Subject: Re: Denial of Service by Spamware?

From: Vernon Schryver <[email-masked]>
Date: Thu, 28 Dec 2000 20:20:27 -0700 (MST)

> From: "Christopher Ambler" <[email-masked]>
> To: <[email-masked]>

> X-Mailer: Microsoft Outlook Express 5.50.4522.1200

> > Although I know it's hopeless, I still say the right thing is for the
> > IETF to automatically unsubscribe anyone whose mail bears the tell tail
> > "X-Mailer: Internet Mail Service".   
> > By tolerating the malware and being "inclusive" of those who insist on
> > abusing the rest of us with it, the IETF is sanctioning it.
>
> I use Exchange, and it works fine for me. I have no settings that would
> cause it to send out anything like what you've seen. If you rig it such
> that my choice of mail software, which has done no harm to you,
> causes my de-subscription to this list, you have discriminated against
> my choice. Hardly fair.

Notice that I did not say "Microsoft" or "Exchange" because I have no
certain knowledge that Microsoft is the perpetrator of "Internet Mail
Service."  Since I'm at pains to delete trojan horses and other security
problems whenever I find them, I don't know whether Exchange is related
to "Internet Mail Service."  I have noticed statements in this list to
that effect from other people.

I'll assume you know far more about "Internet Mail Service" than I (which
would be easy) and that your "Microsoft Outlook Express 5.50.4522.1200"
is sufficiently similar to "Internet Mail Service" that will now flood
you.  That you have not enabled the abuse floodgates for your particular
installation of the garbage is irrelevant.

> If there's a specific technical gripe you have, say so. If it's a violation
> of any RFC, I'd be pleased to personally call it to the attention of
> someone in Exchange who can look at it. ...

It has been said explicitly and repeatedly over the years in this mailing
list, including twice within the week.

> If, on the other hand, you have a problem with a particular 
> person's misconfiguration, or addition of 3rd party software (like
> virus scanners) that are spewing garbage, why not take it up
> with them.

Given the duration and frequency of vacation notice abuse from
users of "Internet Mail Service," the fault is in the software
instead of those who configure it.

There is no excuse for the vulnerability to the viruses that afflict
Microsoft software and that cause people to buy other malware such
as the Antigen garbage that recently flooded us--assuming that
Antigen is not a Microsoft product.

> Please do let me know if I'm missing something, other than
> religious aversions to Microsoft.

You're missing the long well known abusive behavior of the "Internet
Mail Service" in sending vacation notices.

Anyone dumb enough to use "Internet Mail Service" should consider that
they're announcing their absence to complete strangers all over the world,
including not only IETF participants but also random spammers.

You're also missing some of the rational reasons behind aversions to
Microsoft software.  Microsoft has a long history of egregious
embracing-and-extending of standards.  I could list several examples of
major crimes in PPP, but will desist.  Personally, I think the reasons
are almost always incompetence and an inability to read any RFC instead
of evil intent, but motives for crimes matter mostly during sentencing.

Decades ago people made fun of the canonical IBM blue suit that
was so provincial as to be unable to imagine that anything might
exist outside Amorak.  Those guys had nothing on people in the
Redmond area.  In other words, it would doubtless come as a surprise
to people near Redmond if they would (and could) look outside and
discover that there are are reasons why the almost 20 year old
open-source BSD vacation program did some of the things it does.

Vernon Schryver    [email-masked]

---

From: "Christopher Ambler" <[email-masked]>
Date: Thu, 28 Dec 2000 22:50:53 -0800

> instead of those who configure it.

This is what I mean. You're singling out one product. I just got
a bunch of vacation notices. Quite a few looked like this one,
below. Looks like Lotus Notes to me.

The vacation notices that I send out are configured, using
Exchange, to not send to mailing lists. Anyone can do this.

Even Lotus Notes users...

From: [email-masked]
Subject: Cynthia Mamacos/CAM/Lotus is out of the office.
To: "Christopher Ambler" <[email-masked]>
Date: Fri, 29 Dec 2000 01:03:06 -0500