HDTenEightyP/NetNews huggingface dataset:
From: mfterman@phoenix.Princeton.EDU (Mutant for Hire)
Subject: Re: Future OS virus immunity.
Originator: news@nimaster
Reply-To: mfterman@phoenix.princeton.edu (Mutant for Hire)
Organization: Mutant for Hire, Inc.
Date: Sun, 3 Jan 1993 02:33:08 GMT

In article <eronald.726016050@ruble>, eronald@fml.tuwien.ac.at (Edmund Ronald) writes:
>  Several people remarked that virues on Unix machines were "impossible"
>because of the access control separating accounts. No one bothered to 
>remember that the past ten years have proven Unix system security to be an
>oxymoron, a topic that keeps graduate students entertained nights. In fact,
>if I may venture some sarcasm, if administrators and vendors did not make
>such exagerated claims about Unix security, then there would probably be
>fewer attacks :)

The main problem with Unix security is that there are a lot of holes to
plug. The system administrator can make a unix system fairly secure,
placing the weak point with the users, but you have to really be careful
about programs that run setuid, protections on all files, and other such
issues.

One may ask how easy it is to make a unix system secure, and I agree that
it is not easy to make a system that is used by a lot of users for various
sophisticated tasks secure. Additionally, unix being so widely distributed
and talked about has a hard time relying on "security through obscurity",
since any hole will get talked about. I do wonder how much more secure
other OS's are, where the ability to keep a security hole quiet is a bit
easier.

-- 
    Martin Terman, Mutant for Hire, Mean Ol' Top, Priest of Shub-Internet
    Disclaimer: Nobody else takes me seriously, why should you be the first?
mfterman@phoenix.princeton.edu mfterman@pucc.bitnet terman@pupgga.princeton.edu
"Sig quotes are like bumper stickers, only without the same sense of relevance"
Xref: sparky comp.security.misc:2385 comp.org.eff.talk:8177
From: phardie@nastar.uucp (Pete Hardie)
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Re: Stupid Licenses (YUCK!)
Date: 30 Dec 92 14:55:28 GMT
Organization: Digital Transmission Systems, Duluth, GA.

In article <1992Dec29.145649.5377@mksol.dseg.ti.com> mccall@mksol.dseg.ti.com (fred j mccall 575-3539) writes:
>The three most dangerous things in the world:
>
>	1) a hardware type with a software patch
>	2) a software type with a soldering iron
>	3) a user with an idea

I'd suggest a re-ordering (most to least dangerous):
	1) a hardware type with a software patch
	2) a user with an idea
	3) a software type with a soldering iron


-- 
Pete Hardie:  phardie@nastar  (voice) (404) 497-0101
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team           |  cat * | egrep -v "signature virus|infection" 
Position:  Goalie               |
Newsgroups: comp.security.misc,comp.org.eff.talk
From: charlie@umnstat.stat.umn.edu (Charles Geyer)
Subject: Re: Stupid Licenses (YUCK!)
Organization: School of Statistics, University of Minnesota
Date: Mon, 28 Dec 1992 00:23:14 GMT

In article <1992Dec22.034142.14471@fsl.noaa.gov> bear@kestrel.fsl.noaa.gov
(Bear Giles) asks:

> Would you postpone a release with known bugs (documented in a 'here there
> be dragons' addendum) which would replace a previous, more buggy version?

Why can't they just provide a release that fixes the old bugs without
introducing (known) new ones?  Featurality first is the only explanation.

> What about a release with significant improvements which just happened
> to crash if you had a really obscure combination of hardware and software?
> What if the company offered you a free upgrade (or other compensation)
> if its software twigged on this odd combination?
>
> Or what if the software only had problems on really old systems which
> should have been upgraded a long time ago? ("Gee, I'm running DOS 2.8
> on a 5 MHz XT and your program doesn't seem to work!")  How long do
> you need to keep providing upgrades for existing platforms?

A customer can't really complain if software doesn't work on hardware the
vendor doesn't claim it works on.

But the "should have been upgraded a long time ago" reminds me of another
consequence of the software industry's abysmal quality level.  Only a fool
"upgrades" unnecessarily.  Most "upgrades" turn out to be degrades that
needlessly break lots of working applications and only provide bells and
whistles in compensation.  This forces sensible customers to fall behind
"current" versions of operating systems.  It's sound defensive computer
usage.

