Slashdot Mirror
Virus Cost Estimate For 2001 Tops $10 Billion
Snootch writes: "CNN has a story on the costs of virii - they're absolutely collossal, and remember that the $10 billion figure is just *so far this year*...scary. The article gives a pretty good breakdown by virus, and while it says little else that the average /. reader won't know by now, it's an interesting read all the same. To quote Red Dwarf's Kryten, 'Smug Mode,' but I note that every single one mentioned in the article, bar one (Code Red), was a client-side Outlook virus ..."
"My other thought was this: Considering that according to the article, nearly half the money was spent cleaning infected systems out, then the virus-checker industry, and therefore the implications of Symantec's recent patent, are even bigger than I realised ... *gulp*" Of course, estimates like these are often made by people with vested interests in the effect such numbers have, and there are a lot of costs that are very tough to estimate accurately -- like sysadmin time.
I work in the Network Operations Center at one type of mission critical facility and most of our servers are Linux and Unix variants while these were fine we were still hit w/ code red (all the win2k desktops) bogged down everything our DNS servers were getting around 10,000 hits/hr (a lot for our internal servers) and all the extra traffic (probing for other IIS boxes) brought stuff down cause nothing could communicate over the network for about 12 min we pulled the plug on router that connects everything to the servers so that the servers could still communicate that started patching machines we lost about 12 min of productivity and another day of patching desktops. Luckily it happened around 8:00PM right as I was getting ready to leave so I was right they to pull the plug to separate the networks and than we called people in and started patching the win2k boxes
This must be Thursday, I never could get the hang of Thursdays.
Considering Code Red's favorite food, that's pretty much a clean sweep for Microsoft, isn't it?
I guess they do bring something to the total user experience that you can't get from anyone else.
Gotta run. A whole bunch of people hae sent me files they need my advice on.
I see even classic Slashdot is now pretty much unusable on dial up anymore.
I'm not saying that MS should be ponying up billions for Outlook's defects (esp. since estimates of the value of "lost time" always seem to be generous; witness the costs of "being stuck in traffic" as being huge) but if there is some desire to reduce the widespread incidence of viruses, then there should be some mechanism, prefereably financial, for encouraging people not to create and sell vulnerable products.
It's psychosomatic. You need a lobotomy. I'll get a saw.
Lost productivity includes time spent by system users and support and helpdesk staff on virus issues that takes them away from their regular responsibilities
This sentence should read "arbitrary figure made up to inflate costs of viruses". What the hell are "regular responsibilities" if they don't include helping users get rid of viruses. We all know that viruses are annoying, cost a little bit of money, etc etc - but even if each and every computer ever affected by a virus this year was attended by a tech charging 50 bucks an hour (and who needs an hour to get rid of sircam?!), we're looking at a 3 billion dollar bill. Not 10 billion.
It's yet another hype article. Bring in a story queue which we can moderate, like Kuro5hin, because the newsworthy to nonsense ratio is worsening all the time.
btw, the plural of viruses is... well, I just wrote it. Look at the latin root of "virus" and you'll understand. Or just google for "virii" (34k hits) vs "viruses" (1.4m hits). Nuff said.
the foot-and-mouth disease [satirewire.com]
My feeling is that most of these are Microsoft-based worms because that is the most popular platform. (And perhaps the users are less concerned about computers than we are.) There have been plenty of exploitable holes in pine, for instance; it's just that not enough people use the same version of pine for a successful worm to be built around it.
I think perhaps this is an argument for diversity more than it is an argument against Microsoft.
Here's the original report that CNN qouted, from computer economics
I have to say, I agree with the point about vested interests (and yes, this company has good reason to exagerate the claims). At least they are being honest about giving estimates - how many times have we heard about court cases where the prosecution charged a hacker with exactly $1,764,726,818.76 worth of damage [well, er, none actually - but you get the point!]?
Yes, $10 bill sounds like alot. However, this is from the same company:
Migraine headaches cost American businesses between $5.6 and $17.2 billion in lost work productivity a year...
