Re: Anti-MS drivel

[Valdis.Kletnieks () vt edu]

On Mon, 19 Jan 2004 19:58:15 EST, "David F. Skoll" said:

> It's pathetic that 17 years after CHRISTMA EXEC, hundreds of thousands of
> Windows machines are succumbing to the same easily-preventable security flaw.

What's even MORE pathetic is that even 17 years ago, CHRISTMA EXEC required for
you *first* to receive the file from your "reader" space to your disk space,
and *then* to invoke it as a command.  So that's the equivalent of first saving
an attachment from an e-mail into a directory, and then going and finding the
file in the directory and launching it.  At that point, there's not much you
can do if you're going to allow attachments at ALL. (Also, IBM quickly released
a set of patches against RSCS (the communications subsystem in use for VNET and
Bitnet) that allowed filtering of filename/filetypes, with either quarantining
or renaming of the files - so a site admin could make CHRISTMA EXEC end up
being called CHRISTMA CEXE, which then wouldn't run unless the user manually
renamed it back.)

The other interesting thing was that although CHRISTMA EXEC went on quite the
burn then (I should know, I was the admin of a VM system on Bitnet at the time
;), the user community *learned*, and although there were 5-6 subsequent
copycat programs, they were nowhere near as widespread.  However, today people
will *still* click on unknown stuff....

Moral of the story - in the past 2 decades, the users have gotten stupider, and
many of the software designers have as well.....

Attachment: _bin
Description: