If Microsoft spent half as much time...

[Chris]

...debuggin Internet Explorer and IIS as they do trying to stop people from thinking Bill Gates is spamming them perhaps they wouldn't have the problems they do.

http://www.cnn.com/2004/TECH/interne....ap/index.html

Seriously, it's spam...who cares. In Pine all I have to do is type a "d" and it's gone. Delete works well on other programs.

My problem with this "initiative" is that it fucks end users that use one account and forward multiple accounts into it. All of my addresses dump to the same inbox and then I send replies or new mail from the appropriate alias, but also from that same account. Under the MS plan, I couldn't do that.

The REAL problem with spam, people using open-relays on mailservers and chewing up the bandwidth on the server side, really wouldn't be addressed by ANY of these plans as far as I can tell.

Am I off base here, or does this seem like a lot of work, money, and time to deal with a problem that is a minor annoyance at best?

[Grifter]

I don't care about spam much either. It's annoying and when I have kids I would rather not have porn spam showing up in the mailbox, but it's not really that bad. Of course I've been using Eudora for the last few months and that has made things 100x better since setting up a few rules sends 98% of the spam to the Junk folder.

So...use Eudora.

[Xodia]

Eudora is indeed a quality program. It brings back memories of my old piece of crap Performa.

Spam only bothers me during the big outbreaks of internet worms. Generally spam can be somewhat entertaining to read ("Grow your Penis 15" Longer!"), but when I suddenly get 15 messages with "Hello" in the subject line its just annoying.

[Clp727]

In the security classes that I am taking, we set up virtual machines running Win2K server and XP pro. After performing a default set up on both OSs, we then installed all patches and updates. We then used the MS Baseline Security Tool from MS. We downloaded v2.? and installed it. The download that we installed contained a corrupt cab file. This was downloaded from MS's webpage. We then had to find and install v1.1.1. so that we could do the lab project. The point is, Microsoft definately has more issues than SPAM. The Windows OSs are full of security flaws, as all of you know. I was amazed. We also installed and ran the IIS Lockdown tool. We did our best to secure the OSs, and secure our small classroom network against intrusion. SPAM was the least of our problems.
The Instructor still got in.... :(

[skroo]

We also installed and ran the IIS Lockdown tool. We did our best to secure the OSs, and secure our small classroom network against intrusion.

The real problem here is how most places approach teaching a classroom full of students how to install Windows, particularly in a server environment.

I've noticed that what tends to happen is that a great deal of emphasis is placed on partition selection and setup, DNS, user configuration, IIS, and patching - but very little on post-install configuration in terms of making the box more secure. Patching and running the tool o' the week such as IIS Lockdown or MBSA (neither of which is particularly thorough) is taken as the gospel answer to security. Hint: those 'Everyone' permissions on C:\IISROOT are a Bad Thing (for starters).

You're lucky in that your instructor made a point of proving people wrong - most places don't go that far, which probably goes some way towards explaining the number of rooted IIS boxes out there.

[Adrenaline]

I've noticed that what tends to happen is that a great deal of emphasis is placed on partition selection and setup, DNS, user configuration, IIS, and patching - but very little on post-install configuration in terms of making the box more secure.

Agreed, that's definitly something I've noticed as well, it's all of that and then maybe 'oh, and after that's all done do a windows update', and then just installing things like dns and AD and their default config's and and how to maybe configure them a little, and with that they believe they've taught them everything they need to know for a real world environment, but there never is any emphasis on teaching how to secure any of it at all.

in which case the typical guy out of one of those schools does the install's like he learned, only to get on and do his updates only to get the blaster virus and god knows what else 5 seconds later.

[bascule]

I just don't see how cobbling anything more onto SMTP is going to solve the spam problem. Personally I'd just prefer to migrate to a new mail architecture... one which would solve not only the spam issue, but all the additional issues plaguing SMTP, such as the infeasability of large (i.e. 100,000+ subscriber) mailing lists, or the sheer load placed on SMTP mailservers in general (which, admittedly, comes largely from spam).

I'm more interested in attempts to develop Dan Bernstein's IM2000 concept, which has seen a few implementation attempts.

[Chris]

I just don't see how cobbling anything more onto SMTP is going to solve the spam problem. Personally I'd just prefer to migrate to a new mail architecture... one which would solve not only the spam issue, but all the additional issues plaguing SMTP, such as the infeasability of large (i.e. 100,000+ subscriber) mailing lists, or the sheer load placed on SMTP mailservers in general (which, admittedly, comes largely from spam).

My point exactly bascule. It appears to be yet another case of "the vendors" making things more difficult on end users with a half assed workaround rather than actually fixing the problems at their core.

Anyway...some spam is good. I got a great one the other day for one of the Viagra clones that the foreign dude that mass emailed it had typed in his native language and then run through babel fish to send out. The translation was hilarious...I am pretty sure I saved a copy, I'll try to find it and post it here..

[//::HoPpeR::\\]

In the security classes that I am taking, we set up virtual machines running Win2K server and XP pro. After performing a default set up on both OSs, we then installed all patches and updates. We then used the MS Baseline Security Tool from MS. We downloaded v2.? and installed it. The download that we installed contained a corrupt cab file. This was downloaded from MS's webpage. We then had to find and install v1.1.1. so that we could do the lab project. The point is, Microsoft definately has more issues than SPAM. The Windows OSs are full of security flaws, as all of you know. I was amazed. We also installed and ran the IIS Lockdown tool. We did our best to secure the OSs, and secure our small classroom network against intrusion. SPAM was the least of our problems.
The Instructor still got in.... :(

microsoft has more problem then just spam. i think bill gate sould trash xp pro and all of the window os

[noid]

you're an idiot. I wasnt going to feel better till I said that. Now go take your uninformed trolling elsewhere.

[ndexsrvr]

I'd like to try to stay out of OS holy wars as much as possible.

I empathize with people who have to support Windows environments to pay the bills.

There has to be an assessment of risk. It's not your personal assessment of whether a platform is a danger to civilized computing or not but (in the real world) a professional assessment of the best possible compromise of price, performance (SLA's) and risk reduction.

It's a "nice idea" for M$ to provide a "lockdown tool" for their platform. It would be much nicer if it didn't need a lockdown tool before you dare to turn it up on a production network and download the lockdown tool. In other words, I'm agreeing with a part of the "idiot" assessment. Once you've put an unhardened system on an open wire, it's too late. In the wild a windows box isn't safe for even 5 minutes.

There is no such thing as perfect security but you *can* have effective security. If you have no choice but to implement an insecure platform in a high risk environment, do your homework first, use logic and common sense.

Every process running on a production system should be able to 'justify it's reason for existence'. Try that on a windows box... we won't wait. No system should be put into production without a proper QA cycle to determine if it operates within acceptable tolerances for risk. This doesn't happen at M$ before they ship " that's what .0 releases are for" and yes, that's a quote from an M$ PM years ago. The fact that proper QA almost never happens before deployment is lamentable but that's the way it is, for now.

</soapbox>

-ndex

[astcell]

Of course supporting windows is good. That's like having the only tow truck company on a highway covered with nails. And all the drivers have bald tired.

One day OSes will be easy and Administrators will go the way of the elevator operator and the projectionist.