how-to block ads
|
|
Uniqs:
38157 |
Share Topic
 |
 |
|
|
|
 HpowerRoflmao
join:2000-06-08
Glendale, CA | reply to wheelert$93
Re: Steve Gibson - All Bent out of Shape?? Yea, I got zonealarm pro.
Maybe I just didn't check the whole program out. 
I just found it. I thought the pro wasn't any different, and I am trying to convince my friend to switch from free normal version to pro version.....but its hard. heeh
--
Charter Pipeline MACH 3 Service (1.5mbps/512kbps)
Status: Working excellent! 1532/489!
First hop: Less than 10! | |
 RayJ9
join:2000-08-01
San Antonio, TX | reply to wheelert$93
Wheelert,
Yes, ZA Pro has a Restricted Zone:
The Restricted Zone enables you to identify specific web sites and IP addresses and earmark them as being denied access to and from your computer. Click on the Restricted Zone tab to relegate any IP address or range of addresses to a totally isolated zone vis-a-vis your machine or LAN. Any IP addresses you place in this zone will neither be reachable by your users nor will that IP address be able to have access your network. This means complete isolation of any address you place in the Restricted Zone.
ZA Pro also allows specific port permission/blocking as well as more control over which alerts you don't want to pop-up. The port control is a major plus for gamers who need to allow certain ports for online gaming.
I've been running ZA Pro since it was beta and have been very pleased.
Ray | | |
|
Anon | reply to R2
R2,
Many good things there that I want to add to a bit ...
said by R2:
However, it would not block those sites from reaching you -- a firewall would be needed for that -- eh, I believe.
Exactly correct. Actually, the HOSTS file probably isn't worth bothering with in this case for exactly the reason you cited. The threat is not, in this case, "from within" — as when your browser is being told to fetch ads and web-bugs from out on the web — but rather "from without". So the right solution here is to block the combo of IP-range and port from someone "there" trying to get into your machine *through* your Napster or Gnutella client/server.
said by R2:
Homer- I think you are right on one point -- it should NOT be just ONE site that Mr. Brady does this for!!! As I posted above, there could be a USER-controlled list of Known sites that could generate SIMILAR messages. For example, you might want to enter DSLR into this list...
Precisely. And here, again, I fall back to the core issue of DEFAULT BEHAVIOR for the typical (read: 'less informed') Internet user. In all cases, the default behavior should be for the software to do what the user PROBABLY WANTS. Does the user PROBABLY WANT to be tracked across the Internet? Gee ... let me think ... Does the user PROBABLY WANT to have some home-phoning software installed in his machine without asking? Perhaps not. In my private eMail conversations with Ben Brady, I kept making the point (without any success) that his users, if simply asked, probably did not feel like "Victims" after visiting MY web site, would probably not consider me to be an "Intruder" and so would not want to send an "Intrusion Report" to me and my ISP.
So, by all means, make the list user-configurable, but PRE-LOAD IT with the various known IP-ranges of popular security sites. Or ... ASK THE USER at installation if they would like to be notified when their logs contain IP's of popular, known, security testing sites.
Our Matt, of ZLA fame, jumped on the idea. He had some "unused bits" in his existing "known-IP" list, so he allocated one for "security testing services". It's the right — and responsible — answer.
In truth, Ben Brady's recent posting here pretty clearly shows that he has a large and personal problem with me. I believe that this began back when my opinion of BlackICE Defender changed from "enthusiastic thumbs up" to "strongly thumbs down". The original nature of my dislike for BlackICE was my (and the industry's) growing awareness that it was "crying wolf" FAR too much for the average Internet user. Ben has stated here, in this thread, that he has sold only about 250 copies of ClearZone, but many (or maybe he said several) tens of thousands of copies of ClearICE — the reporting tool for BlackICE Defender. So, while it was certainly never my intention to damage Ben, my strong public about-face on BID might have had a powerful negative effect on his income. I don't know.
But either way, it seems to me that Ben may be confusing his apparently intense dislike for me with the real issues and consequently not serving the best interests of his users. As "2k" pointed out much earlier in this thread, it is SUCH a simple thing for Ben to ask his users how they want their software to behave ... but BEN is the one who wants to decide for them.
said by R2:
I agree that Mr. Gibson holds himself in high regard, but many of us do that. Certainly WE are not mindless individuals worshipping him! This thread started out AGAINST Mr. Gibson, but his actions and words cause the tone of this thread to shift. I cannot say the same for yours... 