I'm inclined to believe that the figure of $10 billion is little more than a wild guess. But since we're spending time trying to put a price on lost time and data, I have a different question along the same general lines:
Disregarding viral infections, how much money does American business lose annually to Windows crashing?
Schwab
Editor, A1-AAA AmeriCaptions
I'm not going to say viruses don't cost money....
But I have little faith on the 'loss valuations' put forth like this.
If I have to disinfect all 50 computers in here over the course of a year, I'm not going to claim my company 'lost' any money, even though my time IS worth money. I would have been here, and been paid, regardless of the virus being here or not.
The same goes for cost valuations done because of website defacements 'cracking' etc.... they are rarely rooted in reality, but instead rooted in a numbers game to make it seem worse than it is.
Would you have been at work, and paid for your hour whether or not you had to deal with Sircam? And did that hour cause the company to pay you overtime, or any other payment they would not otherwise have paid?
Geez, you would think that on /. people would know that Sircam was not Outlook specific. I had a friend (who is rather computer illiterate) who doesn't even use outlook and stilll managed to spread the virus. Sircam doesnt just use the outlook address book for viruses, it looks through your temporary internet files for anything it seems like an email address (this is the reason why Tacoboy would whine like a sissyboy about the gigs of email he was gettign from sircam). Sircam require outlook to propogate, it had its own internal SMTp engine. Sircam was not outlook specific, merely windows specific. And i am sure that it would be really easy to make a port to linux (but i could be mistaken since i know jackshit about programming or unix). The true innovation of the sircam virus was its social engineering aspect. People are always curious to open documents, even if they know that it wasnt meant to be sent to them.
Hello? SirCam? It's an executable. It's mentioned in the article. It's a Windows executable, but it will happily infect people running Eudora on Windows, supposing of course that they are dumb.
It is another victory for the guys at Redmond, of course.
my old sig used to be funny, but then slashcode ate it and now it's not funny anymore
What looks better to Joe Consumer:
1. "New and Improved Security makes sure that port scanners are unlikely to determine services running on your system, thereby helping the internet work faster for most people"
or
2. "Fancy new Paperclip tells you funny jokes!"
The second will get them more sales a lot faster than the first.
I demand a million helicopters and a DOLLAR!
I just want to say that this really boils down to MS Outlook's rediculous security model. I have been using Windows since Win95 and DOS before hand, I've NEVER installed a virus shield as I hate TSR's, and I've NEVER gotten one of these silly virus's. I've also NEVER installed Outlook on my machine. MS should be ashamed of itself, but at the same time, to say that Windows == Easy Virii Breading Ground is unfounded.
There is no longer anything that can be done with computers that is nontrivial and clearly legal. -- Paul Phillips
...have one reason and one reason only. Those in the appropriate industries like to have a lot of attention to these overblown cost estimates, so that the next time they're lobbying Congress for some law that will hand over more and more power over individual conputer users to "responsible" corporations, Congress will see the huge cost of not passing the legislation, and bang, we've got the next DMCA, or individual-restricting "internet security" law, or whatever.
I agree that viruses cost money. Time, productivity, equipment, and work is all lost when a virus hits your system. There are real losses. But these gigantic estimates that keep coming up -- Bullshit. They're estimates made by pegging every conceivable factor to one end of the scale. Have a security person on staff? Estimate that 100% of the cost of keeping that person on staff is due to "viruses," and add it into your cost estimate. Hell, I'm sure that they add in 100% of the time employees spend by the water cooler during a virus infection. "They can't work because there's a virus on their computer!" Of course, this assumes that when there is no virus, employees spend 0 time by the water cooler.
These estimates are probably less bullshit than the estimates that the RIAA, MPAA, BSA, and AAP come up with due to losses from piracy. I saw one in the paper, where you would have to assume that every illegal MP3 downloaded from the internet would have to then be passed on to 10 other people who would have definitely bought the CD, but did not because they received the free MP3. Obviously, a completely bullshit estimate, but there it is, Congress sees it, and no responsible person can then argue that we don't need laws to stop this economic hemorrhaging.
Note: I have no actual evidence to back up my conspiracy theory. But I do believe beyond a doubt that the cost estimates we read for these things are hugely overblown, and you do have to admit that such overestimating such cost estimates could potentially benefit those trying to provide positive spin for DMCA-like corporate-graft legislation.
-Rob
The correct plural for virus is either viri or viruses. Viruses is the English way to form the plural, and viri is the Latin way of doing it. Personally, I prefer the Latin way since it sounds more elegant.
vymths.com typically has debunkings of numbers like this.
It's definitely recommended reading for any geek. The introductory section is here.
I don't buy these numbers. These exorbitant figures are created from generous estimates of downtime, repair costs, and so forth. In addition, they take into consideration elements only tangentially related; I think that anybody with their Michael Shermer hat on can tell that a more serious inquiry than this is required.
(But, then again, this would be good fodder for anti-Microsoft arguments. Now how ethically responsible would that be?)
Including patching or AV software costs is rather dubious -- OSes need maintenance and their bugs/vulnerabilities fixed.
These damage numbers are like the damages claimed in the "Hacker Crackdown" - somebody cracks into the phone company, copies one document, and gets nabbed for 'damages' to the tune of $80,000 - it later turns out that that figure included:
1. A technical writer had been hired to research and write the E911 Document. 200 hours of work, at $35 an hour, cost : $7,000. A Project Manager had overseen the technical writer. 200 hours, at $31 an hour, made: $6,200.
2. A week of typing had cost $721 dollars. A week of formatting had cost $721. A week of graphics formatting had cost $742.
3. Two days of editing cost $367. `
4. A box of order labels cost five dollars.
5. Preparing a purchase order for the Document, including typing and the obtaining of an authorizing signature from within the BellSouth bureaucracy, cost $129.
6. Printing cost $313. Mailing the Document to fifty people took fifty hours by a clerk, and cost $858.
7. Placing the Document in an index took two clerks an hour each, totalling $43.
Bureaucratic overhead alone, therefore, was alleged to have cost a whopping $17,099. According to Mr. Megahee, the typing of a twelve- page document had taken a full week. Writing it had taken five weeks, including an overseer who apparently did nothing else but watch the author for five weeks. Editing twelve pages had taken two days. Printing and mailing an electronic document (which was already available on the Southern Bell Data Network to any telco employee who needed it), had cost over a thousand dollars.
But this was just the beginning. There were also the hardware expenses. Eight hundred fifty dollars for a VT220 computer monitor. Thirty-one thousand dollars for a sophisticated VAXstation II computer. Six thousand dollars for a computer printer. Twenty-two thousand dollars for a copy of "Interleaf" software. Two thousand five hundred dollars for VMS software. All this to create the twelve-page Document.
So using the same rule, you can see these adjusters running around asking, "Was this PC infected by a virus last year?", "yes", "Ok, that's one $2000 PC and one $100 Outlook License, plus one hour labor, lets see, that comes to $2220 lost productivity, NEXT!".
try { do() || do_not(); } catch (JediException err) { yoda(err); }
Why is it that nobody seems to recall that right after Lovebug, /all/ the newspapers happily printed articles (presumably swallowed verbatim from MS) hailing the fact that Microsoft was improving Outlook and Outlook Express so as to prevent this happening again. What did they do? Hardwire it not to arbitrarily execute code in emails with 'I love you' in?!?!? And much more importantly, why did the entirely of the media fall for it? An 'everything's just dandy' mentality?
It's rather interesting watching slashbots make smug comments about "Microsoft worms" and "Outlook viruses" when the two most damaging worms that have occured this year could have appeared on any platform.
Code Red
The Code Red worm is a typical worm that exploits a buffer overflow just like the Morris Internet Worm and the Ramen worm before it. Either of the aformentioned worms could have done what code red did once they had 0wn3d the boxen, they just happened not to.