-- 
Charles Geyer
School of Statistics
University of Minnesota
charlie@umnstat.stat.umn.edu
Newsgroups: comp.security.misc
From: DMARTIN@vm.ucs.UAlberta.CA
Subject: Re: Stupid Licenses (YUCK!)
Organization: University Of Alberta, Edmonton
Date: Tue, 22 Dec 1992 15:00:46 GMT

------------------------- Original Article -------------------------
> From: bhayden@teal.csn.org (Bruce Hayden)
> Agreed - you can't get all of the bugs out. You can however get the major
> ones out, and the minor ones down below a certain, prespecified level.
>...
> I disagree. We have the capability today to set an acceptable bug level
> before the release, then not release until we have reached that level.

Maybe I'm misunderstanding what you mean by a "bug level", but I'm having
difficulty with what you propose. WHAT IS an "acceptable bug level", defined
so that I know when I have reached it? You can't simply ask that there be
no more than x "minor bugs" present in the software - that gets you into
a variation of the issue of proving software correct (How can I possibly KNOW
that I am down to x "minor bugs" and 0 "major bugs"?).

Please understand, I AM in agreement with your philosophy; I'd just like to
see a usable definition.

Merry Christmas, Happy Chanukah, Happy Saturnalia, etc. etc.!
Newsgroups: comp.security.misc,comp.org.eff.talk
From: bhayden@teal.csn.org (Bruce Hayden)
Subject: Re: Stupid Licenses (YUCK!)
Organization: Colorado SuperNet, Inc.
Date: Tue, 29 Dec 1992 17:44:50 GMT

leonard@qiclab.scn.rain.com (Leonard Erickson) writes:

>>> Would you postpone a release with known bugs (documented in a 'here there
>>> be dragons' addendum) which would replace a previous, more buggy version?

>>Why can't they just provide a release that fixes the old bugs without
>>introducing (known) new ones?  Featurality first is the only explanation.

>Well, I know of a case where this was tried, but one of the fixes involved
>switching from a no longer supported (and *buggy*) comm library to a new
>library that turned out to be buggier than expected. While waiting for
>the fixes, the programmers decided to add a few of the "easy" features
>users had been requesting. Which (of course) lead to a few new bugs.

Appears to me to be a management problem, not a technical problem.

Bruce E. Hayden
(303) 758-8400
bhayden@csn.org

Newsgroups: comp.security.misc,alt.security
From: rslade@cue.bc.ca (Rob Slade)
Subject: New virus report: "Ryan Erik Hoff"
Organization: Computer Using Educators of B.C., Canada
Date: Wed, 30 Dec 92 21:48:13 GMT

 Entry...............: "Ryan Erik Hoff"
 Alias...............: Dave, "El Gargantuo"
 Strain..............: Furneaux/Meeter/Slade/Hoff
 Detected when.......: 921227 2058H
          where......: Royal Columbian Hospital, New Westminster, BC, Canada   
                          (there are indications that it originated in         
                          neighbouring Port Moody  :-)
 Clssification.......: Although others in strain have been viral, this may be a
                          "dropper"
 Length of virus.....: 6.25 3 1/2" disk widths
 ------------------------Preconditions---------------------------------
 Operating System(s).: All current and future, hopefully  :-)
 Version\Release.....: as above
 Computer models.....: as above, and his other grandfather and I are agreed    
                          that he should also be able to sail by the age of two
 -------------------------Attributes-----------------------------------
 Easy identification.: his father's head shape, and his mother's furrowed brow
 Infection Trigger...: Well, see, when you grow up, you start to feel ...
 Media affected......: I haven't been online at all for four days
 Interrupts hooked...: Everything on Saturday night and Sunday
 Damage..............: The integrity shell of the carrier program had to be    
                          broken during disinfection.  There were initial      
                          indications of serious damage, but the carrier       
                          program has proven capable of self-repair.
 Damage trigger......: Reverse placement
 Particularities.....: Extraordinary size (4345 gm)
 Similarities........: Red, sleeps and cries a lot
 ----------------------------------------------------------------------
 Countermeasures.....: None yet attempted.  Likely never will  :-)
 -----------------------Acknowledgements-------------------------------
 Location............: V.I.R.U.S., Vancouver, BC, Canada
 Classification by...: all grandparents
 Documentation by....: Grandpa
 Date................: 921230
 
