HDTenEightyP/NetNews huggingface dataset:
From: rat@ruth.UUCP (David Douthitt)
Newsgroups: comp.org.eff.talk
Subject: Re: Beneficial Virus?
Date: 9 Jan 93 02:40:09 GMT
Organization: Network XXIII - +1 608 222 9253

betsys@cs.umb.edu (Elizabeth Schwartz) writes:

| You are missing a basic point. For a virus to "check for the presence
| of a marker file" that virus has to be executing on my system, whether
| or not I have authorized it to. 

Interesting point and one to consider.... does this extend to "hidden"
de-compression code attached to executables?  Does this mean that all
auto-uncompressing executables should be eliminated?

|     Besides, how does the virus *get* to my system? Either it cracked my
| security, again without my permission, or it was hidden on a file
| imported onto my system, without my knowledge (if I *know* about it,
| and import it deliberately, then packaging it as a virus was not
| necessary.)

This discussion is not relevent to "cracking security" -- the benificial
virus we've taken to discussing is NOT going to crack security.

As for being "hidden on a file" - you mean just like the way
auto-uncompression code is "hidden"?  There are only two ways the
virus could arrive on your system:

   1. You installed the viral software.  The file marker VIRUSOK!.MRK is
      present, and the virus is okayed.  When a compressed file runs,
      the file is uncompressed, then the virus takes up residence in
      memory if not already there, and watches for a chance to compress
      a new executable file.

   2. You did not install the viral software - there is no marker.
      The file decompresses, and the virus deactivates itself and
      does NOT take up residence in memory and does NOT run.  This
      virus could also erase itself from the self-uncompressing code,
      automatically causing it to die out when removed from its host
      (interesting biological analogy there.... somewhere :-)


--
UUCP: ....!fullfeed.com!ruth!rat        |  Network XXIII - +1 608 222 9253
InterNet: rat@ruth.UUCP                 |  80Megs+ of Usenet/Fido programs!
Fidonet: David Douthitt 1:121/23        |  ... Files via Fidonet FREQ,
"...because appealing to the masses has |  anon uucp, first time login,
 never appealed to us."                 |  mail to fileserver@ruth.uucp
Newsgroups: comp.org.eff.talk
From: phardie@nastar.uucp (Pete Hardie)
Subject: Re: Beneficial Virus?
Organization: Digital Transmission Systems, Duluth, GA.
Date: Tue, 12 Jan 1993 15:39:16 GMT

In article <19531@mindlink.bc.ca> Clayten_Hamacher@mindlink.bc.ca (Clayten Hamacher) writes:
>You could have a breeder virus, one with all the code to install a marker
>file if the user so desired, and a nuetered virus, one with the replication
>and compression code removed..

>The way this would work is that the master virus would ask 'Marker File not
>found: Install marker file, remove compression, or continue?' when you ran an
>infected file, if you said install then it would copy the replication code
>and compression routines into the marker and save itself as a nuetered
>version. Then if your friend wanted a copy of the breeder to install, you'd
>run the marker file and it would put all the code back into a complete
>version of the virus ready to be installed.

So if I follow this, the breeder resides in an executable, and contains the
code for marker file, virus replication, and compression/decompression,
correct?

How does a file get compressed without running the marker file and
ending up with a full virus?

How does this breeder virus spread?

>This would be a virus because it would contain all the code for replication
>etc but would copy this into one file when installed to save space.

But does it spread on its own?  If not, we start to push the definition of
virus.


-- 
Pete Hardie:  phardie@nastar  (voice) (404) 497-0101
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team           |  cat * | egrep -v "signature virus|infection" 
Position:  Goalie               |
From: rat@ruth.UUCP (David Douthitt)
Newsgroups: comp.org.eff.talk
Subject: Re: Beneficial Virus?
Date: 9 Jan 93 14:39:54 GMT
Organization: Network XXIII - +1 608 222 9253

betsys@cs.umb.edu (Elizabeth Schwartz) writes:

| i wonder if these cheery hypothesizers have ever
| EXPERIENCED a virus infection on a PC in a work environment?

*I* have...

| Or
| discovered that there were altered system files on a multi-user
| networked machine, which they were being paid to keep secure?

I've not had the pleasure on this one.  Thank goodness, eh?

|    There's a very clear line on this group, and in comp.unix.admin,
| between the paid system maintainers and what I would categorize as the
| inexperienced users. Anyone who's ever seen a weird message appear on
| a system console late Friday afternoon or early Monday morning has a
| different attitude about "fool-proof" "guaranteed harmless" programs!

A CLEAR line eh?  I find too many "business" computer folks to have taken
on the mentality of their management counterparts and have become
"stuffed shirts" the way IBM has been since the dawn of time.

I've seen that "weird message" you refered to - and as I should have
expected, the user started to suffer a severe case of paranoia and went
through a massive denial ("It didn't come from any of US!  NO, not US!").
He was also convinced that it was a plot to destroy everything on the
system, even though he was repeatedly told the virus was not destructive.
After the virus attack, everything that happened wrong was the viruses
fault - at least until the new computer system came.  Then everything
that went wrong was because of the new computer system.

In fact, I've had MORE problems with *LEGAL* programs and copy-protection
than I've *EVER* had with viruses.  EVER.  When I switch someone's PC,
I expect the programs to go onto the new PC.  However, we have at least
two copy-protected applications, and they take at least a day by themselves
to transfer.  Copy-protection causes more problems than viruses; why
don't we have more "copy-protection removal" software out there?

A side note: one application where I work is NOT copy-protected; but our
secondary source oh so generously FORCED us to purchase a program whose
sole purpose is copy-protection.


--
UUCP: ....!fullfeed.com!ruth!rat        |  Network XXIII - +1 608 222 9253
InterNet: rat@ruth.UUCP                 |  80Megs+ of Usenet/Fido programs!
Fidonet: David Douthitt 1:121/23        |  ... Files via Fidonet FREQ,
"...because appealing to the masses has |  anon uucp, first time login,
 never appealed to us."                 |  mail to fileserver@ruth.uucp
Newsgroups: comp.org.eff.talk
From: plummer@cs.swarthmore.edu (David Barker-Plummer)
Newsgroups: comp.org.eff.talk
Subject: Computers, Freedom and Privacy Conferences: Proceedings?
Date: 11 Jan 93 15:28:54 GMT
Distribution: comp
Organization: Swarthmore College, Swarthmore, PA

Are there proceedings available for the Computers, Freedom and Privacy
conferences available?  If so, could someone send me publication
details, or preferably on-line sources.

Thanks -- Dave
From: mab@wdl39.wdl.loral.com (Mark A Biggar)
Newsgroups: comp.org.eff.talk
Subject: Re: legal question re anonymity online
Date: 11 Jan 93 19:13:53 GMT
Organization: Loral Western Development Labs

In article <C0M7Fv.9sA@world.std.com> mkj@world.std.com (Mahatma Kane-Jeeves) writes:
>Yes (I couldn't resist :).  Well, actually I don't know, but isn't 
>it true in general that a merchant who sells sexually explicit 
>material, or any other prohibited material (such as cigarettes), to 
>a minor is liable, even if the minor misrepresents him/herself?  I 
>remember that back in my youth, I had arguments with a number of 
>liquor store owners who thought my ID was false (it wasn't, I just 
>looked young, which made me a little testy).  They were universally 
>convinced that if I was underage, and they sold me liquor, they 
>would be in trouble.  Based largely on those experiences, I've 
>always been under the impression that the burden is on the merchant 
>to be certain that a sale is legal, period.  I could be wrong 
>(liquor store owners are not generally recognized as reliable legal 
>authorities), but I might be right.

There is legal precident the other way for missrepresentation of age.
The most notorious case is the Errol Flynn Statuatory Rape Case in which
he got off by proving that the girl (and her companions) lied before
witnesses that she was over age and the court decided that Flynn had no duty
to inquire further.  This is where the phrase "In like Flynn" comes from.

--
Mark Biggar
mab@wdl1.wdl.loral.com
Newsgroups: comp.org.eff.talk
From: Clayten_Hamacher@mindlink.bc.ca (Clayten Hamacher)
Subject: Re: Beneficial Virus?
Organization: MIND LINK! - British Columbia, Canada
Date: Tue, 5 Jan 1993 02:22:31 GMT

A compression virus would be an interesting project. It would be smaller to
patch the OS somehow to call a decompression routine whenever it loads a file
because you wouldn't have to have the decompresser (and compressor and
replication system if it was a true virus) in every file.

