RE: [Asrg] Viruses

Barry Shein wrote:
> For example, is it a FEATURE of all mentioned windows OS's 
> that any non-privileged program can add new .EXE files to 
> the system directory and modify the registry such that 
> those newly added programs autostart on boot?
> Or is it a BUG which was exploited?

	The reality is that it is both Feature and Bug. The difference
depends on perspective and timing not on technical details... What was
once a feature would be seen as a bug if designed today. Times have
changed. "Back then", many would have claimed that making software easy
to install on Windows machines was appropriate. End users had trouble
dealing with passwords, didn't understand security constraints, etc.
and, Windows machines weren't "mission critical" -- they were just
desktop front-ends to other more well protected systems. But, those
times have changed. What hasn't changed very much is Windows' idea of
security.
	It is the same with email protocols. I built my first email
system in 1980 and shipped my first product containing email (DEC's
ALL-IN-1) in 1981. (It had 54% market share for commercial Office
Automation back in the 80's). I also participated in numerous
international standards efforts related to email. However, I don't think
I can remember a single instance during the 80's when spam was seriously
discussed as something that should be addressed in email protocol
design. It has always been with us, however, people trusted that folk
would use the network well and that peer pressure could get people to
stop sending inappropriate mail. This naïve and hopeful view of the
world was shattered during the 90's...
	What we've got now is a legacy problem. There are thousands of
software applications that rely on the virtually non-existent security
in Windows to do what they need to do and we've got thousands of mail
packages that rely on old protocols designed for a different era. It
isn't useful at this point to tag things as "bugs" or "features." What
we need to do is define what the correct behavior should be "in these
times" and then deal with all the issues related to bringing all the old
systems up to date.
	If Microsoft is to be faulted, it isn't for making the original
design decisions in Windows. They should be faulted for not having
addressed the issue of re-design more aggressively as the world changed
around them.

> I really believe we are nearing the actual 
> heart of the spam problem.
	Yes, the "heart" of the problem is that the people who designed
the systems being exploited by spammers today had a very different
worldview than they would have if they were designing the same systems
today. The people who designed the systems in use today didn't
anticipate fully how those systems would be used. These systems were
designed during a "kinder and gentler" time. The world is a different
place today.

		bob wyman


_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg