ietf
[Top] [All Lists]

Re: Denial of Service by Spamware?

2000-12-29 11:10:02
On Fri, 29 Dec 2000, Christopher Ambler wrote:

Knowing the software in question, it seemed pretty clear to me that this
was a case of user error. My virus scanning software doesn't send return
email. My vacation notices are configured to only send once to each
sender, and then only to senders on my "I'd like these people to know
I'm on vacation" list. I can't help but wonder why other users haven't
done the same. Nothing more, nothing less. 

I have to strenuously disagree with your premise, here ("user error"). 
The technical community, all too often, strikes me as user-hostile,
blaming many things on "the user"  (a.k.a. the I/O error -- Idiot
Operator). (Note that there are counterexamples both here and at large,
but I'm making a point :) ). 

When I say a piece of software is "broken", I usually do so for one or
more of a very few reasons:

        - it doesn't "do the right thing" by default
        - it doesn't let me make it "do the right thing"
        - it doesn't do anything right ;)
        - it's cumbersome and expensive to do anything beyond what
          the original designer considered "the right thing" (when
          there isn't already an accepted social definition of "the
          right thing", as there -is- in this case)

I'll bet you quite a large sum of money that, if Exchange Server, or
Outlook, or whatever, came configured out of the box with "excruciatingly
polite" vacation messages, there wouldn't be this furor. Consider this set
of rules from the qmail-vacation package, by Peter Samuel:

        vacation will not generate a reply if any of the following
        conditions are met:

                - The sender address includes the string -REQUEST(_at_)(_dot_)

                - The sender is you.

                - The sender's name is any of:
                        daemon
                        postmaster
                        mailer-daemon
                        mailer
                        root

                - The sender matches any of the mail addresses listed in the
                  optional files ~/.vacation.aliases and
                  ~/.vacation.noreply . See the FILES section below for
                  more details on these files.

                - There is a Precedence: bulk or Precedence: junk header.

                - There is a Mailing-List: header.

                - Your mail address, or any address you have listed in the
                  optional ~/.vacation.aliases file does not appear in
                  either the To: or Cc: headers. This feature can be
                  disabled using the -j option. See the OPTIONS section
                  below for more details on this option. 

                - An automatic reply has already been sent to the same
                  address during the last week. The timeout  value
                  may be changed using the -t option. See the OPTIONS
                  section below for more details on this option.

                - -n was specified on the command line and the user does
                  not have a ~/.vacation.messages file.


What I'm really getting at, here, is the notion of "graduated
stewardship". Simply put, out of the box, a system must behave as a
polite member of society. However, that system should also be able to be
shaped in the hands of a somewhat skilled user (such shaping power being
given in direct proportion to the user's adeptness, by way of increasingly
obtuse access vectors for increasingly obscure tweaks). Unless
specifically designed for such purposes, a system should not allow the
user to make it do something antisocial, when there is an accepted de
facto or de jure standard of social interaction.

It's easy to blame users for bad software, but it's simply not their
fault. Users, by and large, don't -have- and don't -want- the intimate
understanding of how everything works. They no more want to configure a
mail system before using it than they want to configure their car before
driving it. Getting tags and stickers, adjusting the seats and mirrors,
and cranking up the radio are analagous to getting IPs and DNS, setting up
user accounts, and changing the background wallpaper. People don't want to
be a mechanic or visit a mechanic before they're able to drive off the
lot.


Peace.

Through superior firepower ;)

-- 
   Joy-Loving * Tripp Lilley  *  http://stargate.eheart.sg505.net/~tlilley/
------------------------------------------------------------------------------
   "There were other lonely singers / in a world turned deaf and blind
    Who were crucified for what they tried to show.
    Their voices have been scattered by the swirling winds of time,
    'Cause the truth remains that no one wants to know."

   - Kris Kristofferson, "To Beat the Devil"





<Prev in Thread] Current Thread [Next in Thread>