Heck, I've toyed with writing a proof of concept *nix verison of Code Red using wu-ftp vulnerabilities, rpc.statd vulnerabilities, telnetd vulnerabilities, sendmail vulnerabilities and even BIND vulnerabilities. Of course, I haven't gone much further than deciding what exploits to use and glancing at some source since I'm busy with school at the moment and more importantly I don't want to go to jail.
Sircam
The Sircam worm spread either through social engineering or across unprotected network shares. Neither of these requires Outlook. It didn't grab addresses out of the address book and instead grabbed them from the user's web cache. Sircam also didn't use the client mailer to mail itself out but instead included it's own mail program.
Thus all Sircam needed to spread was clueless users. This only thing Microsoft-y about this worm is that it ran on Windows.
All the above said, it is truly sad that on almost all popular platforms we are stil dealing with a 30 year old security problem whose causes and solutions have been known from probably before a sizable number of the slashdot population was born.
"I believe it must be true so I'll post it to slashdot even though I have no idea what the truth of the matter is"
NASA has for many years been failing to deploy desktop security from a Canadian company called Entrust. That means that their security infrastructure has to be running on W2K machines 'cos thats all Entrust support.
I find it interesting that the company I work for strips out Sircam virus using a plug in to their Exchange server while the MIT AI lab where I have a courtesy account still hasn't put a patch into their sendmail running on Slowlaris.
I still get about 200 Sircam messages a day on my AI account. Not a problem if I have a high bandwidth connection but my account is now unusable from a dialup modem.
The reason that most viruses attack Outlook is that it is much easier to access the outlook address book with a couple of lines of VB script than to parse the headers in the mail spool.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
I have a feeling NASA doesn't use outlook for email, or run unpatched systems, even if they did use IIS.
I dunno if NASA runs IIS, but I do hear that they run ISS.
-Rob
btw, the plural of viruses is... well, I just wrote it. Look at the latin root of "virus" and you'll understand. Or just google for "virii" (34k hits) vs "viruses" (1.4m hits). Nuff said.
I'm not going to argue whether or not you're correct, but the way in which you've proven your correctness is pretty lame. All you've shown is which form is more popular, not more correct.
There's this saying you might have heard, "The masses are asses."
"And like that
I work for a small R&D firm. My time is worth more to the company than my salary. Why? When I'm working on a contract, there's this little concept called overhead. For every dollar that I'm paid out of the contract, about two dollars from the contract are placed in the company overhead account. This provides the operating budget for the business. It pays the lights, rent, phones, secretaries, etc., but it doesn't pay my normal salary.
When I have to change hats to clean up after a virus, I'm being paid out of the overhead account. It's not billable time. When I'm not working on contract, it costs the company more money than just my salary. For every dollar that I earned cleaning up after SirCam, there was one dollar deleted from the overhead budget and two dollars that were not "earned" by overhead. In other words, for every dollar that I was paid to clean up after SirCam, the company lost three dollars from the operating/overhead budget--one dollar for my salary and two dollars in lost revenues. The contract dollars are still there, but my time is gone forever.
So just because I was already being paid, doesn't mean that it didn't cost the company money. It cost them a great deal. In the end, we figured that SirCam cost us about $2500, which is probably on the high end of the distribution. (We have a lot of unattended, networked computers scattered throughout the labs. Despite my repeated complaints, some of the researchers and graduate students still did not have anti-virus software on these computers. "But I never read email on that computer!" Half a dozen of them turned out to be infected with SirCam.)
If you accept the figure of $2500 dollars for our company, then it only requires 4000 similar infections to total $10 million in lost revenue. There were probably far more than 4000 infections. Is the number $10 Billion inflated? Probably, but it still cost a tremendous amount of money to fight SirCam.
I hate these so called 'reports' that don't even care to share their methodology for determining costs. I mean, it said that clean up costs include "x, y, z" and lost productivity inlcludes "a, b, c".... but what exactly was included, who did they interview and how did they come up with number of companies affected?? Also, does this include the cost of protecting computer systems (eg, with antivirus software) that don't get infected?
===> An eye for an eye makes everyone blind - MG
First of all, I would like to know how these news stories keep coming up with monetary figures to represent mostly intangible concepts. Sure, there's a scientific way to go about it, but I know that I wasn't surveyed, so the results of such a process are at least flawed.
Secondly, I have three distinct and conflicting views about virii. Mostly, I find them a nuisance and a pain in the ass to deal with. I also find them entertaining. It's like a great big joke, we get to watch M$ hang its ass in the wind - and we get to see M$'s fervent supporters run around like headless chickens for a while. I also find virii to be a necessary part of our daily electronic lives.
That being said, the reason I find this article (and others like it) so disturbing is because we are seemingly paving the way for a whole new onslaught of legislation against computer virii. Let's be realistic: virii do -for free- what an entire industry fails to do with regularity - identify security holes. Almost 100% of the time, these holes are found in M$ products, which we all know are used by virtually every person in the online world. If virus writers didn't exploit these holes for their own entertainment, it would be much, much easier for malicious people to exploit these holes for their own gain and/or to the serious detriment of the victim.
Based on that, the only news in this article is found between the lines.
main(){char I,l,O[]={'-',1-1,0,(1<<5)-1,0+'-',-10-1,-10,11-0,
Even more ridiculously I am forced to do engineering work on a 64 MB Win 98 machine. When I tried to at least get more memory for the machine I was told that I didn't qualify: Engineers were considered in the same category as secretaries as far as their computer usage.
If it weren't for the (personally owned) Linux box I keep on my desk I couldn't get much useful work done.
The people who do the actual work at NASA are the sharpest group of people I've ever had the pleasure of working around - but like most places the upper management has more than its fair share of 'clueless techno ignorants' making decisions.
At least our computers are behind a firewall - so they don't get hacked all the time - but there are enough technically unsophisticated people (managers, secretaries etc.) on computers that viruses remain a problem.
All of these articles that I have been reading lately discuss Code Red and Code Red II in the past tense. Its still out there folks and its still attacking systems. I just ran a scan of my log file for one of my systems and the following IPs attempted to attack the webserver (which is running Linux/Apache and doing just fine):
216.175.70.25 which attacked at 31/Aug/2001:04:16:29 PST
61.129.37.165 which attacked at 31/Aug/2001:10:47:55 PST
216.254.153.209 which attacked at 31/Aug/2001:13:58:40 PST
62.110.109.5 which attacked at 31/Aug/2001:14:01:40 PST
216.75.67.200 which attacked at 31/Aug/2001:14:25:52 PST
216.210.235.68 which attacked at 31/Aug/2001:14:32:04 PST
216.254.2.43 which attacked at 31/Aug/2001:19:13:21 PST
195.128.198.2 which attacked at 31/Aug/2001:20:40:38 PST
200.204.61.28 which attacked at 31/Aug/2001:21:09:45 PST
ip244.54.136.216.in-addr.arpa which attacked at 31/Aug/2001:22:30:24 PST
209.88.144.24 which attacked at 31/Aug/2001:22:52:19 PST
209.88.144.24 which attacked at 31/Aug/2001:22:53:36 PST
216.72.50.157 which attacked at 31/Aug/2001:22:54:32 PST
61.175.90.219 which attacked at 01/Sep/2001:01:18:38 PST
24.176.223.88 which attacked at 01/Sep/2001:01:25:49 PST
216.224.75.34 which attacked at 01/Sep/2001:01:49:07 PST
212.38.187.178 which attacked at 01/Sep/2001:02:45:22 PST
Now the number of attacks goes down on the weekenend and up during the week, which suggests that most of these addresses (if not all of them) are simply DHCP desktop boxes run by morons who are too stupid to download and install a patch that has been widely mentioned in the news. But the fact remains that this worm is out there and active on a ton of systems and should *not* be spoken of in the past tense.
Just my 0.45 Cents Canadian...