==============
Vancouver      ROBERTS@decus.ca         | "If you do buy a
Institute for  Robert_Slade@sfu.ca      |  computer, don't
Research into  rslade@cue.bc.ca         |  turn it on."
User           p1@CyberStore.ca         | Richards' 2nd Law
Security       Canada V7K 2G6           | of Data Security

Newsgroups: comp.security.misc,comp.org.eff.talk
From: mccall@mksol.dseg.ti.com (fred j mccall 575-3539)
Subject: Re: Stupid Licenses (YUCK!)
Organization: Texas Instruments Inc
Date: Tue, 29 Dec 1992 15:05:02 GMT

In <1992Dec28.002314.21233@news2.cis.umn.edu> charlie@umnstat.stat.umn.edu (Charles Geyer) writes:

>In article <1992Dec22.034142.14471@fsl.noaa.gov> bear@kestrel.fsl.noaa.gov
>(Bear Giles) asks:

>> Would you postpone a release with known bugs (documented in a 'here there
>> be dragons' addendum) which would replace a previous, more buggy version?

>Why can't they just provide a release that fixes the old bugs without
>introducing (known) new ones?  Featurality first is the only explanation.

Well, only if that's the only 'explanation' you're willing to look at.
However, you might want to consider that any time you change software
(even to fix a known bug), there is a possibility that you will
introduce other bugs somewhere else.  Naturally everyone TRIES to
avoid this (design for low coupling, etc.), but it is still going to
happen, particularly if performance is an issue (because all those
nice theoretical practices may have to be traded off to get enough raw
speed). 

I'd suggest you read up on this (someone else suggested _The Mythical
Man Month_, which is a good place to start), but I get the impression
that you really aren't that interested in the real reasons.

>> What about a release with significant improvements which just happened
>> to crash if you had a really obscure combination of hardware and software?
>> What if the company offered you a free upgrade (or other compensation)
>> if its software twigged on this odd combination?

They would soon go broke.  Figure that ANY program of any size is
going to have bugs.  

>>
>> Or what if the software only had problems on really old systems which
>> should have been upgraded a long time ago? ("Gee, I'm running DOS 2.8
>> on a 5 MHz XT and your program doesn't seem to work!")  How long do
>> you need to keep providing upgrades for existing platforms?

As long as that's where your market is.  If they can't upgrade their
hardware to something within that last decade, why would they update
software? 

>A customer can't really complain if software doesn't work on hardware the
>vendor doesn't claim it works on.

>But the "should have been upgraded a long time ago" reminds me of another
>consequence of the software industry's abysmal quality level.  Only a fool
>"upgrades" unnecessarily.  Most "upgrades" turn out to be degrades that
>needlessly break lots of working applications and only provide bells and
>whistles in compensation.  This forces sensible customers to fall behind
>"current" versions of operating systems.  It's sound defensive computer
>usage.

Provided that what you have meets your requirements, of course.

-- 
"Insisting on perfect safety is for people who don't have the balls to live
 in the real world."   -- Mary Shafer, NASA Ames Dryden
------------------------------------------------------------------------------
Fred.McCall@dseg.ti.com - I don't speak for others and they don't speak for me.
Xref: sparky comp.security.misc:2373 comp.org.eff.talk:8126
From: leonard@qiclab.scn.rain.com (Leonard Erickson)
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Re: Stupid Licenses (YUCK!)
Date: 29 Dec 92 00:03:30 GMT
Article-I.D.: qiclab.1992Dec29.000330.3921
Reply-To: Leonard.Erickson@f51.n105.z1.fidonet.org
Organization: SCN Research/Qic Laboratories of Tigard, Oregon.

brad@clarinet.com (Brad Templeton) writes:

>I don't know what the fuss is.  There are lots of software vendors and
>computer dealers and even computer stores that sell things with a money
>back guarantee these days.  It's been happening for years.

And not one of them will give you your money back after a relatively 
short period. Say a month. So If the nasty bug shows up after 6 months
of use, you are stuck.

Worse, if the bug takes out the data you'd entered into the program,
or worse yet, takes out unrelated files, you aren't going to get one cent
for that.

I know how hard coping with "everything" is. But that's no excuse for 
the sort of "we disclaim responsibility. All shapes, all sizes, all 
kinds." that seems to be popular.