It's sure not fun making enemies, and I don't do it easily or happily. John Navas is pissed off at me for not taking his advice about SpinRite twelve years ago when he worked for some hard drive manufacturer, and Ben may be furious because I don't like — or no longer recommend — the firewall which provides the lion's share of his income.
But a guy's GOT to have an ego if he's going to do what I do. I really believe that the issues, companies, and people I occasionally "take on" are important. But that's not enough. I need to have the "juice" and "steam" to make changes happen, otherwise I AM just sitting around listening to the sound of my own voice. | |
 WildcatboyPremium,Mod
join:2000-10-30
Toronto, ON
kudos:2
Security Product V..
Security
| reply to Anon
Thank you both Mr. Gibson an Mr. Brady for hanging around here and for your continued contributions to this discussion. Although Mr. Brady I really don't understand some of your remarks. A look at the negative marks next to some of your post should tell you that certain behaviours don't help you in this issue and certainly won't help us understand your points better. We are all here to read about your side of the story as well as Mr. Gibson's side but I'm afraid we've heard less about the logic of your opinions than we have about Mr. Gibson's. A shouting match and personal attacks against Mr. Gibson and to a certain point DSLR members won't get you any closer to your goal which I hope is to inform people about your point of view.
I'd say this though. You, all by yourself, have managed to do more damage to your product and to your reputation in this thread than anyone else here. As you can see at the beginning of the thread almost everyone was on your side but you have managed to turn table against you by not disclosing the facts completely and by your personal attacks. It also seems odd to me that a job that you claimed would cost you hours of manpower and $20,000 was done so fast overnight ( at least a major part of it). Not that I am complaining. I think what you have done in modifying the software is a very positive step in the right direction and I hope we can all see more of it. I hope you can one day come here and share with us the great modifications you can make to your product and show us how someone can make a product better and more useful. That way we can all applaud you and even promote your product among ourselves. I certainly am interested to hear more of your reasoning and I certainly love to keep an open mind and you as well as Mr. Gibson are always welcomed here.
--
You can catch the Devil, but you can't hold him long. | |
 Zhen-XjellProlific BunnyPremium,VIP,ExMod 2001-04
join:2000-10-08
Bordentown, NJ | reply to Anon
said by BenEBrady:
In MY OPINION Steve Gibson is nothing more than a loud-mouthed, egotistical megalomaniac with a web site and a keyboard. He's not interested in actually educating the users with regard to internet security, the ONLY thing he's interested in is the creation of mindless individuals,
worshipping the keyboard he uses to punch out his incessant blathering...
I am shocked and somewhat appalled Ben. For someone who claims to be using the facts to try and explain his side of the story, you sure used a lot of feeling in this quote.
As WCB respectfully pointed out, most of the members here were on your doorstep at the creation of this thread. But long past its zenith, thanks to you, I fear your doorstep is just a memory now.
I am not slandering you now sir, just observing your behavior. As Wheelert stated, the type of posting you have shown us here is not accepted in the least bit. We are not a Usenet group, we are DSL Reports. | |
 ethics$Premium
join:2000-12-27
Brooklyn, NY | reply to 2kmaro
Ben,
I am on your side, still, but won't be for long if we can't have a meaningful discourse.
Can we try again, pleaaaaaaaaaaaase?
I am really curious as to what your facts are. I am sure you know your product and security, and I have outmost confidence that you can relay it here. Forget Steve for now, let's talk about the issue? Please?
--
Folding can save a life!
| |
Anon | reply to Anon
ZoneAlarm problems??? said by BenEBrady:
Does anyone else wonder why he has been threatened with lawsuits by RealNetworks, AOL and Netscape???
Waaaa! Those 3 names make my blood boil. Especially RealNetworks! How dare they send stuff from our PCs without our knowledge. We should be threatening THEM with lawsuits...
Ooops that was probably off topic! Also so is this: wot are the problemos with ZoneAlarm that were mentioned (way back) in this huge thread? Eg the time BlackIce worked but ZA didn't...
p.s. ZLAnalyzer is quite pretty...you can change the colors and stuff.
xxx luv barcoose | |
RayJ9
join:2000-08-01
San Antonio, TX | reply to Anon
Re: Steve Gibson - All Bent out of Shape?? said by BenEBrady:
He has done irreparable damage to our company and our software. Our attorney has advised us that we have absolute grounds to take action against him for slandering our product and restraint of trade.
Ben,
While we know that anyone can sue anyone, anytime, for anything, and I'm sure you have presented "facts" to your attorney, I would really be surprised if any attorney would advise you anything of the sort.
