis Ritchie, 1979

That's the big difference between all non-MS operating systems and MS. The whole damn world knows that systems are insecure, and that safeguards must be taken, not only to avoid known exploits, but to be prepared for future exploits. MS shows no remorse or shame every time they're caught with their pants down. Microsoft attitude to security is the same as their attitude to bugs in general. If it sells, why bother fixing it?

I can guarantee you all that Microsoft will continue to ignore security. Untill the day when the computer security industry (antivirus software, firewalls, etc.) is so big that Microsoft decides to corner that market. What a sweet deal that will be for them. It's like having a pharmaceutical company releasing a plague so that they can sell you medicine.

Wrong Problem? I think you need to reconsider

[JudgeFurious]

Don't go after the virus writers? The real problem is the buggy and insecure code? You don't think maybe the real problem is the little asshole writing a virus to screw up my mail or web server do you? I simply feel that if you write a virus and put it out there to spread and cause as much trouble as it can then you pretty much need to be shot in the back of the head and dumped into a large, unmarked, grave with the bodies of your fellow turds. Of course I also think that snipers with night vision could put an end to the graphiti problems in major cities too but then that's just me.

NO!!

[Omnivorous Cowbird]

I know this is a humor piece, but still...

There is a large tendency to over-regulate computers as it is (DMCA, etc.). The last thing anyone (sane) would want to do is give the over-regulation MORE power. Think of all the recent cases (DeCSS, Dmitry Sklyarov, etc.)... you do NOT want the people who thought stuff like this illegal to have the power of the death penalty in their hands.


______________________________________

Don't kill them. Use them for good......

[Anomynous Cowerd]

Use the virus writers to make the spammers lives miserable. Instead of making worms that just send themselves to everyone in the victim's address book, make them do that AND send mail to domains in the Realtime Black Hole List or something. This could be fun and useful. Or maybe even a worm that uses Dialpad to call spammers at home from everyone's computers. It could be really useful.


~The Moron

If virii were deadly...

[hivolt]

If email virii would kill off gullible fools, the virii would have no means by which to replicate, and the problem would be solved. Virus writers could then turn to more intellectually challenging activities, such as writing improved kernels.

If you think death to virus writers is radical...

[General8]

... then check this out.