Subject: RE: [Asrg] DCC and IP checksums

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 12 Mar 2003 11:19:00 -0800

I don't trust sandboxes either.

But I do trust signed code that has been thoroughly reviewed.

We would be talking about a few hundred lines of code here,
not tens of thousands.

		Phill

> -----Original Message-----
> From: David F. Skoll [mailto:[email-masked]]
> Sent: Tuesday, March 11, 2003 4:12 PM
> To: [email-masked]
> Subject: RE: [Asrg] DCC and IP checksums
> 
> 
> On Mon, 10 Mar 2003, Hallam-Baker, Phillip wrote:
> 
> > But consider what happens when you use mobile code to describe the
> > hash function.
> 
> Oh, yes, let's consider that.
> 
> You have enormous security violations all over the Internet.
> 
> "Mobile Code" is a non-starter from a security standpoint.  I 
> don't trust
> sandboxes, and I don't think most SMTP server owners do either.
> 
> > This is how satelite TV companies keep card piracy at 
> acceptable levels.
> > PThey don't shut off a pirate card immediately, they let a number
> > of customers develop then they kill it when doing so does maximum
> > damage to the pirate's reputation.
> 
> They have a closed system and can trust their own mobile code.
> 
> > The apamware companies have a big problem that script 
> writers do not,
> > they want to make money from their code. So it takes them 
> much longer
> > to react than the opposition.
> 
> From my observations, a lot of simple anti-spam tricks that worked a
> year ago (and are even widely-known, e.g., as part of 
> SpamAssassin), still
> work pretty well.  So I think you have a point about the 
> reaction time.
> 
> --
> David.
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 12 Mar 2003 14:36:45 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> But I do trust signed code that has been thoroughly reviewed.

If you don't trust sandboxes, then you are crazy to follow the
Microsoft ActiveX fraudulent nonsense of confounding authentication
with authorization.  That someone at a big company has signed some
code does not imply anything about how well it has been reviewed.
Bugs happen, and you can never know for certain that a VP has told
a chain of pointed hair bosses to stop delaying and SHIP IT!
Besides, how do you trust that the goals of any reviewing had
anything to do with your goals or even your well being?

Let's consider some of the attacks that might be done with distributed
filtering code.  If the sandbox does not exist or allows the code to
modify passing mail, then your entire system is wide open.  Naughty
filters could add viruses and worms to passing mail.

If the sandbox does not allow changes to passing mail by the filter,
then a filter from Microsoft could cause a random 70% of mail from
AOL to be rejected, and be labelled a bug much like Microsoft's so
called bug caused alternatives to Windows to fail.
See http://www.oreillynet.com/pub/a/network/2000/02/07/schulman.html
and http://www.google.com/search?q=microsoft+drdos

> We would be talking about a few hundred lines of code here,

The checksums computed for the DCC involve fewer than tens of thousands
of lines of code but strech a few hundred.  My first checksums half
a dozen years ago did almost exactly what one person proposed in this
list.  However such simple tactics have not been effective for years.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 12 Mar 2003 20:38:42 -0500 (EST)

> But I do trust signed code that has been thoroughly reviewed.

I do not, necessarily.

Signed code is not really more secure than unsigned code, because it
only takes one piece of buggy signed code to open up an exploit.

The problem with PKI is that revocation is not very scalable or
reliable, so old, buggy signed code continues to do damage for a long
time.

> We would be talking about a few hundred lines of code here,

Nevertheless, I would still not trust it, and I doubt many other
administrators would either.