This was a totally private matter between you and Steve until you made your inflammatory post in c.s.f. You chose to make a public and VERY biased statement there.
Steve only posted there AFTER you posted to explain and defend his position because you went public with private correspondence.
What little merit there may have been in your arguments are totally nullified by your multiple ad hominem attacks.
This is starting to remind my of the false accusations you made last year when you claimed that Steve had "banned" you from posting at GRC.
IMO, a number of your statements here and at c.s.f are far more actionable than any alleged claim you have.
BTW, your private DSLR Instant message to today was way over the line and totally uncalled for.
Ray | |
 veunadWhat Does This Do?Premium
join:1999-08-06
Alpharetta, GA | reply to Anon
said by BenEBrady:
He has done irreparable damage to our company and our software. Our attorney has advised us that we have absolute grounds to take action against him for slandering our product and restraint of trade.
Ben E. Brady
Brady & Associates, LLC.
This is a good one I feel the need to comment on. I seriously doubt any actions you take will glean you anything other than legal costs. (Absolute grounds for your lawyers to argue the case in court. I seriously doubt that argument would win in any court.)
Can you sue the flame because you stuck your hand in it?
I might remind you that in the first paragraph of this post, you yourself stated this started because you posted the press release on the USENET. The public opinion (Of this forum at least) has slanted away from your view, now you want to sue? Take a deep breath, sit down, and discuss the issues. If you have a case outside of this issue, that is another matter. However, I doubt that is really, what is afoot.
Here is a listing of some of the issues that caught my eye,
User Education
Software Design
Verbiage of report terms
Responsibility of Internet connected software
There are many more. Take some time to expound on some of those issues, and perhaps people will see the world from your angle for a while.
I will admit, that Steve could be a little more discreet in the directions of his viewpoint on whether specific features your software was deliberate or not. That is not something that can be validated, but only argued until all parties are blue in the face. Either way, unless I miss my guess the issue that Steve had with your software has been resolved, am I right?
Then lets get back to the issues that can be discussed, perhaps Steve will lessen the pokes, and you can relax enough to discuss some of the issues others have brought up.
--
36,000ft from the CO. Pulling 1100-1200Kbps, and pushing 210+Kbps.
»/metashare/b4c848 | |
HpowerRoflmao
join:2000-06-08
Glendale, CA | reply to Anon
Re: ZoneAlarm problems??? I think I have your answer.
Realnetworks threatened him BECAUSE zonealarm was BLOCKING a port for REALNETWORKS SOFTWARE to send out information about your activities (SPYWARE!) to their server.
AOL and Netscape threatened him because zonealarm was blockin a port that prevented AOL's network in determining some information about the user's current activity.
Thats exactly what I BELIEVE happened...because I HAVE read that realnetwork's download IS SPYWARE, and a BIG spyware program that SENDS out the FILENAME and location of your current download to the server. PRIVACY PLEASE??? Nope....
Realnetworks and AOL REALLY make a mistake and take people's privacy away. This is a big fact that I have done some research on, and I am NOT surprised to see it happen always.
--
Charter Pipeline MACH 3 Service (1.5mbps/512kbps)
Status: Working excellent! 1532/489!
First hop: Less than 10! | |
 2kmaroThinkPremium,ExMod 1 BC
join:2000-07-11
ColossalCave | reply to Anon
Re: Steve Gibson - All Bent out of Shape?? said by BenEBrady:
... In MY OPINION Steve Gibson is nothing more than a loud-mouthed, egotistical megalomaniac with a web site and a keyboard. He's not interested in actually educating the users with regard to internet security, the ONLY thing he's interested in is the creation of mindless individuals, worshipping the keyboard he uses to punch out his incessant blathering...
...
Ben E. Brady
Brady & Associates, LLC.
Well, the Mr. Moderator in me must come out now. You pose an interesting quandry - you are more less here at the 'request' of DSLR, but you are acting outside of the normal accepted parameters of this site: posting a specific attack upon another member. I believe the 'score' on the vote for that post speaks pretty well as to the general response of the public membership here. Since you are new here, I will explain the voting: a single vote by a registered member counts either 2 points up or 2 points down, unregistered visitors votes count 1 point either way. It would seem that no less than the equivalent of 12 registered members found your comment inappropriate for one reason or another.