Safety wouldn't be much of a concern if you had it looking for a certain file
(VIRUSOK!.MRK or some such incredibly rare name) but the project has no
practical use aside from an experiment.

P.S. I think people misunderstood the way original poster would have the
virus use the marking file. The presence of the file would enable the virus,
therefore if the marker was not present the virus would NOT infect any files.
It seems some people thought it was the other way, the virus would always
infect UNLESS it found the marker.

On the subject of just patching the OS to shrink and unshrink files, what do
you think Stacker (and all the similar programs) do?

--

Clayten_Hamacher@Mindlink.bc.ca                 Land of the rising snow.
Newsgroups: comp.org.eff.talk
From: phardie@nastar.uucp (Pete Hardie)
Subject: Re: Beneficial Virus?
Organization: Digital Transmission Systems, Duluth, GA.
Date: Mon, 11 Jan 1993 16:40:43 GMT

In article <C0Kztn.Hvu@panix.com> rpowers@panix.com (Richard Powers) writes:
>> If the marker file was just a flag, you'd still have a virus, but
>>once it starts being code, you no longer have a virus.  I'm not sure
>>if there is a good term for what it is, however.
>
>This I do not agree with.  If a virus makes calls to code that is
>available to any program via the OS, this does not make it any less a
>virus.  (ie: calling code contained in libraries.)  If the code it
>calls resides someplace else, what difference does it make?

Algorithmic integrity.  A virus has all of the algorithm contained in the
single infected program, and does not need to access another file for part
of the algorithm.  If it needs to access another file for part of its 'real'
code, it cannot spread by itself.

-- 
Pete Hardie:  phardie@nastar  (voice) (404) 497-0101
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team           |  cat * | egrep -v "signature virus|infection" 
Position:  Goalie               |
Newsgroups: comp.org.eff.talk
From: rpowers@panix.com (Richard Powers)
Subject: Re: Beneficial Virus?
Organization: PANIX Public Access Unix, NYC
Date: Sat, 9 Jan 1993 10:00:59 GMT

In <1993Jan8.151721.29014@nastar.uucp> phardie@nastar.uucp (Pete Hardie) writes:
>In article <C0IDMu.By5@panix.com> rpowers@panix.com (Richard Powers) writes:

>>It is a virus because it replicates itself.  Period.

>I don't think so.

>Computer virii are called that for their similarity to bilogical
>virii, which are simply 'core' of DNA that use *another* cell to
>reproduce.  I can write a program that will replicate itself, but
>unless it *resides within* another executable, and *inserts itself*
>into other executables, it's not a VIRUS, it's a WORM.  A virus is (in
>the canonical definition) a self-contained code fragment that resides
>in an executable, and copies itself into other executables.

Whoops.  After looking at this again, I see your point.  I mispoke.
My apologies.  My statement above is *wrong*.  I might mention though,
that there are times when the division between virus and worm is not
so well-defined.

> If the marker file was just a flag, you'd still have a virus, but
>once it starts being code, you no longer have a virus.  I'm not sure
>if there is a good term for what it is, however.

This I do not agree with.  If a virus makes calls to code that is
available to any program via the OS, this does not make it any less a
virus.  (ie: calling code contained in libraries.)  If the code it
calls resides someplace else, what difference does it make?


I'm getting a little tired of this.  (As well as just plain tired.
Its 5AM!)


-- 
)                    )  I am more than this...  )               )
) rpowers@panix.com  )                          )   Apathy...   )
)                    )      Continue...?        )               )
Newsgroups: comp.org.eff.talk
From: matt@wardsgi.med.yale.edu (Matt Healy)
Subject: Re: Boycotting CERT because of the keystroke monitoring advisory?
Followup-To: comp.org.eff.talk,alt.comp.acad-freedom.talk,comp.security.misc,alt.privacy,alt.society.civil-liberty
Organization: Yale University--Genetics
Date: Thu, 7 Jan 1993 14:06:11 GMT

In article <1993Jan6.005425.3318@nntp.hut.fi>, jkp@cs.HUT.FI (Jyrki
Kuoppala) wrote:

>               [text cut] 
> (The need for monitoring might arise for example in the case an
> amendment is made to the drug-free workplace requirements that every
> session and file needs to be grepped for the keywords "joint", "drug",
> "hash", "trip" and such and the matching sessions/files forwarded to
> the appropriate drug councelors and authorities.)

