Slashdot Mirror


Code Red Refunds?

bubblegoose writes "In Washington state Qwest customers are asking for a refund due to losses of service during the Code Red thing. Qwest is refusing to give the refunds. Excite has a story about it here." I tend to think this is just complaining bull crap. My net connection when down too, and I don't run around demanding $5 back. I'd be more upset if I was a business and my server rooted by this. The irony is that this will probably end up just pushing subscription software.

79 of 377 comments (clear)

  1. standing behind user agreements.... by jeffy124 · · Score: 2

    Qwest is probably standing behind some small line in the fine print of their user agreement that says "Qwest will not be held responsible for interruptions in service," meaning they will not provide refunds in the event their service is temporarily offline or has other problems.

    Personally, my cable modem is sometime offline, but it's usually during the day while I'm at work hence I dont notice.

    --
    The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
  2. Qwest by Frijoles · · Score: 5, Informative

    I use Qwest for both my DSL and ISP. I thought they were very helpful during this whole Code Red thing. Qwest called and left a message on my answering machine detailing how I could fix my DSL modem and patch my computer so that I would not be infected. They also called back to see if I had received their message and if I needed any help. I've been very happy with Qwest and was surprised by their customer support.

    Anyway, point is.. I think they do a great job. Keep up the good work Qwest.

    --
    -Frijoles-
    1. Re:Qwest by vulg4r_m0nk · · Score: 2, Interesting

      Funny, Qwest is my provider as well, and the only phone call I got was notification that my bill was overdue.

      On the whole I've been very happy with Qwest also, however I would like very much to know why they gave out bad information regarding the fix for more than a week. In case you didn't know, for some time they insisted that the only thing necessary was to disable remote web access to the Cisco router. This didn't work, and I suffered periodic outages for a week after I applied their prescription. It wasn't for quite some time that they revealed that blocking port 80 on the router was the only way to stop the scans from hanging it.

      As a telecommuter, my productivity was cut enormously over those two weeks. Now, if it turns out that Qwest was negligent, i.e., they knew that their original "fix" didn't work but wasted time releasing that info, then I would expect compensation. However I suspect that, as happens often in complex systems, it simply took them a while to figure out what worked and what didn't. If that's the case, then I cannot reasonably demand anything more from them.

    2. Re:Qwest by pongo000 · · Score: 2

      I'm glad to see Qwest taking care of its customers. @Home hasn't done a damn thing to block the morons who are still propagating Code Red (my Apache box gets hammered by all versions, 99% of which are from @home IP blocks). I think asking for a refund is silly, but OTOH I think @home and other ISP's should be taking proactive measures to actively block the legions of fools who have no idea they've been rooted.

    3. Re:Qwest by MadAhab · · Score: 2

      Just brings up an unpleasant point, which has always been true (since the dawn of dial-up, at least), and always will be; if you really depend on it, have more than one way to connect to the Internet. Sure, it might suck to pay for dial-up on top of paying for DSL (and if you do, make sure to get them from different providers), but in a pinch, it might help you find out why your shitbox minirouter doesn't work.

      --
      Expanding a vast wasteland since 1996.
    4. Re:Qwest by dillon_rinker · · Score: 2

      Yeah, well, I think Windows XP is a great OS because I've never seen it crash. And I've never broken a bone. And I don't know any homeless people. So I think Microsoft, Dr. Harris, and George Bush are really good at their jobs.

      Anecdotal evidence is COMPLETELY irrelevant when you're discussing issues that address thousands or millions. UNLESS, of course, you have anecdotal evidence from every member of the studied population...

    5. Re:Qwest by kootch · · Score: 2

      No... Rhythms, Northpoint, and Covad all went bankrupt because the bells, ie Verizon et all wouldn't give them access in a timely manner AND priced them out of the game.

  3. why not? by jchristopher · · Score: 3
    Complaining? And why not? They are in business supplying a service - you trade your money for that service.

    I cheerfully pay my ISP every month, because they provide me with a reliable, stable, fast DSL line. If it wasn't that way, I'd be in line clamoring for a refund too.

    The computer industry is way too lax on quality of service - every program, OS, or hardware device has a disclaimer that they aren't responsible if it doesn't work. What am I paying for then?!?

    1. Re:why not? by stevew · · Score: 3

      I agree - I've had a two week outage from @home partially due to the fact they couldn't get a service person out here quickly. They gave me a month off my bill which is ONLY reasonable! I was without the service for half a month, what they did was "the right thing."

      --
      Have you compiled your kernel today??
  4. Comment removed by account_deleted · · Score: 2

    Comment removed based on user account deletion

  5. Not quite... by quartz · · Score: 2

    While demanding a refund may seem a little off, I'd have to admit that if I was a subscriber to a program such as this one, offered by my provider, and got "protected" by having my port 80 shut off, I'd be asking for a refund too.

  6. hmmm by Beowulf_Boy · · Score: 2, Funny

    While were talking about refunds, lets all get refunds from Microsoft because there crappy software has bugs and was affected by something as simple as the code red bug.
    Oh, I'm sorry, when we all sold our souls to microsoft when we signed the user agreement I bet that was covered.

  7. Whose problem? by alewando · · Score: 2
    Quoth Qwest:
    The problem is not the modem, the problem is the virus. Qwest is not crediting for the virus.

    What Qwest clearly fails to comprehend is that, by choosing the tools they did, which have a known history of virus vulnerability, they are responsible for the reprocussions.

    It's a well-settled legal principle that persons are held responsible for the actions of their agents when those agents act in the furtherance of their employers' wishes and in a manner not contradictory to responsible behavior.

    Microsoft and Cisco perhaps should be held independently responsible for their failings here, but it certainly does not follow that Qwest ought be absolved of all duty to its customers.

    The rationale behind such a legal relationship is readily apparent. The customers have their dealings with Qwest.

    The customers often are not provided the opportunity to inquire into the methods Qwest is using to provide customers with services.

