Subject: Re: value of standards

From: Vernon Schryver <[email-masked]>
Date: Thu, 4 May 2000 17:24:35 -0600 (MDT)

] From: Keith Moore <[email-masked]>

] ...
]        You could have senders sign any executables. That might help a little,
] > as long as the sender's machine hasn't been compromised.
]  
] this would also help, but we'd need a better way to verify the sender's 
] signature than we have now.

It wouldn't help much, unless you are of the religion that believes
authentication implies authorization.  Or don't you think that
today's evil doer could have managed to get the latest virus signed
with some company's key?  My bet is that many among those websites
that are defaced have handy dandy files of ASCII encoded binary
around near the anonymously improved HTML.
   .......

> From: John Stracke <[email-masked]>

> > Then again, it doesn't say DON'T CUT YOUR CUSTOMER'S ARM OFF either.
>
> Don't be silly; a vendor would never cut a customer's arm off.  How would
> they pull out their wallet to pay for the next upgrade?

Don't you be silly either; vendors that think that shipping browsers
with ActiveX turned on from most of the Internet don't want or expect
customers to do anything so "un-user-friendly" as explicitly authorizing
payment.  They're happy to infer lack of serous protest as authorization
to debit credit card accounts.  They also value the freedom to innovate
missing arms to reduce protests that are not really serious.

(I'd hate to be the marketoon who coined "freedom to innovate."  It's
already enshrined as one of the all time Newspeak phrases denoting its
opposite...oh, well, that's probably a badge of honor in some circles.)
   .......

> From: Lillian Komlossy <[email-masked]>

> Let's not make it political. We've all been attacked, it is pointless
> to bring in the Unix vs Windows debate. Office, Windows, Unix, Linux, Mac 
> are all great as long as somebody likes to work with them. 
> I personally like Microsoft products, but I respect those who don't - and
> expect the same respect from them.

You don't get respect for buying what everyone else buys, and you get the
opposite when you buy and use the infamously worst available.  (Never mind
that one can't be anything except "political" when demanding "respect.")
At this late date anyone admitting using Outlook without coercion is asking
for contempt from anyone whose respect is worth having.  The technical
reasons for that are infamous and too numerous to list here.
 .......

} If MS gets split, we could have Office for UNIX sooner rather than
} later too!

There are already packages similar to Office available for many free and
commercial flavors of UNIX.  At least one major contender even comes with
something supposedly vaguely like free source.  Note that I'm not
recommending those alternatives.  Office is fine for simple documents such
as your resume, provided you take precautions with tools outside Office
to ensure that you're not distributing more text, macros, and other stuff
than meets the eye of the casual reader.

Vernon Schryver    [email-masked]

---

From: Austin Schutz <[email-masked]>
Date: Thu, 4 May 2000 15:58:50 -0700

> around near the anonymously improved HTML.

	The point was that an attachment could be signed by the _message
sender_, not the originator of the file. So any executables you send to your
friends would be signed by _you_. Of course, if _your_ machine has been
compromised then your signature is probably no longer valid and the system
breaks.
	Your friends would thereby give you the authority to run executables
on their system (with their manual assent, of course) assuming your executable
was properly authenticated as having come from you.

	Austin

---

From: Keith Moore <[email-masked]>
Date: Thu, 04 May 2000 21:23:46 -0400

> ] ...
> ]        You could have senders sign any executables. That might help a 
> ] little,  as long as the sender's machine hasn't been compromised.
> ]  
> with some company's key?  

why in the world would I trust some random company's key?

now, if a "trusted friend" sent me a signed executable -
I as a person might decide that I'm willing to run the executable.

note that there are at least two kinds of trust here -

1. I have to be able to verify my friend's signature against a public
key which is either known to be valid because I've verified it personally,
or because it is signed by someone else that I trust (*maybe* a commercial 
CA, definitely *not* a random company)

2. I also have to trust my friend
a) not to be malicious 
b) to take reasonable steps to safeguard his system from compromise
   (including not running executables from unknown sources)
c) to take reasonable steps to safeguard his private key
   (which is not quite the same thing as b).

note that it takes a nontrivial user interface to communicate this to
a recipient of email:  e.g.

  NOTE: this message was signed by someone purporting to be 
  Keith Moore <[email-masked]>.  The signature is validated
  by a certificate from Fly-By-Night Certificate Authority, Inc.
  Fly-By-Night's certificate verifies correctly according to
  another certificate from FemtoSoft corporation that was supplied
  with your email reader, but you have not personally placed trust 
  in FemtoSoft.

  Therefore the authenticity of the claimed sender cannot be verified.

and yet this is basically what it takes to do the job.

there's no way you should ever just "click" on an arbitrary 
attachment regardless of content, expect that content to 
be evaluated, and still expect it to not cause harm.

Keith

---

From: [email-masked]
Date: Thu, 04 May 2000 23:08:39 -0400

> authentication implies authorization.  Or don't you think that

Unfortunately, some people are as neuron-paralized by this religion
as by many others.  The example I've finally taken to using to
explain the difference is as follows:

"Hmm.. you have 3 different ID's that say you're Jeffrey Dahmer(*).
I guess it IS ok to lend you a steak knife...."

That usually gets their attention...

				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

(*) Yes, I know he's dead.  If that ruins the example for you,
use Hannibal Lecter instead...