[OT] Virii on vger.kernel.org lists

[William Scott Lockwood III]

Hello Riley!

As I said in another post on the list,

"http://www.mcafeeb2b.com/naicommon/buy-try/try/products-evals.asp

Go there, select your language and LINUX, and you will get a survey to
fill out that then lets you test drive their stuff for linux."

I don't feel that I am particularly blasé, but I will concede that you
have several good points.  My main point was that people seem to be more
interested in the server doing the scanning for them rather than taking
responsibility for their own (lack of) security.  Your view point is
just as valid.

And I don't think your experience with McAfee as reported is typical at
all.  If it was, I'd still be having problems, and NAI would be out of
business.  How long ago was this?  What version of the product?   What
OS?  How did you update?  What 14 Virii were you hit with?  Did you
contact McAfee for support?  I'd be very interested to get more details
about this.

Regards,
Scott

----- Original Message -----
From: "Riley Williams" <[e-mail]>
To: "William Scott Lockwood III" <[e-mail]>
Cc: "Matti Aarnio" <[e-mail]>; "Linux Kernel"
<[e-mail]>
Sent: Tuesday, July 31, 2001 5:41 PM
Subject: Re: Virii on vger.kernel.org lists

| Hi William.
|
|  > Of course, non of the common "holes" in OE are left unfixed.
|  > People should be responsible to update their mail clients.
|  > People using Windows (like me) should also be responsible to
|  > maintain current virus software themselves, rather than leaving
|  > that job to the mail server, which seems like an unfair burden
|  > on the mail server to me.
|
| Depends how you view it - I'd much rather host my mailing lists on a
| server that I knew scans for virii and deals with any it finds than
| one that doesn't.
|
|  > I personally use McAfee, as it will auto update itself
|  > periodically if you tell it to. Using OE as patched, and McAfee,
|  > Virii like the one that just hit are not a problem - they are
|  > caught and killed before they can execute...
|
| McAfee isn't a guarantee, no more than any other virii scanner is. I
| used to use McAfee, and had it in auto-update mode. I still got hit by
| FOURTEEN virii within half an hour of it updating itself!
|
|  > I got hit once (and if you search through the archives, you'll
|  > find a message from me about it - one that I caught holy hell
|  > from many of you for, but anyway) and learned from that incident
|  > to secure my system. It has not happened since, and won't if I
|  > am careful.
|
| Even if you're careful, you can still get hit, so don't rest on your
| laurels...
|
|  > The user has the responsibility to be careful, I think. Not the
|  > list server.
|
| My own viewpoint is somewhat less blase than yours - the more virii
| scanners between the originator and me, the lower the likelihood of my
| systems getting a virii.
|
|  >> Is there any way we can set up an automatic virus scan of all
|  >> attachments at vger, and have it deal with any virii at source?
|
|  > Yes.
|
|  >> Come to that, is there a decent Linux-based virus scanner around?
|
|  > Yes.
|
| Perhaps you'd care to give details, since you're so blase about it...
|
|  >>> It is analogous on how I am seeing the UNRELIABILITY of people's
|  >>> email systems. I see only failure cases, never succesfull
|  >>> deliveries!
|
|  >> Same here...
|
|  > No, you both miss the point.
|
| Oh?
|
|  > Some PEOPLE are ignorant or unreliable...
|
| Whether people are ignorant or unreliable has about as much to do with
| whether their computers can catch virii as with whether they can. The
| only people likely to claim otherwise are virii writers, IMHO.
|
|  > The email system performs exactly as instructed, no matter if it
|  > runs on Linux, or *BSD, or Mickey$oft.
|
| The basic point of this duscussion is that the email system's
| instructions are flawed and need changing.
|
| Best wishes from Riley.
|
|