    And even when they are, there is no reasonable expectation that these subcontractors will listen to these end customers. (After all, their customers aren't Qwest's customers. Their customer is Qwest alone.)

    But Qwest has no real reason to complain to Microsoft and Cisco, since Qwest can simply pass the costs on to their consumers as they're trying to do here.

    In the end, consumers are shafted, and everyone else profits.

    Only by extending legal reliability up the foodchain to people making the final decision can we attempt to ensure that moronic decisions like these accurately produce the reprocussions for decision-makers that consumers feel.
    1. Re:Whose problem? by figment · · Score: 2


      Microsoft and Cisco perhaps should be held independently responsible for their failings here, but it certainly does not follow that Qwest ought be absolved of all duty to its customers.


      This problem has been known for a few months prior to the CodeRed outbreak. Cisco was fairly responsive in issuing a fix (not as fast as their normal bug fixes... but this isn't an IOS so it's somewhat understandable.)

      Qwest should be somewhat held responsible because the fix had been out for a decent period of time, during which Qwest had declared the patch unsupported, leaving people who wanted to patch their routers without much of a choice but to leave it broken, and DOSable.

    2. Re:Whose problem? by aozilla · · Score: 2

      Vigorous competition is the solution to these problems, IMHO.


      I completely agree, unfortunately cable is a shared medium, so a solution like the phone company's line sharing agreements is impossible. You could at least force the cable companies to offer pure internet connectivity with no services to resellers at competitive prices though. Personally I'd like to see the communities buy out their local cable companies, even through local bonds if needed. There is real competition in the DSL broadband market though. The phone companies have a monopoly on the lines themselves, and on the colocation space in the COs, but this is highly regulated (and a natural monopoly). It wouldn't take too many people to create a co-op for DSL service for your local community, and you could easily expand that to a long distance and even local phone service co-op. Get enough revenues and maybe you could even start thinking about buying out your local CO. I don't know the regulations, but maybe you could even make a deal with some TV stations and offer cable TV service through the phone lines. Be sure to let me know where you do this, I'll strongly consider moving there.


      Yeah, most of that is nothing more than shitty pipe dreams, but I still contend that the efforts should be spent treating the problem, not the symptoms.

      --
      ok then your [sic] infringing on my copyright! Could you as [sic] me next time before STEALING my comments for your own?
    3. Re:Whose problem? by WNight · · Score: 2

      Ok, let both parties spell out the limits and liabilities, in detail.

      When MS lists the IIS holes in the EULA and the user signs off on them, I'll accept it as the user's fault.

      But, the EULA says, in as lawyerly prose as possible, that Microsoft isn't liable for anything. Even if they intentionally bundled a virus with the OS and targetted it at you, the EULA disclaims all responsibility.

      I too think that people should be able to purchase less-than-perfect products, and then be unable to sue, if it was clear what the defects were, or the extent of the sellers knowledge.

      For instance, if you buy a Machine, and it's marked "As Is", you're entitled to take it back for a full refund if you find that that the seller knew it didn't work. You see, "As Is" means "I don't know" not "I tested it and it failed". It's perfectly reasonable to sell something broken, even something you believe will never work again, as long as you make its condition clear when you sell it.

      Microsoft *knows* its products are shit. If they don't take immediate steps to correct this, along with notifying potential customers, imho they're liable for the damages. Hell, there's a ton of companies who are skilled in fixing security bugs. Counterpane does security audits, both network and code. They could even bring in Theo from OpenBSD; whatever else it true about Theo, he's smart enough to know which C and C++ functions risk overwriting a buffer.

      Because Microsoft makes NONE of these attempts to fix their products, in my eyes, they are liable for the damages caused.

    4. Re:Whose problem? by WNight · · Score: 2

      Actually, it appears we don't disagree.

      1) Oops, my bad.

      2) I know the law would protect you, I was saying that if MS had their way and the EULA was a contract, that you wouldn't be protected. Hypothetical.

      3) Yeah, I know. They fail most of the prerequisites for a valid contract.

      4) There's a difference between 'no the best' and 'shit'. MS fraudulently sells the product as enterprise ready for servers yet knows they are not capable, yet alone less capable than the free stuff.

      5) Yes, monopolies should get different treatment than other companies. The spirit of capitalism is companies competing to bring you a product, not someone lying, cheating, and stealing to drive everyone else out of business, leaving the consumers with no choice.

  8. excite article by enrico_suave · · Score: 2

    Is there some irony there? like when MSNBC.com reports on the latest M$ security hole/virus/etc ???

    E.

    --
    Build Your Own PVR/HTPC news, reviews, &
  9. Why shouldn't they get refunds? by Wakko+Warner · · Score: 2

    It depends on what they were guaranteed, doesn't it? If the contract they signed stipulated an always-available Internet connection, and it wasn't always available (due to whatever circumstances), shouldn't a refund be in order?

    When a telephone pole near my house was struck by lightning last year, I lost cable (and cable modem Internet access) for a couple of weeks. The cable company not only happily refunded me half a month's worth of charges, but I didn't even have to ask.

    - A.P.

    --
    "Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
  10. Damn by banky · · Score: 5, Interesting

    I've never taken the time to write an angry post about the editorial content... but sheesh.

    First, if you lost cablemodem service for almost a WEEK, WHILE BEING LIED TO about the cause, wouldn't you be a little mad? This was the case here in Fairfax. They tried to say it was "sheduled router upgrades", only to backpedal a couple days later after everyone figured it out (and they had to implore their users to patch, and their email system was down, etc etc).

    Second, I guess I'm wacky, but if I pay for something, I want what I paid for, as other people have said here. I pay $45 a month for cable service. I don't call and complain if it goes out during a storm for a couple hours. But if its down for DAYS, their tech support line is TURNED OFF, and no one will tell me when it's coming back up, I expect to not have to pay for this service! I am not being given anything but a blinking data light. Some of us do not maintain multiple backup dial-up accounts; yes, I'll freely admin I'm spoiled by broadband, but at the same time, I can't justify spending $25 a month in case I lose my connection for a week.All the DSL providers in my area are dead or dying; roadrunner is my only option besides modeming (which is a bad scene in and of itself, die to "multiplexed lines" or some such nonsense which means I get 28.8 tops).

    Third, if no one says anything and just rolls over, then the company will not be challenged to provide a high level of service, since they will know customers will just take it.

    Sorry, Taco, but you're a helmet.

    --
    ZOMG I WOULD LOVE TO KNOW ABOUT YOUR FEELINGS ON MACINTOSH VERSUS WINDOWS, VI VERSUS EMACS, AND HOW YOU'RE NOT A DORK
    1. Re:Damn by banky · · Score: 2

      Solar flares are not the fault of the satellite provider.

      Traffic jams are often not the fault of the state, but morons rubbernecking. The state, in nearly every case I can remember, mentions to me in advance when they're going to tear the roads up, so I can plan an alternate route.

      Try again.

      --
      ZOMG I WOULD LOVE TO KNOW ABOUT YOUR FEELINGS ON MACINTOSH VERSUS WINDOWS, VI VERSUS EMACS, AND HOW YOU'RE NOT A DORK
    2. Re:Damn by dillon_rinker · · Score: 2

      The state promises you nothing. The state can't be sued for breach of contract, fraud, or negligence, even if they decide to tear up every road they own. Of course, you can vote the bums out of office, but that's a little different from suing them.

      Stuff happens. Pick your battles. Win them and you won't have anything to complain about.

    3. Re:Damn by fishbowl · · Score: 2

      >Traffic jams are often not the fault of the
      >state, but morons rubbernecking.

      You can't really compare public roadways
      to privately owned telecommunications.

      --
      -fb Everything not expressly forbidden is now mandatory.
    4. Re:Damn by Danse · · Score: 2

      They may be able to make a case if the customer was infected. But what if they weren't? Either way, they still lied to their customers and the service was still down for a WEEK.

      --
      It's not enough to bash in heads, you've got to bash in minds. - Captain Hammer
    5. Re:Damn by Danse · · Score: 2

      Why would he do that? There is no other comparable service available. One vendor. One choice if you want broadband. Just because they're the only vendor doesn't mean they should be allowed to get off so easy. They failed to provide service for a week. Why should customers have to pay for a month of service when they only received 3 weeks worth? I wouldn't cancel. I'd pursue the matter til it gets resolved. If I get stonewalled somewhere along the line, I'd make sure it makes the news (they love this sort of stuff). Perhaps get my rep involved. There are options.

      --
      It's not enough to bash in heads, you've got to bash in minds. - Captain Hammer
    6. Re:Damn by dhamsaic · · Score: 2
      amen brotha. i have both cox roadrunner and verizon dsl in fairfax. while my cable was wigging out, i bought a second router, hooked it up to the dsl and it worked fine the entire time. i think cable's working again but i dunno. agreed, we were lied to on the phone by roadrunner reps. i had my cable modem unplugged from everything while she was telling me "it must be your computer, i can ping your modem just fine..." - "are you sure it's mine and not someone else's?" - "oh yes, i'm definitely pinging yours and it's working fine..." uhhhh... riiiiiiiiight.


      anyway, where you at in fairfax? i'm right near the high school. mmmm, china gourmet. did you know that think geek is situated in fairfax too?

      --
      Every once in a while I like to masturbate a new word into my vocabulary, even if I don't know what it means.
  11. Refund or Service. by Faux_Pseudo · · Score: 2

    Lets see, a few hundred refunds of $5 a peice which the service contract does not require, OR the knowledge that you will only loose a handfull of customres because broadband is a monoply.
    Oh an option number 3: Be a pissed off customer and complain you want your $5 in this time of economic uncertanty for broadband companies and if enough other people do it the company is unable to pay its bills and you are left with no service at all.

    Lets just say that when my nntp connection goes down with @home for a few hours each month I do not call demanding a refund.

    1. Re:Refund or Service. by WNight · · Score: 2

      If an ISP can't afford to provide the bandwidth they contracted to provide, they should charge more or provide less (after notifying customers).

      I know of many ISPs that cap customers, either in momentary bandwidth (ie, speed caps) or in total bandwidth, or both, where the speed cap drops lower, the more you've downloaded.

      This way that can afford their backbone costs and provide service to everyone without letting a few people use up a T3.

      The reason QWest is providing unlimited bandwidth is so that they can drive all the competition out of business. Monopolistic practices.

      And we're supposed to go easy on them when they don't provide what they contract to provide?

      Do you think the board of QWest is sitting around, discussing overdue bills, saying "We don't have a realistic understanding of living on one wage and supporting children, so we should let these people slide a month" or do they automatically forward all overdue bills to collection, thus ruining your credit rating?

      I might be prepared to cut them some slack if 1) they'd ever return the favor and 2) they we're monopolistic jerks trying to run everyone else out of business.

  12. Re:Did I miss something? by Enigma2175 · · Score: 2
    My cable was down for 12 hours during a storm, would they prorate my bill and take off 1/60th or 1/62nd of the bill?

    Yes. At least with AT&T@home the Tech Support people are authorized to give refunds for outages. At least that was the way it was when I worked there.

    --

    Enigma

  13. Re:Did I miss something? by figment · · Score: 2

    The configuration webserver on the Cisco 675 had serious DOS problems in the setups that various dsl providers were providing (i think it had to be in bridging mode or something), which were known even prior to the CodeRed problem. Essentially, if you did a getrequest with too much crap in it, it crashed.

    It hit bugtraq a few months ago, while cisco was fairly responsive and issued a patch, Qwest at that time declared that patch unsupported.

  14. What is temporary by Catskul · · Score: 2, Insightful

    So what happens if you are without service for a day, a week, a month? Does that count as temporary? This is a very gray area they could have a chance of getting the law on their side.

