Subject: Re: Denial of Service by Spamware?

From: Vernon Schryver <[email-masked]>
Date: Fri, 29 Dec 2000 00:30:27 -0700 (MST)

> From: "Christopher Ambler" <[email-masked]>

> > Given the duration and frequency of vacation notice abuse from
> > users of "Internet Mail Service," the fault is in the software
> > instead of those who configure it.
>
> This is what I mean. You're singling out one product. I just got
> a bunch of vacation notices. Quite a few looked like this one,
> below. Looks like Lotus Notes to me.

Exactly how many is "quite a few" that looked like Lotus Notes?
My records show only [email-masked] and
[email-masked]  
My previous example of Lotus Notes vacation notice abuse was on July 24.

Of the notices you've recently received, who besides Cynthia_Mamacos,
[email-masked], and [email-masked] are not using
"Internet Mail Service"?

Have you not received "Internet Mail Service" vacation notices from
  [email-masked]
  [email-masked]
  [email-masked] (#2)
  [email-masked] (#3)
  [email-masked]
  [email-masked]
  [email-masked]
  [email-masked]
  [email-masked]
  [email-masked] (#4)

By my count, that's 7 to 3 in favor of "Internet Mail Service".

What is your count?

> Exchange, to not send to mailing lists. Anyone can do this.
>
> Even Lotus Notes users...

Any system can be messed up.  I blame only the first of the four notices
from [email-masked] on the perpetrator of "Internet Mail Service".

Note that start of this thread concerned broken anti-virus junk to
supplement software that is designed to be a trojan horse and that you
guys seem to be saying is somehow related to whatever generates the
vacation notice noise.

Vernon Schryver    [email-masked]

---

From: "Christopher Ambler" <[email-masked]>
Date: Fri, 29 Dec 2000 00:59:12 -0800

> By my count, that's 7 to 3 in favor of "Internet Mail Service".

My count is 4 to 2 right now, but I have no reason to doubt you,
and believe that it will equal your count shortly.

> guys seem to be saying is somehow related to whatever generates the

Perhaps I gave the wrong impression, when I grouped the two together,
as it appeared that you were also commenting on the vacation notices
as well. My only point is that you seem to be looking at these messages
and coming to the conclusion that IMS should be banned as a result.

I don't agree, and merely wanted to point out that other mail systems
have the same problem. There is anti-virus software for Notes, too.
It seems to be better behaved, so Notes doesn't enjoy your attention.
To say that IMS is "designed to be a trojan horse" just seems a little
off-the-mark to me. I don't think even Microsoft deliberately designed
Exchange (which uses IMS - you were correct in this assumption) to
be a trojan horse. It has its problems, no doubt, but I don't assign
malicious intent. As I said, I worked for MS for a little over 3
years, most of them in Exchange (server), so I have a little first-hand
knowledge.

My only concern is that you were calling for the banning of email
software that I use, and I didn't think that was quite fair. Knowing
the software in question, it seemed pretty clear to me that this was
a case of user error. My virus scanning software doesn't send
return email. My vacation notices are configured to only send once
to each sender, and then only to senders on my "I'd like these people
to know I'm on vacation" list. I can't help but wonder why other
users haven't done the same. Nothing more, nothing less.

Peace.

Christopher

---

From: John Stracke <[email-masked]>
Date: Fri, 29 Dec 2000 09:10:58 -0500

> have the same problem. There is anti-virus software for Notes, too.

But a sane mail system does not *spread* viruses.

> off-the-mark to me.

I think the reason Verson's calling it a trojan horse is that it's a program
you install and that then starts spreading viruses.  Typically, a trojan
horse is one that spreads its *own* virus; but, from the user's point of
view, that's not a vital difference.  (On the other hand, by this viewpoint,
any OS for which viruses exist is a trojan horse.)

--
/================================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own.  |
|Chief Scientist |===============================================|
|eCal Corp.      |A ship is safe in a harbor, but that's not what|
[email-masked]|a ship is for.                                 |
\================================================================/

---

From: Lloyd Wood <[email-masked]>
Date: Fri, 29 Dec 2000 15:01:53 +0000 (GMT)

> Have you not received "Internet Mail Service" vacation notices from
[..]