I will say once more what I have stated several times to other members in various forums: Discuss the ISSUES, not the personalities, education, upbringing or hair style of others discussing the ISSUES. I believe user veunad has offered a very nice starting point for a list of the issues under discussion. | |
 MeeToo7You Too?Premium
join:2000-10-18
Ardmore, PA | reply to Anon
said by BenEBrady:
Mr. Gibson, and his behavior, is ABSOLUTELY the result of a stunted sense of responsibility, most likely resulting from being brought up in a left-wing childhood as is predominantly found in the LEFT COAST areas of the country, and potentially magnified by the fact that the weight of his head on his shoulders keeps him from standing up and taking responsibility for the problem that he has caused for himself as a result of an INFERIOR and ANEMIC implementation of a web based port scanner.
He has done irreparable damage to our company and our software. Our attorney has advised us that we have absolute grounds to take action against him for slandering our product and restraint of trade.
Ben E. Brady
Brady & Associates, LLC.
I find this statement from you very ironic.
Two points:
1- You are the one who brought publicly your personal communications with Mr. Gibson.
2- I've read several posts from you containing character attacks on Mr. Gibson, and unprofessional name calling
Then you claim that Mr. Gibson "has done irreparable damage to our company and our software."
That phrase is to me the apex of irony in your statements.
You are in effect blaming Mr. Gibson for your poor behavior and your poor product's sellability. Good products speak for themselves, as do one's behavior and words.
Mr. Gibson has gained notoriety and respect from his professional attitude and knowledge, as well as an open mind. You on the other hand are showing on this thread the opposite, and in the end, you are the one doing the most damage to your company and software.
--
. | |
HpowerRoflmao
join:2000-06-08
Glendale, CA | reply to 2kmaro
said by BenEBrady:
------------------------------------------------------------------------------ --
... In MY OPINION Steve Gibson is nothing more than a loud-mouthed, egotistical megalomaniac with a web site and a keyboard. He's not interested in actually educating the users with regard to internet security, the ONLY thing he's interested in is the creation of mindless individuals, worshipping the keyboard he uses to punch out his incessant blathering...
...
Ben E. Brady
Brady & Associates, LLC.
__________________________________________________________
That's pretty sad
I think there are other ways to communicate, in a nicer way. Let's not make dslreports.com a flaming website.
I am here to improve it.
--
Charter Pipeline MACH 3 Service (1.5mbps/512kbps)
Status: Working excellent! 1532/489!
First hop: Less than 10! | |
Zhen-XjellProlific BunnyPremium,VIP,ExMod 2001-04
join:2000-10-08
Bordentown, NJ | said by Hpower:
Let's not make dslreports.com a flaming website.
I am here to improve it.
Will not happen. Justin and the management team, and even many of the members will prevent DSLR from ever become another flame board. | |
Anon | reply to Anon
said by SteveGibson:
... so we know that Copyright.com is most likely contained within there. Therefore, if a user was to setup his system's personal firewall to block inbound connections on his Napster port from the IP range: 209.48.134.0 - 209.48.189.63 there is a VERY good chance that copyright.com would NEVER be able to find their machine, inventory its contents, report them to their client, and force the user off the Napster network.
All the best,
Steve.
Hi Steve,
I'm badly off topic, as is this entire line of conversation (napster), sorry.
I do wish that that would work, as you say. But I seriously doubt it, due largely to the fact that napster's database will pretty much provide these services for copyright.com. All copyright.com's P2P clone _really_ needs to do is connect to napster and once having found "pirated" works, do a further search based on the user-names that come up. This can be done without initiating any connections to the users, merely to Napster's network by adding a user to one's hotlist. This automatically displays ALL of their shared files, but does not require a direct connection to them.
To lend a little support, here is the only unregognized connection shown by "netstat -a" _while_ performing this operation on a napster user at random (typed in some search term, and clicked on the 1st match). I retreived a song-list with a few pages of songs in it.
From "netstat -a":
TCP oemcomputer:3243 208.184.216.46.napster.com:8888 ESTABLISHED
There are other connections listed, but they are all attributable to something else on my computer (connections to here, to a newsgroup, to my email server, and to icq, respectively).
The sad thing to say is, it seems that the only way to avoid copyright.com's profiling is to avoid the napster service or to munge your song-names (rot13 anyone?)
Sam
(again, sorry for the off-topic posting) | |
HpowerRoflmao
join:2000-06-08
Glendale, CA | Sorry, I am off topic also.
That's pretty interesting, though.
I think it that only time speaks for napster.
What port does napster use to serve files/download files?
I am interested in this. I think I forgot the port number, since I rarely use napster. 
--
Charter Pipeline MACH 3 Service (1.5mbps/512kbps)
Status: Working excellent! 1532/489!
