Re: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Paul Vixie
Should ISPs control what applications their customers can run? frankly and truly, i would be satisfied if isp's wouldn't run outlook/exchange in their noc/abuse departments, so that they could safely accept mime-mail rather than bouncing it as their only means of keeping themselves virus-free.

Re: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Christopher L. Morrow
On Mon, 16 Jun 2003, Paul Vixie wrote: Should ISPs control what applications their customers can run? frankly and truly, i would be satisfied if isp's wouldn't run outlook/exchange in their noc/abuse departments, so that they could safely accept mime-mail rather than bouncing it as their

Re: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Matt Hess
why can't multibillion dollar companies figure that out? it does mystify me :) The only lame excuses I can come up with are possibly: laziness, stupidity, ignorance, complacency, fear of non-compliance (but I think that's a stretch) and perhaps the raccoon mentality of 'it's new and shiny - I

Re: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Paul Vixie
therefore 3) why would anyone ever run outlook i love outlook2003. no joke, i use it every day. whenever i get an attachment that seems reasonable and i need to open it, i put it in the folder that outlook can see, and i read it. i also share a calendar (in three directions) using

Re: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Brandon Butterworth
the thing that actually burns my hash, is when my spam complaints or noc correspondance are robotically bounced because they contain dangerous mime attachments of type message/rfc822 (spam examples) or text/plain (traceroute or tcpdump output). if your noc or abusedesk has such a robot

Re: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Jared Mauch
On Mon, Jun 16, 2003 at 03:43:41PM +0100, Brandon Butterworth wrote: the thing that actually burns my hash, is when my spam complaints or noc correspondance are robotically bounced because they contain dangerous mime attachments of type message/rfc822 (spam examples) or text/plain

RE: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Mark Borchers
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Brandon Butterworth Or they may be happy thinking their NOC is more 0day virus proof rather than hoping a 3rd party will update their scanner in time Who'd want to risk the NOC falling to the same

Re: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Christopher L. Morrow
On Mon, 16 Jun 2003, Paul Vixie wrote: therefore 3) why would anyone ever run outlook i love outlook2003. no joke, i use it every day. whenever i get an attachment that seems reasonable and i need to open it, i put it in the folder that outlook can see, and i read it. i also share

Re: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Brandon Butterworth
I think pauls point may be: If they use text based mailers I know, intrinsically safe is good but that's not what managment wants so you end up with bodges to make their choices safer. Some people may go too far It's a lot harder to open up a microsoft executable on a *nix

Re: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Paul Vixie
[EMAIL PROTECTED] (Brandon Butterworth) writes: I think pauls point may be: If they use text based mailers text based is not what i'd require. professional grade is the right term. that can be anything from xmh to eudora as long as it was written to stand up to the worst the

Re: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread William Allen Simpson
Christopher L. Morrow wrote: yea, if my sister in-law (who barely knows what 'computer' means most times) can come to the conclusion that: 1) all email viruses of note are outlook targetted 2) everyone with outlook gets viruses therefore 3) why would anyone ever run outlook why can't

Re: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Jack Bates
Paul Vixie wrote: text based is not what i'd require. professional grade is the right term. that can be anything from xmh to eudora as long as it was written to stand up to the worst the internet is capable of delivering to it. text based is my own preferred crutch but you don't need text based

RE: Mobile code security (was Re: rr style scanning of non-customers)

2003-06-16 Thread Herb Leong
As far as I could tell, the vector was AOL IM. So, it's not only M$ and outlook. Why oh why are vendors shipping with defaults like no restrictions on buddy downloads and execution? Hiya, The same reason why some linux installs were/are totaly open: They wanted it to work outta the box.