🚀 go-pugleaf

>From:    fc@turing.duq.edu (Fred Cohen)

>	I am quite astounded by the concept that creating viruses in
>the privacy of my home should offend anti-virus types. 

We can draw some parallels here with genetic research. I have nothing
against experimentation with proper safeguards and have no doubt that 
yours are probably better than most *but you didn't say so*. I am sure 
that as a professional you have the capability to create a virus that
would be *very* difficult to detect as can any number of others. The 
difference is that I am reasonably sure that they *won't*.

I have a great deal of respect for your abilities but feel that such 
ability also carries an ethical responsibility that needs to have
equal weight and cannot be taken for granted.

>And I take it from
>some of the comments that these researchers have NEVER created a virus
>of their own to explore the concept!  It's sad that people who have
>never tried it feel free to condemn it.  Or have they done it and
>simply don't have the integrity to admit it?

This is true - I have never felt the need to create a fully functional
virus. Like most, I have examined quite a few and thought "I can do that
better" however everything I needed to prove could be done with code
fragments that provided a "proof of principle", some of which can be
found in my software - how many viruses can infect all four major
floppy sizes without problems of any kind ? SafeFBR and FlopSec can but 
are not viruses - or possibly they do meet *your* definition ?

IMHO what makes a virus a virus (e.g. the propagation function) is so
simple as to be trivial and not interesting at all.

>	ASP has already introduced one virus-based commercial product
>(which has never been detected as a virus by any scanner) which
>operates quite well, and we are in the process of creating another
>virus-based product designed to operate in LANs.  Our users don't seem
>to be offended by the optimization of resource utilization, automated
>distribution and installation, high reliability, and small space used
>by our products based on viruses...

Thought we explored this subject on Virus-l last year and the concept
was found to be a good one so long as the user was notified of what 
was happening and given the opportunity to decline (and be logged off).

I know of several antivirals that use this technique and have for some 
time.

I expect that the real question is one of sematics. There is a place for
controlled rules-based self-progagating code. There is no excuse for
code that propagates without control or that attempts to disguise the act
of propagation. From what I have seen of your vritings, what is being
called a virus is really a program that modifies other programs *designed
for that purpose*. 

Malicious software (what we call viruses) on the other hand, modify 
programs that were not intended to be modified, often disrupting 
systems as a result.

Like  was said, sematics, but not only are you using terms out of the 
generally accepted context, you are not defining your meanings, at least 
not for this audience.

I know, I have often made the statement "review the literature", but then
have tried to only quote readily available sources (usually ones I have
found at Walden's or B. Dalton's) and cite the reference.

Possibly this seems harsh but is meant to be constructive. We know that 
you are brilliant but seem immune to the outside world, striking out
with provocative statements designed to dazzle (or is it baffle ?). Please,
if you are going to post, take the time to learn the net's language. 

>p.s. considering the people who agree with my recent postings, I may
>have been wrong - nah - you know you're not saying much when everyone
>agrees with you - the lemmings to the sea thing and all.

As counterpoint: "In order to ask the question, you must already know most 
of the answer".

					Warmly,
						Padgett