Subject: RE: THe Value Of Following Standards... (was Re: VIRUS WARNING)

From: Lillian Komlossy <[email-masked]>
Date: Thu, 4 May 2000 13:13:59 -0400

I don't know about deliberate inclusion of the security hole - it looks
more to me like "careless". Feels like it just "was not thought to be
a danger of any kind to security"... (Does the word TITANIC mean anything to
you?)

Lillian Komlossy                     
Site Manager                         
http://www.dmnews.com           
http://www.imarketingnews.com  
(212) 925-7300 ext. 232 

-----Original Message-----
From: Keith Moore [mailto:[email-masked]]
Sent: Thursday, May 04, 2000 11:58 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: THe Value Of Following Standards... (was Re: VIRUS WARNING)

> So if your e-mail software is opening it and feeding it to Visual Basic
> just because it's tagged .vbs even though it's a text/plain, you're
> violating the RFCs.

well there's nothing illegal about violating RFCs.

but it sure seems like the deliberate inclusion of a security hole in 
email software would be sufficient grounds for a class action lawsuit.

Keith

---

From: Lloyd Wood <[email-masked]>
Date: Thu, 4 May 2000 18:37:15 +0100 (BST)

> a danger of any kind to security"... (Does the word TITANIC mean anything to

They should have called it Marko Polo: the ship with the hole.

L.

a viral CFP would wrap all this up nicely.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: Keith Moore <[email-masked]>
Date: Thu, 04 May 2000 13:44:15 -0400

> a danger of any kind to security"... (Does the word TITANIC mean anything to

the builders of the titanic didn't know that certain kinds of steel 
become brittle at cold temperatures.  

otoh, the developers of this user agent knew, or should have known, 
the risks of executing code of unknown origin.  they have been 
understood for a long time.  they were discussed during development
of the MIME standard. the MIME specs have required content-types to 
document known security risks since the early 1990s. other email-borne
viruses have used similar mechanisms to this one to propagte themselves.

Keith

---

From: Austin Schutz <[email-masked]>
Date: Thu, 4 May 2000 12:51:20 -0700

> viruses have used similar mechanisms to this one to propagte themselves.
	So if the users would save the virus to disk and then run it,
what's the savings? If I send a naked_bunnies.exe file to a dirty joke
email list, some people are going to run it no matter what warnings are given
or whether or not it's zipped and uuencoded, whatever. If 20% of the people
receiving a virus propagate it rather than 50%, that's probably still good
enough to be significantly detrimental.
	You could have senders sign any executables. That might help a little,
as long as the sender's machine hasn't been compromised.

	Austin

---

From: Keith Moore <[email-masked]>
Date: Thu, 04 May 2000 17:11:32 -0400

> what's the savings? 

the virus doesn't propagate as quickly, nor to as many people,
before it is detected and countermeasures are put in place.
yes, this does make a significant difference.

> as long as the sender's machine hasn't been compromised.
 
this would also help, but we'd need a better way to verify the sender's 
signature than we have now.

Keith