"The first time I got drunk, I got married. The second time I bought a chimpanzee, after that I stayed sober" Arian Seid
I think that virii cost more in terms of the hype they create. I spent more time explaning to my mom and friends that code red would not melt their harddrive and that they were free and clear.
:)
The time lost is real. I must have spent at least 16 work hours patching, researching and explaning to others in the office who "needed" to know. Thats about 500 dollars of lost money for my company.
Anyhow, check out my homepage for a graph of the code red hits my web server has taken
Jeremy
If our admin's hadn't spent 2-12 man weeks dealing with MS related security upgrades and crap over the past year, they might have gotten a VPN up and running, which would have meant the 120 odd employees could have put in a dozen or so extra hours of work from home, and those that dialed in without the VPN would have been able to use the VPN and work more effectively.
Lessee, 120 employees times 20 hours over the past year times $60 CDN per hour per employee, that's $144,000 just for the medium sized IT shop I work at.
Of course that's mostly opportunity cost. Not too much of it would have been billed directly to clients, but we would have produced better software with fewer bugs and more features. (Not to downplay the term opportunity cost, it is valid to worry about such things...)
Comment removed based on user account deletion
"Viruses" is correct, "virii" is not. Look it up in a dictionary if you don't believe me: http://www.dictionary.com/cgi-bin/dict.pl?term=vir us
Whom is a direct object. "To whom" is correct, "to who" is not.
In the same manner, saying "between you and I" is incorrect; "between you and me" is correct.
You'd never say "Give that to I," now would you?
Honestly, people, correct grammar is neither difficult nor time consuming. Hell, I went to a US High School and all this was taught in English class. What the hell is your excuse?
It doesn't mean much now, it's built for the future.
My company network was unusable for 2 days, preventing my team from accessing development and Notes servers we needed to do our job. For several days after the initial outbreak was contained, the network ran dog slow. Some deadlines were missed because of it. Productivity lost for my team alone easily ran six to eight thousand dollars.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Not it hasn't been. I've been saying this all along to people I know. The recent trends of anti-virus software vendors starting to charge a subscription fee to get signature updates has done nothing but solidify my argument. A few years ago companies that charged money for the antivirus software itself were really the exception... now we are seeing the reverse. Does anyone know of any virus scanning software that is free?
This page explains in great detail why not:
http://language.perl.com/misc/virus.html
Additional support:
http://www.dictionary.com/cgi-bin/dict.pl?term=vir us
A search on Google for "viruses" turns up 1,480,000 hits.
A search on Google for "virii" turns up 38,200 hits.
Any technical literature written by professionals will NEVER EVER USE THE WORD VIRII! IT'S NOT A REAL WORD! The plural of "virus" is "viruses"!
http://www.mcafee.com - on the FRONT PAGE the word "viruses" is printed several times. "Virii" is not.
http://www.centralcommand.com - same deal.
I'm going to keep posting this on every virus story that comes up until everyone gets the damn hint!
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
I won't be a judge of whether the $10 Billion is an accurate figure. Consider what wold happen if damages was awarded to MS victims? (excluding punitive damages):
Some Microsoft figures:
Annual Sales: $25 billion
Annual earnings before taxes: $11 billion
Profit: 7.7 Billion
This shows us that MS contributed approximately 0 dollars to the economy. That's what I call a well put together scam. If punitive damages were awarded, MS would soon be history, and Billy Boy would move from his mansion to some shelter.
While the lottery is a tax on the mathematically challenged, MS is a tax on the computer illiterati.
-- Another senseless waste of fine bytes.
So, you acutally lost revenue by not working for 3 hours? The project you were working on actualy was delayed 3 hours and this actually cost money?
If you are contracted out to others, and in this case, had to be retained that valuable time to clean up from Sircam, fine, that's a valid point.
Most places, though, have IT staff who are there to do such things.
I believe in it too; but I also believe in intent.
If I *know* that my actions are going to hurt your system, and I do them, then it doesn't matter *how* I did what I did; I should be guilty.
Simply writing a virus? No. Shoudln't be illegal.