-- 
Leonard Erickson		      leonard@qiclab.scn.rain.com
CIS: [70465,203]			 70465.203@compuserve.com
FIDO:   1:105/51	 Leonard.Erickson@f51.n105.z1.fidonet.org
(The CIS & Fido addresses are preferred)
Newsgroups: comp.security.misc
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: Future OS virus immunity.
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 31 Dec 92 14:57:59 GMT

kludge@grissom.larc.nasa.gov (Scott Dorsey) writes:

> Viruses aren't a real problem in any system that has memory protection and
> any way to prevent users from directly writing into system space.  In such
> a system, a user would be able to destroy his own area, but wouldn't be
> able to touch the OS.

While your second statement is, of course, true, the first is not
necessarily so. Viruses are a problem is there is sharing,
functionality, and transitivity of the information flow. If you
prevent any of those, you make the viruses impossible. The only
problem is that you also make the computer not very useful.

Let's consider Unix - a typical system with memory protection,
discretionary access control, and all that jazz. Absolutely nothing in
this system prevents a virus from infecting ALL executable files of a
particular user. Between the different users on one and the same
system the virus will not spread that well, because users don't often
execute programs that belong to other users. An exception is the
"users" bin and root. Once one of those users executes an infected
file, the virus will spread in the system like a wildfire. But again,
those users do not often execute programs that belong to other
users...

Between different systems the virus will have even less chance to
spread, because the sharing of programs occurs mainly in the form of
source code. You do not walk around with infected tapes and do not run
the programs on them on different machines, as you do in the PC world.
That's why, in multi-user systems the worms and the trojans are of
much more concern than the usual viruses.

Memory protection has almost nothing to do with it - ok, without it
the viruses will be easy, just as in MS-DOS, but even if it is
present, this does not prevent the viruses from spreading. What
prevents them is the limited sharing.

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: comp.security.misc
From: poland@cam2.gsfc.nasa.gov (Jim Poland)
Subject: software piracy question
Summary: A question about recent software piracy legislation
Keywords: laws, software piracy
Organization: Goddard Space Flight Center
Date: Tue, 22 Dec 1992 20:27:12 GMT

(sorry if this is a duplicate...)

I recently (within the last 6 months) read an article in the Washington Post
about software piracy.  The article stated that "on June 4, the Senate passed
S.893, a bill to move the willful copying of a computer program from a 
misdemeanor to a felony, and the bill is expected to be voted on favorably 
by the House, possibly next week."

I was wondering if anyone knows the status of this bill and the possible 
penalties associated with this legislation.

Thanks in advance.

Jim Poland
Newsgroups: comp.security.misc
From: eronald@fml.tuwien.ac.at (Edmund Ronald)
Subject: Future OS virus immunity.
Organization: Technical University of Vienna
Date: Wed, 30 Dec 1992 21:50:39 GMT

 I am a Paris based computer-interest writer, and I need info about current
trends on making operating systems virus-resistent. Could people tell me 
what the lines of research are?

My Paris email is eronald@cnam.cnam.fr

Thanks for your time.

Edmund.


Newsgroups: comp.security.misc
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: Future OS virus immunity.
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 31 Dec 92 17:57:07 GMT

adam@endor.uucp (Adam Shostack) writes:

> available utility.  While I'm not as familiar with the PC world, there
> seem to be at least 50 major strains of viruses, and I don't know of
> any single program which can stop all of them.

:-). You are off by a factor of ten... Currently we recognize at least
592 different virus families for MS-DOS... They might be slightly more
- something about 600, but you get the idea... The last time I looked,
there were only about 35 different viruses for the Mac...

> Does anyone care to comment on why there are so many more MS-Dos
> viruses out there, and there doesn't seem to be any universally
> accepted tool (like Disinfectant) to stop viruses.  Or is this a false
> impression because I use a mac and have taken the time to find out
> about the tools available?

I really don't know why there are fewer Mac viruses than MS-DOS
ones... The difference in the spread of the two types of computers is
not significant enough to explain the huge difference in the numbers
of the existing viruses... Maybe, due to the different price, the two
kinds of computers are just owned by different kinds of people... My
boss says that the Mac owners love their machines (unlike the IBM PC
owners who hate theirs <grin>), that's why they tend not to write
destructive code from them... :-) This was a joke, please don't start
a flame war.

