Thank You, Linus!

Am 05. Aug, 2003 schw=E4tzte Craig White so:

> Just remember that with success, comes problems. Worms/Virii are certain
> to come to Linux as it achieves more success.

Well, I consider viruses to be an email/macro thing. While some project
might adopt the m$ insecurity model I think it will be a long time before
that is the norm on a *NIX platform.

Some applications are starting to use macros. At some point it might be a
problem, but I doubt it will be at the email client.

> The foresight/laziness issue is probably unfair - I think Microsoft had
> a great idea with an email client that could execute code - companies

That might be true, but executing images and plain text are foolish.
Whatever group did that obviously never took security or stability into
account. That wasn't adding functionality, that was only adding security
holes.

Open the file and examine it to find out if it is an image, don't execute i=
t
and see what happens. It's a data file, not an executable, so why do m$
programs execute them? I haven't yet seen anything saying they're fixing
this error. They're just suggesting using filters ( some of which are now i=
n
their code ) to avoid ( some of ) the exploits we know about.

> could distribute e-mails with active content - updates/registrations
> etc. The problem is that there are people who saw that as an
> opportunity.

Yeah, I want someone to be able to send me an email that'll turn my gas on
for an hour before lighting it. Great feature. :(

I agree that being able to send a non-text payload via email might've seeme=
d
like a good idea. It might've even been a good idea. It might, even now,
still be a good idea.

Having files execute before the user has asked them to be executed should'v=
e
been seen as a bad idea long before the products hit the market. That
should've definitely be shut down after the first virus exploiting it was
found. It's been years and they still haven't fixed the underlying problem.

People opening executables is a different matter. I disagree with it being =
a
good feature, but I can see the other side.

Having applications autoexecute stuff, especially randomly received stuff,
is not a good idea. Having applications autoexecute non-executables hoping
they're benign is stupid.

I agree that as GNU/Linux use grows there will be more attacks on its
security. It defintely within the black hat radar, though. The attacks are
already taking place. Exploits are more difficult, though.

cp myexploit.bat nekkid.jpg
mailscript -s 'LOOK!!! n A k E d people!!' --attach nekkid.jpg --addies peo=
ple_using_outlook.txt

:)

ciao,

der.hans
--=20
#  https://www.LuftHans.com/    http://www.AZOTO.org/
#  Help Jerry Lewis stamp out M$...oops that's MDA - der.hans