(bias indicator: i'm a microsoft basher; hate them, hate them!)
here's what i think...
when Ted said:
----
Personally, I'd say it's an embarassment to *Microsoft*. Let's
allocate blame where it properly belongs. They were the ones who made
the mail reader which made these sorts of viruses possible....
----
i thought, "well, *i* can't complain; i'm certain there's at least one CERT
advisory on buffer overflow in, say, telnetd, that's my fault."
and, it occurred to me (as it has to many, i'm sure) that microsoft is
targeted so much because, in the immortal words of Milo Medin, they have a
larger ballistic cross-section (i think i got that expression right).
Randy said:
----
from the outside, it appears as if microsoft consciously decided to
distribute software with everything enabled so that their product
would be perceived as very easy to use. the problem is that this
means it is also easy to abuse. so the net is now paying for them
having a more salable product. who gains, who is bearing the cost?
----
and i think, well, to be fair, that's been a problem almost *all* companies
getting into networking have had, even (i think) the early router companies.
at kinetics (an early [mostly macintosh] router company), we constantly had
tension between "plug and play" for home/small office users and "it ain't on
the net till i bloody well say it's on the net" from sysadmins in large sites.
(someone quoted Cuckoo's Nest as saying the same about mid-1980's Unix boxes
and that might be true, too; certainly i think ``ipforwarding'' was set to 1
by default for a long time.)
again, in fairness, i think this is an issue that takes a while for a
corporate culture (*any* not-already-heavily-internet-imbued corporate
culture) to incorporate. so, i can't blame microsoft for not getting it (but,
it would be good for them to get it as soon as possible!).
now, maybe there are many subtleties i don't see (undoubtedly there are).
but, as much as i like bashing Microsoft, on this particular point i am "first
stone inhibited". and, know that whatever is the biggest target is going to
take the most (in number and in sophistication) shots.
(i also, in total ignorance, have a tinge of wonder as to whether something we
haven't yet defined in MIME, or something we defined incorrectly, might have
some bearing on this. i can't define that any better than that, though it
seems maybe there could be some way of marking "this part will be executed".)
cheers, Greg Minshall (happy FreeBSD user)