Sending it out to a spam list in order that people will run it? Your intent is obvious. You wasted people's time and money ON PURPOSE. You knew the effect of what you were doing.
Exactly. The latest Microsoft Internet Explorer "service pack" DISABLED another company's software (QuickTime). This kind of sneakiness makes upgrading impossible for the average user. You must be technically knowledgeable and well-informed to defend yourself against this kind of behavior.
Bush's education improvements were
Prevention is social, and difficult to coordinate. Even our most technical users still stupidly opened up ILOVEYOU.
There is innoculation in the form of patches and anti-virus. If kept up to date you will see very little damage from these problems.
Windows users can run a fake java-based webserver called Code Red Vigilante that uses the exploit to inform infected users that they've got it.
There's a apache script that works a lot like this, someone care to post the link?
At no point in this process does it rely on anything in Outlook that can be really called an "exploit", like a buffer overflow bug. Outlook itself is the exploit. The worm doesn't need to do anything that Microsoft hadn't planned for people to be able to do. There is only one step in this process that relies on human frailty. The rest of it is simple API calls to functionality that Bill and Co. decided to make available to executable email attachments. Outlook (anything that uses Microsoft's "Windows Scripting Host") is excellently designed to host worms and provide services to them as they infect a network.
Windows does give you a warning when you are about to open something that has executable content in it (HTML with JavaScript, Excel documents with VBA scripts, etc.). Microsoft has seen fit to cram executable content into so many different file types that every single attachment you ever open from anybody gives you this warning. It's like the boy who cried wolf. But this is the extent to Microsoft's approach to security. It doesn't stretch much further than the "hey, do you want me to run this?" dialog box (if they even give you that). They just don't take security seriously at all.
Now Microsoft is not full of stupid people. The decision to include executable content in emails must have raised alarm bells concerning security. They must have realized the vulnerable state they were putting everyone in. And how did they handle it? By reprogramming their OS and application suites to properly implement security and handle code from unknown sources with the appropriate level of caution? No, that would be too much work, and then people might complain that the security was getting in their way. So this is how they handle it: they put in a dozen lines of code that show you that little ubiquitous dialog box (unless you've checked "never show this dialog box again" on it before), and they extract a boolean from your confused and sorry ass. Then they branch there. If anything bad happens now, it's your fault.
All of this probably sounds very complicated if you don't know Latin or another inflected language but it actually isn't that hard. There are just a lot of fancy names for things.
I am usually in favor of using Latin plurals for Latin words (and Greek plurals for Greek words, and Italian plurals for Italian words, and German plurals for German words, and so on), but in this case, by pluralizing it correctly you risk confusing too many people. Just use viruses. However, if you are translating an English document that contains the word "viruses" (I can't imagine why you would do that though), translate it as "vira".
My only political goal is to see to it that no political party achieves its goals.
Are you sure that mine was the post to which you meant to reply? I ask because I didn't use any version of the plural of virus in it. Even the quote only contained the singular.
I see even classic Slashdot is now pretty much unusable on dial up anymore.
So the correct plural of virus is slimes? :-)
I see even classic Slashdot is now pretty much unusable on dial up anymore.
That's true. And they have. You've mentioned the Ramen worm (which was actually more complex than Code Red - taking advantage of 3 exploits). There was li0n. And sadmind (spreading accross Solaris machines, then defacing IIS sites).
They're out there. There are plenty of Linux and Solaris servers to populate. Where's the big outcry and doom stories accompanying all the horrid damage done by these worms?
There are a few possible things happening here. Its possible these systems are better administered - set up and actively administered by knowledgable administrators. Its possible that these machines aren't deployed with everything possible running. Its also possible that these platforms are simply easier to secure and patch.
In any case, the smuggness isn't entirely out of place.
More like they keep "innovating" security problems that allow "innovation" of new worms and viruses, although I wouldn't be surprised if they did manage to come up with an original way to make their products vulnerable.
I see even classic Slashdot is now pretty much unusable on dial up anymore.