You are right that in the MS-DOS world there is no program that can
stop all known viruses. The reason is that there is not such thing as
"all known viruses". New viruses for the IBM PC appear everagely 2-3
per day. Nobody can update their anti-virus programs that fast.

Another thing that makes me wonder is why most Mac viruses are pretty
silly. OK, some of them have the equivalent of tunneling, but none of
the advanced techniques used in MS-DOS like stealth, armour, slow
infection, sparse infection, polymorphism, and so on are used... OK,
stealth is probably not easy, having in mind how MacOS works, slow and
sparce infections are not needed, since integrity checkers are not
used much, but why not polymorphism? It is much easier to do with the
690x0 CPU than it is to do it with 80x86...

Regards,
Vesselin

P.S. This discussion probably belongs to comp.virus.
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: comp.security.misc,comp.org.eff.talk
From: dkeisen@leland.Stanford.EDU (Dave Eisen)
Subject: Re: Stupid Licenses (YUCK!)
Organization: Sequoia Peripherals, Inc.
Date: Wed, 30 Dec 92 16:43:54 GMT

In article <1992Dec30.145528.6387@nastar.uucp> phardie@nastar.uucp (Pete Hardie) writes:

>I'd suggest a re-ordering (most to least dangerous):
>	1) a hardware type with a software patch
>	2) a user with an idea
>	3) a software type with a soldering iron

Then I guess you've never seen me with a soldering iron.



-- 
Dave Eisen                               Sequoia Peripherals: (415) 967-5644
dkeisen@leland.Stanford.EDU              Home:                (415) 321-5154
       There's something in my library to offend everybody. 
          --- Washington Coalition Against Censorship
From: adam@endor.uucp (Adam Shostack)
Newsgroups: comp.security.misc
Subject: Re: Future OS virus immunity.
Date: 31 Dec 92 17:25:36 GMT
Organization: Aiken Computation Lab, Harvard University

In article <1hv07gINN3mn@rave.larc.nasa.gov> kludge@grissom.larc.nasa.gov (Scott Dorsey) writes:
>In article <eronald.725752239@ruble> eronald@fml.tuwien.ac.at (Edmund Ronald) writes:

>Unfortunately the two major microcomputer operating systems are still in
>the early 60's level of technology.  This is a marketing problem, not
>a technological one.  If people refused to use junk like MS-DOS and Mac OS,
>viruses would be almost nonexistant.

I agree in principle that the Mac OS & MS-Dos by their lack of
protection, make viruses easy to spread.  However, there are less than
20 viruses for the mac, all of which can be stopped by a freely
available utility.  While I'm not as familiar with the PC world, there
seem to be at least 50 major strains of viruses, and I don't know of
any single program which can stop all of them.

Does anyone care to comment on why there are so many more MS-Dos
viruses out there, and there doesn't seem to be any universally
accepted tool (like Disinfectant) to stop viruses.  Or is this a false
impression because I use a mac and have taken the time to find out
about the tools available?




Adam Shostack 					adam@das.harvard.edu

What a terrible thing to have lost one's .sig.  Or not to have a .sig
at all.  How true that is.
Newsgroups: comp.security.misc,comp.org.eff.talk
From: phardie@nastar.uucp (Pete Hardie)
Subject: Re: Stupid Licenses (YUCK!)
Organization: Digital Transmission Systems, Duluth, GA.
Date: Thu, 31 Dec 1992 14:46:56 GMT

In article <1992Dec30.164354.27296@leland.Stanford.EDU> dkeisen@leland.Stanford.EDU (Dave Eisen) writes:
>In article <1992Dec30.145528.6387@nastar.uucp> phardie@nastar.uucp (Pete Hardie) writes:
>
>>I'd suggest a re-ordering (most to least dangerous):
>>	1) a hardware type with a software patch
>>	2) a user with an idea
>>	3) a software type with a soldering iron
>
>Then I guess you've never seen me with a soldering iron.

You'd need to set the building on fire to duplicate the effects of some of the
hardware guys I've seen coding....

-- 
Pete Hardie:  phardie@nastar  (voice) (404) 497-0101
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team           |  cat * | egrep -v "signature virus|infection" 
Position:  Goalie               |
Newsgroups: comp.security.misc