NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/comp/org/eff/talk/8506

Internet Message Format | 1993-01-09 | 6.1 KB

Path: sparky!uunet!haven.umd.edu!darwin.sura.net!gatech!concert!rutgers!cmcl2!panix!rpowers
From: [e-mail] (Richard Powers)
Newsgroups: comp.org.eff.talk
Subject: Re: Beneficial Virus?
Message-ID: <[e-mail]>
Date: 9 Jan 93 09:25:47 GMT
References: <[e-mail]> <[e-mail]> <[e-mail]> <[e-mail]>
Organization: PANIX Public Access Unix, NYC
Lines: 128

(I'm going to split this follow-up into two messages, as I think there
are two separate issues being discussed.)

In <[e-mail]> [e-mail] (Pete Hardie) writes:
>In article <[e-mail]> [e-mail] (Richard Powers) writes:
>>In <[e-mail]> [e-mail] (Pete Hardie) writes:
>>How would you not know it is in place?  You would have had to place it
>>there yourself.  Or at very least placed the marker file.

><sigh>

>It's a *multi-user* system.  Another user could have installed it.  I might
>NOT be the owner.

Ok, I should have been a little clearer on this.  _Someone_ had to
introduce the BCV to the multi-user system.  I am assuming that the
user that does this only has write permissions for files s/he owns.
The BCV will, of course, have the same privileges(sp?) as the owning
user.  If this user wants to transfer an executable file to another
user (or make it available to other users), then s/he should take the
exact same precautions as would an owner of a single-user system who
is transferring a file to a separate system without the BCV.

Is it clear how (IMO) a multi-user system does not have to be taken
into account as a separate case?

>Does the sysadmin at your school/business always tell you when s/he installs
>something new?  Swaps out one disk for another?  etc, etc.

You imply that a sysadmin would place a BCV on his system without
informing his users.  Either there is no reason for him/her to inform
his/her users, in which case; fine, no reason to worry.  Or else there
is a reason for the sysadmin to inform her/his users.  In that case
s/he should do so.  If the sysadmin fails to do so, it is the fault of
the sysadmin, not something inherent in the BCV.

>If I am a user on a multi-user system, and the admin has installed this BCV
>several years ago, I do not necessarily get *any* information about it or
>its presence onthe system.

(IMO this should not happen.  But anyway...)  Either one of two things
will occur.  (1) You never notice it is on the system.  It works fine,
and you never had a reason to edit an executable, etc.  In this case,
whats the difference?  (2) _Something_ that you didn't expect happens.
You noticed _some_ type of effect of the presence of the BCV.  Here
you ask a question of the sysadmin, and s/he says "Oh yeah.  Forgot to
tell you about that.  Heres how it works...".

>>IMO _if_ the existence of the virus will have any impact on the users,
>>the admin has an obligation to notify those users.  This is not the
>>same as a device driver.  With a device driver the effects should be
>>totally transparent to the user.  And again, if it is _not_
>>transparent, then the users should know.

>From the descriptions of the BCV, if the marker file is present, it *IS*
>totally transparent.

You can't have it both ways!  If it *IS* *totally* transparent, (AS
TRANSPARENT AS A DEVICE DRIVER), then there is no reason for the users
to know of its existence.  If there _are_, on the other hand, things
the user should be aware of, then the sysadmin should make the user
aware!

>How will I know, if I arrive after the installation
>of the BCV, that it is in place?

See above.

>>>>(1) Remove itself.  The BCV would decompress the file and then save it

>>>This would be the only ethical option for a 'beneficial virus', IMHO.

>>Not this method alone, IMHO.  If you have so much of your usable disk
>>space compressed that not everything will fit uncompressed, then this
>>method alone would be disastrous.

>If the marker file is gone, the re-compression code is gone, right?  Every
>executable will be decompressed over time, leading to this very state.

No, wait a minute.  This would happen if method (1), and only method
(1), was used when the BCV could not find the marker file.  That is
why I argued against your "...only ethical option.." statement.

_If_ the compression code is only in the marker file, and _if_ you no
longer have a backup or any other way of restoring the marker file,
then, yes your files will decompress if you told them to.  (I
advocated that the BCV ask the user what to do when the marker is not
found.  The user in this case would _not_ tell _every_ BCV-bearing
file to decompress until more/another storage media is found.)

[Deleted.  Replied to seperately.]

>>>It also makes it possible for a user to infect a system without the
>>>owner's knowledge.

>>I assume you are referring to method (4)?  I covered that above.  Read
>>the underlined again.

>No.  I meant that Joe User could install the virus and marker file on the
>multi-user system run by Mary Sysadmin.

But so what if he did?  If Joe User can write to anything other than
his own files, then Mary Sysadmin has more problems than someone
trying to compress executable files!  If he can't, then what is the
problem?

>>The whole idea has involved from the original to deal with a lot of
>>nitpicking problems.  The original context was a hypothetical concept
>>to refute the idea that a beneficial virus is inherently _impossible_.

>Define beneficial.  Now get 100 people to agree with you.

>That's the problem with a beneficial virus - we don't all agree that
>X action is always beneficial.

Aaaaargh!  It is irrelevant!  The only characteristic which a virus
exhibits that makes it different from other programs is
self-replication.  If everything else is equal, why should this factor
make the program suddenly evil?

(I know you disagree that "virus"=="self-replicating program".  I find
it hard to see your side on this.  Please read my post entitled "Virus
Definition".)

--
)                    )  I am more than this...  )               )
) [e-mail]  )                          )   Apathy...   )
)                    )      Continue...?        )               )