    --

    Im not here now... Im out KILLING pepperoni
    1. Re:What is temporary by Trepidity · · Score: 2

      Yeah, this is still a really gray area. On the one hand, one can hardly expect an ISP to give you say a $0.50 refund every time the system is down for 6 hours. But on the other hand, what if it's an extreme case, and the system is down for the entire month? Surely you can't be expected to pay your monthly fee if you didn't get any service at all. So what about the cases in between?

      The only time I can think of that this became a legal issue was with AOL downtime and limited availability in early 1997 as they were switching from 20 hours a month free access to completely unmetered access. But they settled that by offering refunds (in the form of rebates on the next month's fee).

  15. I was hit... by doorbot.com · · Score: 2

    ...by the Code Red virus. A few entries in Apache's access_log but I didn't go down (nor did my PacBell DSL line). But I think I'll sue all of Qwest's customers (or maybe just the ones suing Qwest) for attempting to attack my system. That's cyber-terrorism, no? They should've been patched and my guess is a bunch of those morons were propogating the worm further. Who knows, maybe Qwest targetted some of their customers specifically who they thought (legitimately or not) were further propogating the worm.

    1. Re:I was hit... by doorbot.com · · Score: 2

      No kidding. I am in awe of your astounding intellect. Please, bestow onto me your infinite wisdom, oh wise one.

      How many of those Qwest customers had PWS (IIS) installed because they have no fucking clue what the hell they're doing? Probably just as many people who are demanding money back from Qwest.

      Do your homework.

      I did, are you the who's going to correct it?

      Don't jump to conclusions, it's a lonely place.

  16. Unbelieveable.... by Lumpy · · Score: 2

    It takes all types, and obviously comuters and the internet are now rife with the types of the clueless. (Ok, I know, that ain't a news flash by any means) First off the TOS with any isp states that they are responsible for nothing, and if something happens that is not of their doing that interrupts your service then tough cookies. This is like asking the Cable company to refund your money because while your power was out you couldn't watch tv! or demanding a refund from the phone company because you couldnt use your phone while your house was burning down.

    Unfortunatly, the courts will either help these "poor" users. or it will be swept under the table.
    I just wish for once we'd get a judge that would publically announce that the plaintiffs in a friviouls lawsuit were morons and idiots... but then that'll bring more friviolus lawsuits... and so starts the spiral downward...

    If this case is won by the users.... when can we sue microsoft for all the lost productivity their operating system causes weekly?

    --
    Do not look at laser with remaining good eye.
  17. Shouldn't.. by RainbowSix · · Score: 2

    ... their target be Microsoft or the creater of the virus? This is just as frivilous as suing mp3.com for allowing users to copy artist's work.

    --
    --------
    It's OK to be social, just don't tell anyone about it.
  18. Re:Qwest was negligent by Ungrounded+Lightning · · Score: 2

    3.Even though it wasn't being used, Qwest left the HTTP server enabled and configured to accept connections on the WAN port of the router.

    Actually, with that version of the Cisco firmware the router would crash due to Code Red's probe packets even if the port was disabled.

    If Qwest was negligent it was because they didn't upgrade the firmware in the routers they supplied, and didn't provide the users with a notification of the need to upgrade and a convenient way to do so.

    --
    Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
  19. Qwest are slime! by Blue+Neon+Head · · Score: 2

    I guess it comes with being a telco and being used to screwing customers over, but Qwest are seasoned pros. It has become customary for them to try to sneak extra charges on my bill anytime I order anything from them (which I avoid when at all possible now). Currently, I am trying to get my ISP switched from Qwest.net to another local service provider. I was quoted Aug. 15 at 5 PM for the switchover. A few days after this, I realized I had not been switched and called to complain; they told me the switchover would be today (Aug. 22) at 5! Right now, it's 9, and I just called support, asking why I wasn't switched, and they had NO such switchover on file at all. Next stop is the Better Business Bureau and the Public Utilities Commission ...

  20. Want to Sue? Sue Microsoft! by mr · · Score: 2

    1) they have money.
    2) If you are runnng, oh say unix, you didn't agree to their licence.
    3) Their shoddy product is unsafe on the information superhighway, and create unsafe conditions for the others.

    Microsoft has had staffers and employees state the goal is to push out new product, andding features over 'good code' or fixing old bugs. You might just get #3 to stick.

    All you have to do is get a jury to buy #3. The lawyers will like 1 and 2.

    --
    If it was said on slashdot, it MUST be true!
  21. Re:More of the same by AntiNorm · · Score: 2

    There are too many companies getting away with complete incompetance and expecting us to just shut up and put up. What's wrong with making them pay for their own stupidity? They waste your time and get surprised/upset when you express annoyance. I don't know about you, but my time is more valuable than that.

    Good point, but Qwest isn't the incompetant company here. Microsoft is. Mind you, it's not all M$'s fault -- people who run any server on any OS, but *especially* an IIS server on Windows -- should be sane enough to secure their systems.

    --

    I pledge allegiance to the flag...
    of the Corporate States of America...
  22. Lost business by SilentChris · · Score: 2
    Actually, I'm still being bombarded by packets (I'm on a cable modem) from recent worms and I've considered dropping my provider/changing it.

    It isn't "five bucks" for a loss of downtime. Most connections alone run between $30-50 in the DSL/Cable range a month, so 10 days, or 1/3 of that, is a loss of at least $10. Add to that work that cannot be completed over the internet, and the downtime can become severe.

    Also, I don't think this situation is helping my provider, @Home, stay in the business any longer. If they can't start blocking these packets they're going to lose subscribers, which is the very last thing they should be doing right now.

    1. Re:Lost business by SilentChris · · Score: 2

      No, it's more like $10 plus any lost revenues I can't receive from failing to complete my work over the Internet. There's opportunity costs involved.

  23. Refunds for not providing internet access... by MadAhab · · Score: 2
    If they won't unblock the port, they should be prosecuted for fraud. If they are blocking ports, they are not offering internet access at all. They are offering "download access", but not Internet access, and you've been sold a false bill of goods.

    It's important to note that Internet access is fundamentally, essentially, and always peer-to-peer. If you don't allow peer-to-peer access, you can call it "client-server" access or something else, but it's a lie to call it Internet access.

