Subject: RE: still no Outlook patch

From: James Salsman <[email-masked]>
Date: Sun, 28 May 2000 17:12:18 -0700

> What is exactly your question/point?
> 
> 1.- Is it that when is the security patch will exist?
>     It already exists.

Only one of two is released.  The only one they have released is 
very weak, in that it would not have prevented Melissa and the 
other self-sending MAPI clients; it only would have slowed their spread.

> 2.- Is it that those features were disabled?

Sort of; please have a look at

  http://www.microsoft.com/technet/security/virus/vbslvltr.asp

In particular:

) Two security updates to Outlook are available to help protect 
) against malicious programs like worms and viruses: 
) 
) - A file attachment update is available for Outlook 97, Outlook 98
)   and Outlook 2000 This update makes it more difficult to
)   inadvertently launch attachments, by providing a more explicit
)   warning dialogue, and preventing attached executables from
)   being launched directly from e-mails. The update also is
)   included as part of Office 2000 SR1. 
)
) - A security update will soon be available for Outlook 98 and
)   2000. This update will provide even greater protection than the
)   file protection update. It prevents certain types of attached
)   files from ever being opened or saved to disk, ensures that
)   customers are alerted anytime a program attempts to send mail
)   on their behalf, and changes the default Security Zone in which
)   mail is processed. 

Likely there will be no way to turn off the MAPI Send method 
without also completely excluding a whole range of file 
attachments.  My guess is that this is being done because of 
some Excel and SQL Server scripts that send mail.  There are 
better solutions, including for Microsoft.  Will Microsoft 
really end up with those two patches 'tied' together?  The 
fact that they still have some people who have suggested it 
is not helping them avoid the "predatory" label.

Cheers,
James

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 30 May 2000 15:25:31 +0200

From: "James Salsman" <[email-masked]>
Sent: Monday, May 29, 2000 02:12
Subject: RE: still no Outlook patch

> The fact that they still have some people who
> have suggested it is not helping them avoid
> the "predatory" label.

Only among those with a poor understanding of the software issues, I
daresay.  I think, in this case (as in most), it is a question of poor or
questionable product design, not predation.

Microsoft, like just about every other microcomputer software publisher,
gives priority to feature bloat over security.  This is an economic
necessity, because the need to sell upgrades and versions to survive
requires that a software publisher find reasons to entice customers to
replace software that already does the job with new software that does the
same thing.  Customers may whine about security, but they won't pay for it,
and they find it a nuisance when they see it in the products they buy (even
mainframe customers tend to be this way, but microcomputer users are much,
much worse in this respect).  Build lots of new features of dubious utility
into a product and you'll be able to persuade at least some people to buy an
upgrade that they don't really need; build security into a product and a lot
of people will stick with the old version just to avoid the inconvenience of
the new security features.  Additionally, while it is difficult to prove
that a publisher has not lived up to its promise with respect to new and
often useless features, it is much easier to prove that a publisher has
messed something up if it promises security and fails to deliver--so it's
best not to promise security in the first place.

Anyway, I'm not sure what any of this has to do with the Internet, apart
from a loose connection to recent problems with viruses that have propagated
via e-mail sent (incidentally) over the Internet.  Even then, in these
specific, recent cases, the viruses spread because individual users were too
stupid to reflect before opening just any old attachment that they see (even
after repeated warnings); and so, if any fingers must be pointed, I suggest
that they be pointed at the end users, not at vendors, ISPs, the IETF, or
anyone else.  There's a limit to how completely any software can protect
against stupidity and still fulfill a useful purpose.

  -- Anthony