Subject: [Asrg] Bug, or Feature?

From: [email-masked]
Date: Thu, 26 Jun 2003 15:21:19 -0500

> For example, is it a FEATURE of all mentioned windows OS's that any
non-privileged program can add new .EXE files to the system directory
and modify the registry such that those newly added programs autostart
on boot?

> Or is it a BUG which was exploited? And if it's a BUG is it odd that
the same bug exists across all those releases, has it been known
previously, why hasn't it been fixed in, apparently, over 7 years
(Windows95 ... XP.)

As much as you might not like to hear the answer... since this characteristic is 
found in all those releases, AND counted upon by large numbers of applications 
which would be broken if that characteristic were changed... clearly the item in 
question IS a "feature".

Not all "features" are particularly well-considered.  This is true for ALL 
software.  (Sometimes it's more important which easily implemented features you 
LEAVE OUT than which ones you PUT IN.)

The FACT remains, however, that restricting certain operations to "root-only" or 
"sysadmin-only" is really pretty meaningless on typical user-level Windows 
desktops, where (especially on home machines) there IS no root or sysadmin-level 
qualified/intelligent/wise authority which is more qualified to approve or deny 
such requests.

As for rapidly getting out patches for SENDMAIL, I'll point out that many of the 
security weaknesses in Outlook and Outlook Express have been closed by patches 
that have been out for more than a year, and maybe TWO... but where many users 
haven't bothered to (or don't realize that they should) install those patches.

Certificates attesting to the trustworthiness of incoming executable software 
are one approach, but typically not a good one especially given the large 
numbers of applications (freeware/shareware/etc) produced by 
trustworthy-but-small producers which cannot ante up the bucks for certificates.

I still believe that a good alternative that is effective in the great majority 
of typical cases is to simply by default block unexpected attachments that 
arrive from unfamiliar. untrusted senders (and most especially if those are of 
risky/executable types).

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 26 Jun 2003 15:00:20 -0600 (MDT)

> From: [email-masked]

> ...

If that made sense, then mail sent to "root" on UNIX boxes would
be a major hazard.  If it made sense, then XP would not be
Microsoft-standard vulnerable to viruses and worms.

The problem with Windows boxes is not they have a single user
account, but that the single user account (on those Microsoft boxes
were there there is any notion of "user account" and so not Windows-ME
and preceding) always has all privileges.

A good picture of the problem is in the difference between ActiveX
and Java.  Microsoft has asserted quite emphatically that the lack of
a "sandbox" in ActiveX is a feature instead of a bug.  That nonsense
cannot be excused as historical baggage, because ActiveX is a
post-Internet mistake.

> arrive from unfamiliar. untrusted senders (and most especially if those are of 

Let's see, what systems are built to to make it easy to execute
code that arrives by mail and even often without any let, leave,
or hindrance by the user?

Vernon Schryver    [email-masked]

---

From: Barry Shein <[email-masked]>
Date: Thu, 26 Jun 2003 18:00:59 -0400

These long-winded apologias for microsoft are touching (and I hope
paid for!)

HOWEVER, what would've been so hard about putting in a goddamn pop-up
confirm box triggered at the system level which said something like:

	THAT ACTION IS TRYING TO MODIFY YOUR SYSTEM
	SOFTWARE AND/OR THE REGISTRY etc etc.

		 Proceed? [YES] [NO] [HELP]

based on some reasonable rules so it's a reasonably meaningful
warning? Lord knows they ask confirmation for everything else you do
it seems.

Sure, some dummy might click yes to everything but at least when you
just opened an email and suddenly there are 110db sirens and blaring
red lights it just might occur to someone to click [NO] or [HELP]
particularly after being warned a 100,000 times in every other CNN HN
and USA Today issue that if you see that warning and you don't have
some vendor's disk in the drive doing an install then be VERY
SUSPICIOUS.

And don't tell me about why Windows '95 doesn't have anything like
this (wasn't obvious in 1995, actually, it was, maybe Windows 3.0 has
that as an excuse), only tell me why Windows XP doesn't.

Or whatever.

The point is FOR WHATEVER REASON this mass-distributed technology flaw
appears to be the base root of the spam problem.

And that's what we're here to discuss.

Even if Gates et al only put it in there because it would help a poor,
blind, cripple become more self-sufficient and regain their pride and
integrity in a cruel and cold world I DON'T CARE. I only care why the
net is being flooded with spam and trying to figure out what to do
about it.

What next? How spam may be the only way for poor, starving
third-worlders to feed their families?

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*