Full Disclosure mailing list archives

Re: New therad: sasser, costs, support etc alltogether


From: "Gregory A. Gilliss" <ggilliss () netpublishing com>
Date: Fri, 14 May 2004 11:40:53 -0700

^wrongdoing^evildoing and you could use this to justify another Bush war :-)

G

On or about 2004.05.14 17:27:48 +0000, Radule Soskic (rms () telekom yu) said:

I can't post this to all the threads that I would like to, so I'm
opening a new one. 

Follow this:

1. MS is wrongdoing by releasing (and charging for use of) software that
has bugs in it. Users of such software have losses in time/money by
trying to keep up with applying pathches, or just by trying to keep the
uptime high.

2. Admins are wrongdoing by not applying patches to the systems they
maintain. There are losses tied to such misspractice, too.

3. Worm authors are wrongdoing by writing software that propagate
through the networks by exploiting all of the above. Again, the losses
occur in time/money spent to remove the worms from the systems affected.

It is obvious that almost every legal system in the world treats #3 as
crime, while #2 and #1 are broadly tolerated. Noone here is against the
book of law, but it just seems to be in contrast to the natural and
intuitive feeling of justice that majority of people might have
regarding the issues like these. See - only one of the three wrongdoers
is being punished. 

Is it right? Or - is it wrong? 

BTW, I have a funny feeling that damages/losses caused by #3 might very
often be far less than the ones caused by #2 and #1. 

Am I alone?

cikasole



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

-- 
Gregory A. Gilliss, CISSP                              E-mail: greg () gilliss com
Computer Security                             WWW: http://www.gilliss.com/greg/
PGP Key fingerprint 2F 0B 70 AE 5F 8E 71 7A 2D 86 52 BA B7 83 D9 B4 14 0E 8C A3

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Current thread: