Message-ID: <3BB86BA2.B123ACAE@idb.hist.no>
Date: Mon, 01 Oct 2001 15:12:02 +0200
From: Helge Hafting <helgehaf@idb.hist.no>
MIME-Version: 1.0
To: hps@intermeta.de, linux-kernel@vger.kernel.org
Subject: Re: [Moving rapidly away from LKM] (Was: Re: [OT] New Anti-Terrorism Law 
 makes "hacking" punishable by life in)
In-Reply-To: <HBEHIIBBKKNOBLMPKCBBIENPDNAA.znmeb@aracnet.com> <3BB82DA9.34499802@idb.hist.no> <9p9l5d$r8e$1@forge.intermeta.de>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org

"Henning P. Schmiedehausen" wrote:
> 
> Helge Hafting <helgehaf@idb.hist.no> writes:
> 
> >And the one to blame here isn't the virus writer.  The ones to blame
> >are:
> >1. Whoever decided to install that vulnerable software.
> 
> "The ones to blame are not the people that build the bombs.
Oh, they too.  They too.  My first sentence was wrong, I'm just
trying to say that increasingly harder punishment against
_dead easy_ crime won't work.  And that people actually are
responsible for taking simple precautions.  


> The ones
> to blame are the people that live in normal houses with normal locks
> or even let their doors open instead of living in fortified bunkers
> and shoot everyone on sight".

I am not that extreme.  But if someone leaves their car with the engine
running all day they are stupid and shouldn't be surprised when
it is stolen.
Someone who leave a unattended company car with the engine running 
deserve to get fired when it is stolen.  This is neglect.

Of course the thief is a criminal too, and the worst one.  But
not taking any precautions is neglecting responsibility.

[...] 
> Fact is: Most companies don't install IIS just because they're
> Microsoft slaves. They install it, because another 3rd party
> application that depends on yet another application that needs another
> piece of software to run is only available on (you may already have
> guessed it) WIN32. OLE, Visual Basic and all the heavily glued
> together windows stuff. That is what drags people to the WIN32.
> And once you're here, you use IIS. Not Apache. Not iPlanet.
> 
You can run your internet server on windows.  Nothing inherently
wrong in that.  But then you'd better put a good firewall in front 
of it.  And you'll run the latest virus checkers.  And you'll
turn _off_ particularly unsafe "features".  Windows servers can
be safe, but many aren't.

Not doing this is like storing your money in a heap on the street.
A thief taking your pile is still a thief but there is less
punishment because he didn't break in or threaten anybody.  

Helge Hafting
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/