<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:creativeCommons="http://backend.userland.com/creativeCommonsRssModule"
	>
<channel>
	<title>Comments on: sobig.f on a rampage</title>
	<atom:link href="http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/feed/" rel="self" type="application/rss+xml" />
	<link>http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/</link>
	<description>Just another Weblogs at Harvard Law School weblog</description>
	<lastBuildDate>Fri, 27 Nov 2009 10:50:57 -0500</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.4</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Used Cellular Phone</title>
		<link>http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/comment-page-1/#comment-9</link>
		<dc:creator>Used Cellular Phone</dc:creator>
		<pubDate>Sat, 10 Sep 2005 14:10:20 +0000</pubDate>
		<guid isPermaLink="false">http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/#comment-9</guid>
		<description>&lt;a&gt;&lt;/a&gt;

Cellular Phone Battery</description>
		<content:encoded><![CDATA[<p><a></a></p>
<p>Cellular Phone Battery</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Sofia</title>
		<link>http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/comment-page-1/#comment-7</link>
		<dc:creator>Sofia</dc:creator>
		<pubDate>Wed, 24 Aug 2005 16:22:50 +0000</pubDate>
		<guid isPermaLink="false">http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/#comment-7</guid>
		<description>&lt;a&gt;&lt;/a&gt;

Thank you for the info. http://www.bignews.com</description>
		<content:encoded><![CDATA[<p><a></a></p>
<p>Thank you for the info. <a href="http://www.bignews.com" rel="nofollow">http://www.bignews.com</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Jesse Ross</title>
		<link>http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/comment-page-1/#comment-27</link>
		<dc:creator>Jesse Ross</dc:creator>
		<pubDate>Thu, 21 Aug 2003 16:49:22 +0000</pubDate>
		<guid isPermaLink="false">http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/#comment-27</guid>
		<description>&lt;a&gt;&lt;/a&gt;

Rules are definitely the most useful way to deal with this.  Hoops, I like the idea of doing it on the server-side.  Since Sobig.F emails have a very definite, identifiable set of characteristics, this could be done system-wide, rather than have every user duplicate essentially the same ruleset on their own machines.  Procmail comes to mind as a free way to do this.

And it&#039;s definitely worth noting that Sobig.F doesn&#039;t affect Mac or Linux or anything else (although who knows what would happen if you ran it in WINE or some Mac Windows emulatro).

We love free software here at the Berkman Center, but this problem is bigger than security holes in Windows.  As I understand it, Microsoft software does tend on the whole to be less secure than software libre, but the reason we see viruses specializing in Windows is that there are so many more Windows machines out there in the world.  No programmer or set of programmers can achieve perfection, and there are security holes in Linux too - at least once a week I have to patch some Linux program.  

But there are definitely plenty of people who administer software-libre machines and don&#039;t install patches, just like there are people who administer Windows machines and don&#039;t bother patching.  Especially those cursed home users! :)  If everyone started using Linux or GNU or BSD or whatever, two things would happen.  First, software libre systems would become more attractive targets for virus programmers, and all their evil genius would go into battering at free prgorams.  Second, the viruses and worms that infect these systems would have a much richer ecosystem to exploit - there&#039;s no reason in theory why a free software worm couldn&#039;t be just as bad as Blaster, or a free-software virus just as bad as Sobig.F.  For instance, the 1988 &quot;&lt;a href=&quot;http://info.astrian.net/jargon/terms/g/Great_Worm.html&quot;&gt;Great Worm&lt;/a&gt;&quot; crippled the internet for a while, long before Microsoft had bothered implementing TCP/IP.</description>
		<content:encoded><![CDATA[<p><a></a></p>
<p>Rules are definitely the most useful way to deal with this.  Hoops, I like the idea of doing it on the server-side.  Since Sobig.F emails have a very definite, identifiable set of characteristics, this could be done system-wide, rather than have every user duplicate essentially the same ruleset on their own machines.  Procmail comes to mind as a free way to do this.</p>
<p>And it&#8217;s definitely worth noting that Sobig.F doesn&#8217;t affect Mac or Linux or anything else (although who knows what would happen if you ran it in WINE or some Mac Windows emulatro).</p>
<p>We love free software here at the Berkman Center, but this problem is bigger than security holes in Windows.  As I understand it, Microsoft software does tend on the whole to be less secure than software libre, but the reason we see viruses specializing in Windows is that there are so many more Windows machines out there in the world.  No programmer or set of programmers can achieve perfection, and there are security holes in Linux too &#8211; at least once a week I have to patch some Linux program.  </p>
<p>But there are definitely plenty of people who administer software-libre machines and don&#8217;t install patches, just like there are people who administer Windows machines and don&#8217;t bother patching.  Especially those cursed home users! <img src='http://blogs.law.harvard.edu/geekroom/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' />   If everyone started using Linux or GNU or BSD or whatever, two things would happen.  First, software libre systems would become more attractive targets for virus programmers, and all their evil genius would go into battering at free prgorams.  Second, the viruses and worms that infect these systems would have a much richer ecosystem to exploit &#8211; there&#8217;s no reason in theory why a free software worm couldn&#8217;t be just as bad as Blaster, or a free-software virus just as bad as Sobig.F.  For instance, the 1988 &#8220;<a href="http://info.astrian.net/jargon/terms/g/Great_Worm.html">Great Worm</a>&#8221; crippled the internet for a while, long before Microsoft had bothered implementing TCP/IP.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Hoops MacCann</title>
		<link>http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/comment-page-1/#comment-26</link>
		<dc:creator>Hoops MacCann</dc:creator>
		<pubDate>Thu, 21 Aug 2003 06:31:36 +0000</pubDate>
		<guid isPermaLink="false">http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/#comment-26</guid>
		<description>&lt;a&gt;&lt;/a&gt;

