On Tue, 2010-04-20 at 20:34 -0700, Jim Preston wrote: > Well, prosecution would be justified if ClamAV had actually done > something illegal.
They did. Releasing 'code' that they new had a potential to harm or interfere with the operation of systems. It's a clearly defined CRIMINAL offence in my part of the world. I suspect that this state of affairs is also true in the USA if the case of Gary McKinnon is used as a point of reference. Perhaps, Jim, you would like to offer the name and address of the person pushing this code out if it does not bother you at all? I'm sure there are a few pissed people in the UK and Europe who would like to even the score up on behalf of Gary McKinnon. It is also clearly a case of blackmail. 'If you don't do this, I will break that' - again, that is a criminal offence in most parts of the civilised world. (I do accept that this may have been the work of *Americans* who may have lower moral and ethical standards than the rest of the world). The correct thing to do would be to warn users of older versions that no update was possible, leaving it running. Not to deliberately and purposely crash it, and anything that depends on it. The mechanism clearly exists to do that, no??: WARNING: Your ClamAV installation is OUTDATED! WARNING: Local version: 0.94.2 Recommended version: 0.96 It was notable to see the difficulty people had trying to update. Try googling this: 'update clamav', first hit: http://www.clamav.net/lang/en/ Now, from that link, try and find instructions on *how* to upgrade. It's pretty appalling to find the info needed. It's fair to say You've had a number of months to make sure that good, easy to find information is easy to find in order to match the carnage you knew it would create for some people. Sure, there is an email support list, but when clam has crashed your mail server, that's about as much use as a chocolate tea pot. But in all of this ding dong something else rather amazing strikes me. In a world of over 6 billion people there was not much noise made about this in real terms, which may suggest just how insignificant CLAM is as a project - this rather amuses me given the clear intent of breaking systems was, in my view, more sinister. I hold the opinion that it was, in part, an attempt to get people to notice CLAM and how they depend on it, and in reality only a handful of people in this big wide world even noticed it. It did not even make news anywhere. In fact, all it has done is piss off a few people who may well stop using it - after all, it's mostly only protecting windows machines at the gateway, and it does such a poor job of it they all tend to rely on local AV anyway. Save the clock cycles and future hassle and ditch it being plausible advice. I'm sure the big players like Trend & Barracuda who sell CLAM in their own products were not hurt by this spiteful, malicious and wicked act. Nor was I. I guess they are used to issues with CLAM having to make daily apologies for all the stuff it misses, let alone this little moment in it's history. The people who probably suffered were just a chunk of small businesses struggling to make ends meet, tiny clinics in the middle of Africa hanging off a dial-up, or other groups with not much money or time. I'm sure they really needed the hassle of this on top of everything else. I do hope your mother would be very proud of you :-) _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