    Anyone who wants to limit service in this way is incompetent to boot, since the Right Way to prevent abuse is not port blocking, but bandwidth capping. At a time when AT&T cable access is such a takeover target, it makes you wonder what the hell they are thinking.

    Worse, by getting away with such a deceptive, unfair, and unnecessary abuse of their relationship with the customer, they are only paving the way to battle the Internet back into the traditional broadcast mode, where a few big companies have a voice, and individuals have none. I'm sure DisneyTimeWarnerNbcABCBSViaColumbialetric would love that, but you should hate that unless you also hate freedom. Like I said, if that's the service they want to offer, let them, but they can't claim that it's "Internet access" without ripping you off.

    --
    Expanding a vast wasteland since 1996.
  24. Spammers like Qwest Re:Qwest are slime! by strredwolf · · Score: 2

    That's the same attutude when us non-Qwest users get spam from their downstreams. "What spammer?" while they nicely /dev/null the complaint.

    --

    --
    # Canmephians for a better Linux Kernel
    $Stalag99{"URL"}="http://stalag99.net";
  25. Brilliant idea by mosch · · Score: 3, Interesting
    Think about what you're saying. Code red infects people by making requests to port 80. So they have a choice of buying a whole lot of expensive hardware and blocking all default.ida?XXX requests, violating the privacy of their users. This is what you're actually asking for.

    The second option is that they can deny all incoming requests to port 80, since the UA forbids running servers anyway, and slowly wait for the code-red running machines to go away. This is what they did

    I don't want "proactive measure" anywhere near my net connection. You do realize that a proactive measure would have to monitor all your traffic in depth, and then try to guess when you're behaviour was dangerous. When it has a false alarm, then you'd blame @Home for using such an error prone method, instead of a simple reactive method.

    The trouble with listening to an idiot is that you might give them what they asked for.

    1. Re:Brilliant idea by pongo000 · · Score: 3, Interesting

      The second option is that they can deny all incoming requests to port 80, since the UA forbids running servers anyway, and slowly wait for the
      code-red running machines to go away. This is what they did


      Not in Dallas, they didn't.


      I'm not advocating any kind of port 80 blocking. It would be a trivial matter to simply block the offenders at their gateway. All @home has to do is set up a monitor on their IP block. This is proactive, but there's no need to monitor traffic in depth, as you say: The morons announce themselves.

    2. Re:Brilliant idea by fishbowl · · Score: 3, Insightful



      >The second option is that they can deny all
      >incoming requests to port 80, since the UA
      >forbids running servers anyway

      You are mistaken, and you have NOT researched
      the facts before posting this.

      *MY* agreement with Qwest expressly allows
      running servers. They are quite up-front and
      honest about the whole thing. It's what makes
      their relatively expensive, but somewhat slower,
      service an attractive choice in markets where
      there's cable or other dsl providers.

      They even offered to help me setup my LAN, my linux boxes, a static IP netblock, you name it.

      I would suggest that when you talk trash, you
      stick to subjects that you know something about.

      --
      -fb Everything not expressly forbidden is now mandatory.
    3. Re:Brilliant idea by WNight · · Score: 2

      How is routing packets based on the destination IP, which involves lookin in the packet, any different than routing based on the TCP level, such as transparent web proxies?

      And then, what's wrong with routing a packet containing default.ida?... into /dev/null? Either it's a worm, and the customer didn't intend to send it, or it's a cracker, who you don't want using the service.

      I think all ISPs should have dropped packets on port 80 that appeared to be CodeRed. It'd have stopped this thing quickly.

      But then I think the Anti-CodeRed scripts that use the same hole, but to apply the patch or shutdown IIS and display a message explaining it, should have been used, and should be legal.

      Attempted analogy. I shouldn't go into your car, even if unlocked. But, if your car was rolling slowly down the hill towards mine, would it be wrong if I opened the door and set the parking brake, to save both of us a large repair bill? Especially if I left you a nice note explaining the parking break, how to set/unset it, and why I did what I did.

      In fact, in some jurisdictions, you'd be held responsible for not preventing an accident if you could have safely/easily done so, regardless of it being your "fault" to being with.

  26. Re:More of the same by SlashGeek · · Score: 2
    While I didn't have any problems from my ISP (verizon), I don't think I would have asked for a refund either. Hell, even if it was down, who is to say that it was their machine in the first place? What bothers me about the whole "CodeRed" virus is, from what I have been reading, the hole was public a month before the virus hit. A patch was available at least two weeks before the virus hit. The virus itself was made public at least a week before it took off. Why oh why did so many large ISP's not fix their machines before hand? I realize that you have to run these patches on test boxes, etc. But the risk was to large not to, and it was very public. I have a friend who still doesn't have his cable modem service back up. To me it is as stupid as standing on a train track for a week waiting for the train to come and hit you. What happened?

    --

    --I assume full responsibility for my actions, except the ones that are someone else's fault.

  27. refund for what ? by Archfeld · · Score: 2

    An uncontrollable net storm caused by a virus, or an idiot admins' decision to block port 80 on a whole segment vs pushing individual machines off
    as they were identified as infected. If you are looking for a refund for the FIRST you should sit down and be quiet, IF you are looking for a refund for the SECOND then I APPLAUD your efforts.

    --
    errr....umm...*whooosh* *whoosh* Is this thing on ?
  28. Re:More of the same by bendude · · Score: 2, Interesting

    When thinking about all these new "issues" that are arrising out of our new technologies, I usually try to find parallel proceedures in existing situations to use as a guide for working out the new problems.

    In this regard, I would look to a not-at-fault car accident, there are a lot of similarities.

    Imagine this: a car stops. The car behind it hits it and sends it carreering into the car in front.
    Now, if I'm in the middle car (the first one mentioned) the guy in the very front car, who was hit through no fault of his own, sues me. I, in turn, sue the car who hit me (who was at fault) and pass on the litigation from the front guy to the one who hit me (I was not at fault for either collision and the rear vehicle was for both.).

    Now lets bring this back home, Microsoft sell a product which has faults. Qwest buys said product from Microsoft and use that as a basis for their own product. I buy the Qwest product and use it to create my own product (say, a website). One day, Microsoft's product stops working. Qwest's product as a direct result, stops working. My product then stops working because of Quest's problems.

    My product cannot make me any money. I am running at a loss.

    I think it would be fair for me to turn around to my supplier and ask for compensation for lost earnings (at the hands of Quest's product), or at least refuse to pay for the portion of the service that was not delivered. Quest then have that option of passing on their costs to their supplier (should they be liable).

    On the other hand, I could just be being too simplistic.

    --


    Get the Hell off my planet, you slimy mobster Bush!
  29. If i had any mod points by Archfeld · · Score: 2

    I'd give them to ya.
    The parent makes several salient points about
    a pssible internet model.

    --
    errr....umm...*whooosh* *whoosh* Is this thing on ?
  30. Astound/Seren has a 24 hour by Archfeld · · Score: 2

    period limit. They will deduct the cost of any outage over 24 hours, otherwise you just stomach it.

    --
    errr....umm...*whooosh* *whoosh* Is this thing on ?
  31. Re:why not? NOT! it's "Who!" by Coolfish · · Score: 2

    The question shouldn't be "why not" it should be "who".

    Whose responsible for the lax security in the #1 email client?

    Who lets the idiot users that use their idiot software run attachments?

    I'll give ya a hint. They have plenty o' cash, and his name is Bill. Last name Gates. Works for Microsoft. In Redmond, Washington. He's friggen rich, dumbass! Sue that guy! now your damn ISP which is gonna go out of business anyway! Good grief!

  32. OMG you could just substitute PAC-BELL by Archfeld · · Score: 2

    for QWEST and EVERYONE of your statements would still be true. The ONLY thing PAC-BELL has going for them is DSL is a relatively stable, or it would be beyond them to handle at all.

    --
    errr....umm...*whooosh* *whoosh* Is this thing on ?
  33. DID they takew reasonable precautions ? by Archfeld · · Score: 2

    Did they provide reasonable protection for their customers ? I think they screwed the pooch badly,
    and are looking for anyway to blame someone, anyone else. There were very simple steps to remove ANY machine that was infected, rather than DO THE JOB they were getting PAYED FOR, they will blame someone else. If you offer a network, your clients have a right to assume YOU KNOW HOW TO RUN IT.

    --
    errr....umm...*whooosh* *whoosh* Is this thing on ?
  34. "it" happens by hyrdra · · Score: 2

    That's stupid to give refunds. It's not a network comapnies job to insure stupid users don't attack each other and bring down the network in the process. This is about liability -- you are ultimatly responsible for what your computer does. What do these people want a refund from? Their own foolishness?

    In some cases, there may be those whom had never actually had the bug, and had experienced a network outage because of the "other people.". This happens. Quest cannot control the weather from destorying a router station just as much as it can't control a virus. Downtimes are a fact of life, a network is dynamic. Shit happens.

    Avoid blaming at all, but at least when you need to, put blame where blame is deserved -- the Code Red virus. Don't sue the messenger.

    --


    "I'll just chip in a bit for RedHat: I actually have that installed on my university machine." - Linus, '95
    1. Re:"it" happens by hyrdra · · Score: 2

      I DID read the fscking article. The article never mentions an equipment failure related to negligence, it mentions they got hit heavily by Code Red. This isn't a service level default of the contract or about the network not meating performance specifications and thus not being able to handle Code Red. It happened to other networks as well.

      Which is why I assume you posted as Anonymous Coward?

      --


      "I'll just chip in a bit for RedHat: I actually have that installed on my university machine." - Linus, '95
  35. Freeway Guardrail Ping-Pong - An Analogy by BigBlockMopar · · Score: 3, Funny

    Quoting from article:

    Steve Larsen, who heads the attorney general's new Cyber consumer resource center, said in a message to Mangus: "It seems reasonable that a customer should not have to pay for service they can't get. If you can't watch your cable TV or your newspaper doesn't show up for days/weeks at a time, I assume you won't pay. I believe that is all your customers ask here regardless of fault."

    Scenario. Some idiot is driving a poorly-maintained car which was ill-conceived at the design stage. Maybe he didn't even know he was driving...

    A wheel breaks off and his car plays Guardrail Ping-Pong on the turnpike.

    The ensuing traffic jam shuts down the city's busiest artery, halting all commerce in the city. Your newspaper doesn't arrive as a result.

    Multiply that by many, many cars at the same time.

    Why don't we go after the bigger problem and charge the jackasses who designed perpetually failure-prone cars and the jackass owners who don't maintain them?

    Going after them instead of the local highway contractor seems like a better idea to me.

    Especially since these drivers have no excuse for not knowing how dangerous their flawed little cars are.

    --
    Fire and Meat. Yummy.
    1. Re:Freeway Guardrail Ping-Pong - An Analogy by alexburke · · Score: 2

      A wheel breaks off [...] The ensuing traffic jam shuts down the city's busiest artery, halting all commerce in the city.

      Oh c'mon, Lawrence. It was a tractor-trailer whose wheel broke off, and it was the 401. Anyone could'a guessed THAT... ;)

  36. Re:Qwest was negligent by Ungrounded+Lightning · · Score: 2

    Actually, with that version of the Cisco firmware the router would crash due to Code Red's probe packets even if the port was disabled.

    Could I see some evidence for this claim?


    I'm just quoting something I found on another site. Unfortunately, I was unable to find it again with about 10 minutes of web searching.

    Sorry. (If I run across it again I'll post a followup.)

    --
    Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
  37. Code Red and Cisco 675 by Alex+Belits · · Score: 4, Interesting

    My provider isn't "The Wicked Q of the West", but I ended up downloading Cisco 675 CBOS upgrade from their site. This is what happened.

    1. I have received announcements about Code Red in everything security-related that I was subscribed to, and as usual, ignored it because I don't use IIS, Windows and other garbage of that kind.