By setting up about six rules fo rmy incoming mail, I was able to delete the mail off the webserver before I used my email client to download check email. Seems to be working okay, so far.</description>
		<content:encoded><![CDATA[<p><a></a></p>
<p>By setting up about six rules fo rmy incoming mail, I was able to delete the mail off the webserver before I used my email client to download check email. Seems to be working okay, so far.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Ernie Oporto</title>
		<link>http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/comment-page-1/#comment-25</link>
		<dc:creator>Ernie Oporto</dc:creator>
		<pubDate>Wed, 20 Aug 2003 17:13:29 +0000</pubDate>
		<guid isPermaLink="false">http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/#comment-25</guid>
		<description>&lt;a&gt;&lt;/a&gt;

I strongly recommend the &quot;don&#039;t open attachments from people you don&#039;t know&quot; advise.  It makes the biggest difference.  I never get viruses because of it, but I see people that don&#039;t follow that rule are always opening attachments.  Keeping the Preview Pane active in Outlook is also bad bad bad.

To prevent address harvesting from web pages, it would be good to have a sugarplum link to something like WPoison which the screen scraping scripts will get stuck in.  Check out http://www.monkeys.com/wpoison/ and http://www.shokk.com/cgi-bin/wpoison.pl.</description>
		<content:encoded><![CDATA[<p><a></a></p>
<p>I strongly recommend the &#8220;don&#8217;t open attachments from people you don&#8217;t know&#8221; advise.  It makes the biggest difference.  I never get viruses because of it, but I see people that don&#8217;t follow that rule are always opening attachments.  Keeping the Preview Pane active in Outlook is also bad bad bad.</p>
<p>To prevent address harvesting from web pages, it would be good to have a sugarplum link to something like WPoison which the screen scraping scripts will get stuck in.  Check out <a href="http://www.monkeys.com/wpoison/" rel="nofollow">http://www.monkeys.com/wpoison/</a> and <a href="http://www.shokk.com/cgi-bin/wpoison.pl." rel="nofollow">http://www.shokk.com/cgi-bin/wpoison.pl.</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Dan Lyke</title>
		<link>http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/comment-page-1/#comment-24</link>
		<dc:creator>Dan Lyke</dc:creator>
		<pubDate>Wed, 20 Aug 2003 16:53:08 +0000</pubDate>
		<guid isPermaLink="false">http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/#comment-24</guid>
		<description>&lt;a&gt;&lt;/a&gt;

It&#039;s interesting to watch the spread of viruses. I don&#039;t use Windows for my email, so I haven&#039;t been infected by any of the big ones, but I&#039;ll notice that I get hit hard by things like the &quot;I love you&quot; virus, but I&#039;ve only seen the Harvard bloggers complaining about this one.

So, anyone out there want to do a study about which sorts of people are susceptible to which sorts of text to get you to open the virus payload? What do AOL users fall for versus what academics fall for versus what lawyer&#039;s offices fall for?</description>
		<content:encoded><![CDATA[<p><a></a></p>
<p>It&#8217;s interesting to watch the spread of viruses. I don&#8217;t use Windows for my email, so I haven&#8217;t been infected by any of the big ones, but I&#8217;ll notice that I get hit hard by things like the &#8220;I love you&#8221; virus, but I&#8217;ve only seen the Harvard bloggers complaining about this one.</p>
<p>So, anyone out there want to do a study about which sorts of people are susceptible to which sorts of text to get you to open the virus payload? What do AOL users fall for versus what academics fall for versus what lawyer&#8217;s offices fall for?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Mark Nottingham</title>
		<link>http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/comment-page-1/#comment-23</link>
		<dc:creator>Mark Nottingham</dc:creator>
		<pubDate>Wed, 20 Aug 2003 16:38:35 +0000</pubDate>
		<guid isPermaLink="false">http://blogs.law.harvard.edu/geekroom/2003/08/19/sobigf-on-a-rampage/#comment-23</guid>
		<description>&lt;a&gt;&lt;/a&gt;

Thanks - this was very helpful.

[[[Everyone knows not to open attachments with extensions like .exe and .bat.  However, Sobig.F uses .pif and .scr as its filename extensions. Don&#039;t open attachments with these names either.]]]

This should be qualified with &quot;If you use Microsoft Windows,...&quot; The whole world doesn&#039;t use it (yet).</description>
		<content:encoded><![CDATA[<p><a></a></p>
<p>Thanks &#8211; this was very helpful.</p>
<p>[[[Everyone knows not to open attachments with extensions like .exe and .bat.  However, Sobig.F uses .pif and .scr as its filename extensions. Don't open attachments with these names either.]]]</p>
<p>This should be qualified with &#8220;If you use Microsoft Windows,&#8230;&#8221; The whole world doesn&#8217;t use it (yet).</p>
]]></content:encoded>
	</item>
</channel>
</rss>