I've received far more than that, presumably thanks to my 
Reply-To: line. All IMS.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: Tripp Lilley <[email-masked]>
Date: Fri, 29 Dec 2000 18:39:18 +0000 (/etc/localtime)

On Fri, 29 Dec 2000, Christopher Ambler wrote:

> Knowing the software in question, it seemed pretty clear to me that this
> was a case of user error. My virus scanning software doesn't send return
> email. My vacation notices are configured to only send once to each
> sender, and then only to senders on my "I'd like these people to know
> I'm on vacation" list. I can't help but wonder why other users haven't
> done the same. Nothing more, nothing less. 

I have to strenuously disagree with your premise, here ("user error"). 
The technical community, all too often, strikes me as user-hostile,
blaming many things on "the user"  (a.k.a. the I/O error -- Idiot
Operator). (Note that there are counterexamples both here and at large,
but I'm making a point :) ). 

When I say a piece of software is "broken", I usually do so for one or
more of a very few reasons:

	- it doesn't "do the right thing" by default
	- it doesn't let me make it "do the right thing"
	- it doesn't do anything right ;)
	- it's cumbersome and expensive to do anything beyond what
	  the original designer considered "the right thing" (when
	  there isn't already an accepted social definition of "the
	  right thing", as there -is- in this case)

I'll bet you quite a large sum of money that, if Exchange Server, or
Outlook, or whatever, came configured out of the box with "excruciatingly
polite" vacation messages, there wouldn't be this furor. Consider this set
of rules from the qmail-vacation package, by Peter Samuel:

	vacation will not generate a reply if any of the following
	conditions are met:

		- The sender address includes the string -REQUEST@.

		- The sender is you.

		- The sender's name is any of:
			daemon
			postmaster
			mailer-daemon
			mailer
			root

		- The sender matches any of the mail addresses listed in the
		  optional files ~/.vacation.aliases and
		  ~/.vacation.noreply . See the FILES section below for
		  more details on these files.

		- There is a Precedence: bulk or Precedence: junk header.

		- There is a Mailing-List: header.

		- Your mail address, or any address you have listed in the
		  optional ~/.vacation.aliases file does not appear in
		  either the To: or Cc: headers. This feature can be
		  disabled using the -j option. See the OPTIONS section
		  below for more details on this option. 

		- An automatic reply has already been sent to the same
		  address during the last week. The timeout  value
		  may be changed using the -t option. See the OPTIONS
		  section below for more details on this option.

		- -n was specified on the command line and the user does
		  not have a ~/.vacation.messages file.

What I'm really getting at, here, is the notion of "graduated
stewardship". Simply put, out of the box, a system must behave as a
polite member of society. However, that system should also be able to be
shaped in the hands of a somewhat skilled user (such shaping power being
given in direct proportion to the user's adeptness, by way of increasingly
obtuse access vectors for increasingly obscure tweaks). Unless
specifically designed for such purposes, a system should not allow the
user to make it do something antisocial, when there is an accepted de
facto or de jure standard of social interaction.

It's easy to blame users for bad software, but it's simply not their
fault. Users, by and large, don't -have- and don't -want- the intimate
understanding of how everything works. They no more want to configure a
mail system before using it than they want to configure their car before
driving it. Getting tags and stickers, adjusting the seats and mirrors,
and cranking up the radio are analagous to getting IPs and DNS, setting up
user accounts, and changing the background wallpaper. People don't want to
be a mechanic or visit a mechanic before they're able to drive off the
lot.

> Peace.

Through superior firepower ;)

-- 
   Joy-Loving * Tripp Lilley  *  http://stargate.eheart.sg505.net/~tlilley/
------------------------------------------------------------------------------
   "There were other lonely singers / in a world turned deaf and blind
    Who were crucified for what they tried to show.
    Their voices have been scattered by the swirling winds of time,
    'Cause the truth remains that no one wants to know."

   - Kris Kristofferson, "To Beat the Devil"