Oh lord, what a horrid possibilty--the electronic equivalent
of urine testing!  Though I don't use illegal drugs myself
I consider the habits of others *none of my business* except
insofar as their *actions* might affect me.  If any agency
tried to make me grep my users' files for drug-related words
I hope I'd have the courage to refuse!

I have a friend who is a librarian; a few years ago the FBI
tried to get them to report who checked out "sensitive" books.
Fortunately for her, she worked in a state with a very strict
law concerning confidentiality of circulation records, so she
could simply say "I cannot do that without violating state law"
and they dropped the matter.  I understand some friends of hers
in other states had to stand up to some pressure before negative
media publicity made the FBI quit asking libraries to do that.

However, I wonder if computer sysadms would be able to stand
up to heavy Federal pressure as easily, given the lack of good
precedents in this area?

PS: Now that I have posted this message those keywords will
turn up in connection with *my* name!  I hope this doesn't
trigger a dossier on me!  If you think I'm being paranoid, read
Bamford's {The Puzzle Palace} about some of the things NSA has
done in the past with keyword searching and "watch lists" of
trigger words!  Just for completeness I'll add a few more
keywords: CIA DIA MI5 MI6 NRO KEYHOLE GCHQ KGB (do they still
operate?).

Matt Healy
"I pretend to be a network administrator; the lab
 net pretends to work!"

matt@wardsgi.med.yale.edu
Newsgroups: comp.org.eff.talk
From: lachman@netcom.com (Hans Lachman)
Subject: Re: Programmers and Libertarians (was: Re: [misc.activism.progressive] Clinton Office Requests Comments)
Organization: Netcom
Date: Tue, 5 Jan 1993 02:31:56 GMT

In article <1993Jan4.174324.9157@lmpsbbs.comm.mot.com> bhv@areaplg2.corp.mot.com (Bronis Vidugiris) writes:
>In article <C0A8tJ.Dy@panix.com> pnh@panix.com (Patrick Nielsen-Hayden) writes:
>)lachman@netcom.com (Hans Lachman) writes:
>)
>)>My guess is that the correlation between programmers and
>)>Libertarians is due to the fact that programmers (the smart
>)>ones at least) keenly understand the KISS principle (Keep
>)>It Simple, Stupid).
>...
>
>)Analogies between engineering & politics like the above have a checkered
>)history, to say the least.
>
>IMO the analogy between programs and society is stronger than the analogy
>between machines in general and society.

Wait a minute.  Before this gets out of hand, let me clarify what I said.

1.  I think the KISS principle is not native to the engineering field, but
    rather, a general principle that applies, very obviously, in engineering,
    and also applies somewhat to bureaucracy.  Both disciplines can benefit
    from this principle, and let's end the analogy there.

2.  I am not advocating a redesign of the government.  I'm simply suggesting
    that maybe the reason why programmers like libertarianism is that, being
    personally acquainted with KISS, they recognize that, of the many
    principles that help make for good government, KISS is the one that is
    most sorely lacking in our current government.  They believe it should be
    given the attention it deserves, and that we may benefit from that.
    Could this be a reason why programmers like libertarianism?

Hans Lachman
lachman@netcom.com
From: mkj@world.std.com (Mahatma Kane-Jeeves)
Subject: legal question re anonymity online
Organization: The World Public Access UNIX, Brookline, MA
Date: Thu, 7 Jan 1993 19:44:52 GMT


Let me pose a hypothetical case.  On his way home from work one
evening, John Q. Publius stops at a newsstand and buys the latest
edition of his favorite quarterly journal, the Entire World
Redux.  Inside, he finds an unobtrusive but inviting ad for an
electronic conferencing system called The BELL.

When he arrives home, he powers up his home PC and applies for an
account on the BELL.  He informs the BELL's administrators that
he would prefer to use a pseudonym, and not reveal any personal
information about himself on-line.  But the administrators deny
his request, stating:

     "Since the BELL makes it clear that users are responsi-
     ble  for  what they post on the BELL, we  think  it  is
     important that they be identifiable."

With a sigh, John proceeds to become a regular BELL user and
contributor under his real name.

Some time later, John participates in a debate on the BELL,
taking a clear stance on a very controversial issue.  A lurking
rabid fanatic with emotional problems takes silent exception to
John's comments, gets John's name from a message header, and
somehow finds John's address and phone number.  He makes phone
calls to John's answering machine, quoting from John's messages
on the BELL and threatening retaliation; later he drops by John's
house and lobs a molotov cocktail in through the window.  John's
house is badly damaged, and John is injured, suffers great pain,
loses income and requires expensive medical treatment.

Infuriated and in desperate need of financial help, John sues the
BELL.  My question:  Does he have a case?

Suppose John can show that although the BELL management denied
pseudonymity to most users, they granted it to certain people
such as celebrities or others with special status.  Would this
strengthen John's case?  Could he argue that if the BELL takes
upon itself the authority to decide who may or may not protect
themselves with a pseudonym, they must also accept at least
partial responsibility for the consequences?

Suppose John can show that other BELL users have previously
suffered defamation, harassment or other problems as a result of
real-name exposure on the BELL, and that BELL management was
aware, or should have been aware, of at least some of these
problems.  Would this strengthen John's case?

I realize that these questions may not have clear answers at this
time, but I am looking forward to informed speculation.

                                   ---  mkj
Newsgroups: comp.org.eff.talk,alt.comp.acad-freedom.talk,comp.security.misc,alt.privacy,alt.society.civil-liberty
From: lachman@netcom.com (Hans Lachman)
Subject: Re: Software as PE
Organization: Netcom
Distribution: na
Date: Thu, 7 Jan 1993 01:10:56 GMT

In article <1993Jan5.222148.1164@netcom.com> lachman@netcom.com (Hans Lachman) writes:
>In <889520164DN5.61R@tanda.isis.org> marc@tanda.isis.org writes:
>>
>>  "Software Engineer" is a meaningless and misleading term.
>>  ... Software Engineer is the fashionable euphemism for Programmer ....
>
>In my opinion, a "software engineer", in addition to being a competent
>programmer, should also have the following characteristics:
>
>- understands and applies general engineering principles
>- has at least a passing knowledge of other engineering and/or
>  physical science fields, helping him/her communicate with
>  technical professionals of other backgrounds
>- knows how use a library to research a technical topic
>- understands the fundamentals of computer hardware design and
>  operating systems
>- knows well-known programming techniques not specific to one
>  language (like stuff from Knuth's books)
>- can do "systems analysis" (product requirements analysis, functional
>  analysis)
>- can write good functional specification and design specification
>  documents
>- is familiar with commonly-accepted software modeling methods
>  (e.g., data flow diagrams)
>- knows enough about the state of the art to identify, most of the
>  time, when a proposed solution is a reinvention of the wheel
>- has a level of judgement that results in good cost/benefit trade-offs
>- can write implementation notes that help future maintainers of
>  his/her code
>- can create effective test plans
>- can communicate effectively, regarding his/her software, with other
>  departments (e.g., other development teams, software test, software
>  integration, marketing, product documentation, customer support)
>
>Anyone who demonstrates the above characteristics qualifies as a software
>engineer, in my book.  (Sorry, no black-and-white, 1-or-0 tests.)

I forgot one important point (and possibly others):

- can handle or at least help with administrative tasks, such as
  project planning (estimating schedules, estimating manpower and
  equipment requirements), managing a bug-tracking database, and
  doing engineering-related paperwork (like patent applications)

Hans Lachman
lachman@netcom.com
From: betsys@cs.umb.edu (Elizabeth Schwartz)
Newsgroups: comp.org.eff.talk
Subject: Re: Beneficial Virus?
Date: 7 Jan 93 07:59:17 GMT
	<1993Jan5.153018.18935@nastar.uucp> <C0EJAu.HuI@panix.com>
	<BETSYS.93Jan5233720@ra.cs.umb.edu> <C0GF9q.2yF@panix.com>
Organization: University of Massachusetts at Boston

I don't care what you do on your home computer. The post I was
responding to mentionned the virus executing on *other* systems and
testing on these *other* systems for the presence of a marker file.
--
System Administrator                  Internet: betsys@cs.umb.edu
MACS Dept, UMass/Boston               Phone   : 617-287-6448
100 Morrissey Blvd                    Staccato signals
Boston, MA 02125-3393                      of constant information....