    2. Cisco 675 router that connects me to my providers (ISP is Megapath, line was Rhythms) started hanging in the most outrageous manner possible, being not accessible even from its serial console that I have attached to one of my Linux boxes through USB multiport serial converter. It was "outrageous" and not merely "bad" because same Linux box happened to have still-working Ricochet modem attached to another USB port, and I was able to reach it from work even when DSL was down, but couldn't reset DSL until I was physically at home.

    3. Later announcements mentioned Cisco routers as vulnerability, and recommended to disable web administration on the router as a workaround, and upgrade the firmware. Cisco page mentioned an upgrade but did not offer anything to download -- required to call their phone number or email them and beg for firmware update. Knowing that everybody who ever bought Cisco 6xx, plus a bunch of people who didn't know how their company's Catalyst differs from bitty box 675, will be trying to reach Cisco, I have chosen to do a workaround.

    4. I have disabled web administration, it stopped working, but router continued listening on the port 80. I assumed, it will just ignore all data that it receives, so a bug won't be triggered.

    5. Router still hangs. I have set a filter to block everything that comes from outside to the port 80 on the router. It looked like router stopped responding to this, so I was confident that I am not vulnerable to that thing anymore.

    6. Router still hangs. Apparently my mind was not advanced enough to comprehend the brokenness of CBOS -- broken code was receiving packets BEFORE THEY PASSED THE FILTERS.

    7. I have looked at the Cisco site to check if they got the idea, how many requests for copies of CBOS patches they are supposed to process and posted the binaries. Nothing -- the page still contained a phone number and email address, and since I was at home, I could be pretty sure that people who were supposed to answer at Cisco weren't at work either.

    As opposed to other Cisco products, CBOS has no optional pieces, and is useful for a single puprose of upgrading shitty 6xx boxes, so why they needed my phone call to make sure that I am indeed going to use their software to upgrade their router and not, say, print as a hex dump and smoke it, is still a mystery for me.

    8. While constantly resetting Cisco, I have started IRC, and asked some of my friends if they know, where to find those damn patches. After few minutes I have received some rather unflattering description of CBOS, Cisco and Intel (who happened to be the real authors of this shit), and the URL on Qwest site with CBOS images.

    9. CBOS images were distributed as Windows executables, with Windows upload program but no instructions -- probably following the logic that if a customer has his servers infected by a virus, running downloaded executables is the least of his concerns. Fortunately, Windows executable was a wrapped zip file, and upload procedure over a serial console was in the router's documentation.

    10. Router worked fine ever since, but it looks like it's still impossible to filter or completely disable web administration on it.

    ---

    Of course, this was that simple only because I had a full access ("exec" and "enable" passwords) to the router. I am afraid to think, how Qwest technicians would have to work if they had to upgrade customers' routers over the network while routers were being attacked, or to distribute passwords to the customers to make them able to run the updater program (I have never seen it running, I assume that it uploads updates either by xmodem over console or by TFTP -- in the first case only customer can enter the password, and in the second one _someone_ has to login to the router and still enter the password), so I kinda understand why Qwest couldn't do much in this situation. OTOH, Cisco could at least issue binary patches as a public-accessible download.

    --
    Contrary to the popular belief, there indeed is no God.
    1. Re:Code Red and Cisco 675 by Alex+Belits · · Score: 2

      You are still vulnerable at the port 81 -- despite the restriction.

      --
      Contrary to the popular belief, there indeed is no God.
  38. Re:Qwest was negligent by Alex+Belits · · Score: 2

    I have seen that. Disabling HTTP and filtering out TCP to port 80 at the router still did not fix the problem -- apparently listening at the HTTP port can't be disabled, and filters don't affect the broken piece of code.

    --
    Contrary to the popular belief, there indeed is no God.
  39. Re:Qwest was negligent by Alex+Belits · · Score: 2

    Great! ;-)

    The problem is, that leaves you behind NAT, and people with "business" DSL service have bunches of servers behind their routers.

    --
    Contrary to the popular belief, there indeed is no God.
  40. Re:Qwest was negligent by VB · · Score: 2

    NAT can be implemented trivially to each of the "business" ip's behind that router directly to the firewall which will route it appropriately.

    This isn't rocket science. NAT each of the public IP's to the same firewall machine and set up the rules to redirect to the private servers as appropriate. Done.

    BTW, this is a business network. I just threw out a simple rule for the 99.9% user. Tweaking it is like eating popcorn.

    --
    www.dedserius.com
    VB != VisualBasic
  41. Very bad by Frodo · · Score: 2

    My net connection when down too, and I don't run around demanding $5 back.

    Very bad that you do not. If you did, and everybode around did the same, probably the current sore state of the security would improve, some knowledgeable sysadmins would be hired and some holes would be plugged.

    As long as the users agree to get crappy service, crappy software and crappy security for their money, they will get crap. The only way to not get crap is to refuse to tolerate that anymore. So if somebody sues their ISP that neglected to provide them the required service and to maintain secuirty, it's a very good thing. If people are promised 24x7 connection and support and then when the problem comes they are said "well, it doesn't work, just wait and maybe it will be fixed in a day or two or more" - they have the right to demand compensation.

    --
    -- Si hoc legere scis nimium eruditionis habes.
  42. Road Runner should give refunds! by fmaxwell · · Score: 2
    According to my Road Runner's web page:


    "The Road Runner system has been designed to offer access to all the high speed services mentioned above, even assuming continuous, maximal usage by every Road Runner user in a neighborhood simultaneously.


    Since Road Runner is supposedly designed to be impossible to saturate, then they should refund money to those who had unusable connections -- especially since the vast majority of the Code Red traffic came from within their network. Of course, this is just another example of marketing hyperbole as many Road Runner franchises (including mine) are horrendously overloaded and subject to packet loss and high latency at peak usage times.


    The real point is that many networks were not taken down or even substantially slowed by Code Red. That makes it pretty clear that Code Red was not some all-powerful force capable of bringing the Internet to its knees. The networks that were rendered useless by it were the ones that had inadequate capapacity.

