🚀 go-pugleaf

In article <DD4CK2.3F9@wombat.hanse.de>, root@wombat.hanse.de (Bernd
"Bernie" Meyer) wrote:

> nevin@CS.Arizona.EDU (Nevin ":-]" Liber) writes:

> >Yea, and the Internet Worm never happened, too. :-(

> Also, this was an honest to God programming _mistake_ that happened. It
> wasn't a backdoor. Had it been a backdoor put there intentionally, the
> author of said piece of code would have lost all his credentials in an
> instant, and probably have faced a number of lawsuits. And evidence would
> have been at hand quite easily.

I hate to break it to you, but the sendmail attack (one of three attacks
the worm used) was possible because of a backdoor.  Quoting from Bob
Page's report on the Internet Worm
(gopher://coast.cs.purdue.edu:70/00/.gopher/doc_tool/doc/morris_worm/worm.paper):

"In the sendmail attack, the worm opens a TCP connection to another
machine's sendmail (the SMTP port), invokes debug mode, and sends a
RCPT TO that requests its data be piped through a shell."

The debug mode is a backdoor by design, plain and simple.  Because it was
there for "friendly" purposes, no one faced a lawsuit over it.  That's the
great thing about putting code in the public domain:  you don't have to be
responsible for anyone misusing it.

> So yes, I prefer to trust utilities with source available. 

I trust that, as well as trusting companies that have a lot to lose when
they get caught doing illegal things, especially if the gain by doing that
covert thing is marginal at best.
-- 
        Nevin ":-)" Liber       nevin@CS.Arizona.EDU    (520) 293-2799
                                                office: (520) 621-1815