YourDoom.A arrives

A NEW VARIANT of the MyDoom.X varieties arrived this morning, carried in a box by the postman. The box, ticking while smelling of vinegar and rotten eggs, seemed to be ready to open. We spun the box around, and opened the top. Paying no attention to the lit fuse and ignoring the odd message “This is C4, run for your lives!”, we pulled what appeared to be a bocce ball with the lit fuse. We shook the ball, wondering what was inside. No matter we thought, and called everyone in the neighborhood to come have a look at the odd contraption. It exploded of course. Thousands of tiny ticking boxes suddenly appeared, all marching down to the post office.

There is a way for every ISP in the world to prevent the propagation of viruses, no matter the nature of the payload. I'm sure that they don't want to do this because it would cost a nominal amount of money per subscriber. It's possible for every ISP to mutually authenticate each and every user and demarcation point—every client can be checked daily. The same sequence of events that authenticates a user or organization can also ensure that there's a working application with up to date virus and firewall definitions—even if it's a mobile. If you let your subscription lapse, you can't logon or you're re-directed to a dead-end that demands you update your software.

Those individuals and organisations using products from Symantec, McAfee, IVG, Sophos, and tonnes of other firewall/virus protection software vendors didn't have any problem with MyDoom, Blaster, or others. Those that didn't have given us all a headache and full mailboxes.

The well-intentioned cause problems, too. Many people have let their virus/firewall update subscriptions lapse largely because their original subscriptions were freebies sent with their new PCs. Some, like mobile users, can't get virus/firewall apps because they don't exist for their platforms—but they can logon to the Internet anyway and are encouraged to do so. ISPs in any event will let them logon anyway, not caring whether the bomb is ticking, the fuse is lit, or the poor punter is MyDoom'd. Is it possible for our industry to protect us from the inept construction of operating systems, applications, and configuration madnesses? It needs to do something. If Microsoft can't protect us, Linux applications makers can't protect us, Macintosh makers can't protect us, then it's going to be up to those that make our network connections possible — because no one can protect us from fools because fools are so ingenious. µ