  43. Nice logic by Smack · · Score: 2

    "My connection didn't go down, therefore no one else's did."

  44. Qwests level of responsibility. by topham · · Score: 2
    Qwest shouldn't be held responsible for the worm, or it's direct actions.


    On the other hand, I believe they (along with others) had problems relating to bugs in the DSL modems. Bugs which they had a patch for but didn't inform their customers about immediatly. For that they are potentially responsible for.

  45. My Qwest experience... by dR.fuZZo · · Score: 2

    ...was a bit different than yours.

    I received the call (and the letter, for that matter) from Qwest about the Cisco/Code Red issues. I had already heard about it, but, I had a bit of a related DSL problem I had to ask them about. Oh no, the caller informed me, he couldn't help me with that. He gave me a phone number to call.

    Ok, says I, I'll just call them up right now and get this taken care of. I call, go through the system ... and am given another phone number to call.

    Well....this isn't so convenient, says I, but I'll give 'er a shot. I called up this second phone number and I'm told that all lines are busy now. They'll take my call as soon as they can. My estimated wait is... 60 minutes.

    Ok, I wasn't that desperate. So, I went to their website to request help through their online customer service form. They usually get back to people quite promptly, I'm informed.

    Five days later ... I get an email response saying that I'm going to have to call them to take care of this issue. Yeah...uhm...I guess I'll wait until I have a good hour or more free to sit on the phone... Right now, like you, I use Qwest for DSL and ISP service. When the change goes through to force people to MSN, I think I'm going to cancel my service.

    --
    -- dR.fuZZo
  46. I want my money back. by AugstWest · · Score: 2

    I use Charter Pipeline cable service, through Earthlink, and I lost access for 2 full weeks. They're overcharging for the service as it is, and during the outage they stopped answering their phones and never let *any* of their customers know what was going on, what was being done, and when it was going to be fixed.

    If I'm paying through the nose for a high speed connection, and it disappears for 2 solid weeks, you can bet that I want some money back. They're giving us all a free month of service now.

  47. Let me spell it out in small words then... by Archfeld · · Score: 2

    If it was an act of god, and they had no control then QWEST is not at fault. If on the other hand there was time and precautions were available for MOST PEOPLE, then QWEST is negligent and deserves to pay for that. I am not a qwest customer nor do I know all the details. PACBELL sent email out to anyone who showed PORT 80 activity nearly a week prior to the problem. There WAS NO SERVICE interuption for me, and it is WELL WITHIN my rights as a customer to run a web-server or anyother server. As to why the 'FUCK' they should care, can't help ya there bud.

    --
    errr....umm...*whooosh* *whoosh* Is this thing on ?
  48. So with this logic by interstellar_donkey · · Score: 2

    With this kind of logic, does this mean I can ask for a tax refund from the department of transportation because people keep ramming my car?

    --
    The Internet is generally stupid
  49. How was it down? by Sloppy · · Score: 2

    The article doesn't say how the service didn't work.

    Did Qwest actually shut down stuff, or was it just so clogged with traffic that it was effectively unusable? If the former, it's QWest's problem and people deserve a refund. If the latter, it's just Life.

    --
    As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
    1. Re:How was it down? by Rick+the+Red · · Score: 2
      Read this. It contains links to other articles that will answer your question.

      Basically, Code Red somehow affected USQwest's Cisco DSL modems, which all stopped working and had to be reset. That's how they lost service: the USQwest equipment located in the customer's premisis failed, and USQwest left it up to the customer to fix it. The sooner you figured out what was wrong, learned how to fix it, and successfully performed the repair, the sooner you were back on-line. Since the delay in fixing USQwest's equipment was entirely due to the cusomer's inaction, ignorance, and/or technical inexperience, USQwest feel they don't need to offer any refunds.


      And since the Explorer wouldn't have rolled over and killed Uncle Fred if he wasn't driving it, it's Uncle Fred's fault, not Firestone or Ford's. Ain't Republ^h^h^h^h^h^hCorporate Logic wonderful?

      --
      If all this should have a reason, we would be the last to know.
  50. Not the whole story by Rick+the+Red · · Score: 2
    The article referenced does not tell the whole story. Here are some stories that appeared recently in the Seattle Times and the Seattle P-I:

    Times:
    Qwest refuses refunds to DSL customers for Code Red outages
    Qwest falls short tackling Code Red worm, but other DSL customers appear to fare better
    'Code Red' wrigglings put users in knots

    PI:
    State pressing Qwest for refunds after 'Code Red II' DSL breakdowns
    Worm has Qwest DSL customers seeing red

    The real story is not in the articles about the State pressing USQwest for refunds, but the earlier ones describing how USQwest basically ignored the problem for as long as possible, then gave people like your Aunt Mildred complex instructions on how to patch their computers and DSL modems, which were broken by Code Red even though the affected customers were not running NT and ISS! Naturally, the Aunt Mildred's of the world had, shall we say, difficulty following the instructions, and if you didn't follow them exactly you only made it worse. It was USQwest's Cisco DSL modems that got hosed, not their customer's PCs, and the customers were first demanding that USQwest fix it and now are rightly demanding a refund for the DSL service they paid for and did not receive.

    As the excite.com article said, this is the same as not getting your newspaper or cable TV -- if a customer pays for a service they did not get, they deserve a refund. Unfortunately the outcome in this case will be less than optimal, because it won't result in USQwest leaving Washington State for good!

    --
    If all this should have a reason, we would be the last to know.
  51. Re:why not? NOT! it's "Who!" by Coolfish · · Score: 2

    Irregardless!

    Americans sue who they want, when they want, over the stupidest things, and it doesn't have to make sense! that's the beauty of the system!

  52. Re:More of the same by unitron · · Score: 2

    And the moral of your analogy is that those who deal with Microsoft and Qwest wind up getting it in the rear.

    --

    I see even classic Slashdot is now pretty much unusable on dial up anymore.