First hop: Less than 10! | |
Anon | reply to Hpower
Hi everyone,
I just wanted to take a moment to let you all know that Ben E. Brady is [u]still[/u] posting denigrating posts regarding Steve, however this time over at news://news.grc.com/news.feedback . It seems to me that Ben is really intent on damaging his own reputation as much as he can, now that he has seen that there is a generally poor perception of his actions.
I kind of feel sorry for the guy. I'm not sure why it is that he continues to post his attacks everywhere. Very similar looking posts, mind you.. cut-and-paste maybe?
Anyhow, just a heads up to let you know that although the attack posting has stopped here, he has merely migrated elsewhere.
Sam | |
Zhen-XjellProlific BunnyPremium,VIP,ExMod 2001-04
join:2000-10-08
Bordentown, NJ | Ben,
Please come back and let us talk the facts and take away the personal confrontation. No one here is out to get you or to get Steve. This thread is a constructive one where any of the issues raised can be intelligently discussed.
No need for perceived justice. We are all professionals. | |
Anon | reply to Hpower
Hi Hpower,
It is my impression that connections to Napster's servers are typically made on port 8888, and that the actual P2P component (file transfer) defaults to 6699, although this port _can_ be user-specified.
Enjoy
Sam | |
Anon | reply to ethics$
I agree, let's talk about the issue...
Steve sends me an email telling me there is a problem. He DEMANDS that I change my program so users cannot report scans from his site as intrusion attempts.
I tell him point blank that I do not believe that is the best solution in terms of the users and the security of their systems.
I offer a solution to change the contents of my Online Help system for each of my products and he accepts said solution as the appropriate course of action.
Two months later, Steve sends me another email. Once again, demanding that I fix my 'defective' software that automatically generates 'spam'. I quite carefully explain to him that my program does nothing more than READ the information in the various log files in question and re-formats it for the user and copies it to the Windows clipboard.
The user must then do the following.
1. The user must press a button to do a WhoIs query. This is accomplished by:
a) launching a browser session and directing the source IP address of the suspicious log entry to the Spamcop web site so the user can get he email address for the ISP to send the report to.
OR
b) using an external lookup utility specified in the options settings, (SmartWhoIs, NeoTrace, VisualRoute, TraceRT) the source IP address is passed on to the command line of the utility specified. The user then has to determine the correct email address based upon the information returned.
Once that has been established, the user must go back to my report utility software and press another button to actually copy the pre-formatted log entry to the windows clipboard. The user is then instructed that if he wants to actually send this email, he has to start his email client, enter the abuse email address, edit the subject line and paste the contents of the clipboard into the body of the email message.
Let me allow you to make note that the user CANNOT send more than one log entry at a time, even though many times my users have requested that I allow them to 'batch' log entries for purposes of reporting to the ISP.
The reason I have refused to add this particular functionality is due to the fact that ISPs investigate the intrusion attempts in a singular fashion. To send them multiple attacks would be more than they could handle.
The user then must press the send button to submit the report to the ISP.
As you can see, (and I described this process to Mr. Gibson) this is by no means automatic generation of 'spam'.
His reply to me is posted below, in it's entirety...
(Start of Steve Gibson's email, 3/2/2001)
Hi Ben,
Well, it looks like we have a dispute on our hands, which is indeed unfortunate, especially when it would be so easily resolved by a little understanding, capitulation, and work on your part.
You have created a tool which encourages and automates irresponsible use of the Internet and generates SPAM. It has automated the continual harassment of my company and ISP. Therefore, there is nothing "smearing" about my
warning people away from the use of such a tool.
The subject line of this message is "Unauthorized access attempt" since that was the subject line generated by your software utility. But it was incorrect. We both know that the packet received from my company was certainly NOT an "unauthorized access attempt" -- thus your software is
defective and is directly aiding and encouraging the generation of incorrect and malicious SPAM.
You, I, and our mutual customers all know that packets from GRC are never attacks or intrusion attempts, so its deliberate generation of such reports -- which you have admitted, and we both know, could be easily blocked -- is
irresponsible and represents defective operation from your product. Your utilities are broken since they are deliberately reporting known non-attacks.
I have been asked several times in the past month for my company's IP ranges from responsible companies SPECIFICALLY so that probes from GRC could be excluded from automated intrusion reports. Those ISP's and organizations are acting responsibly, you are not. Those tools will get my support, yours will not. I can not POSSIBLY recommend the use of your tools, and in fact, discouraging their use only makes sense. Again, there's nothing "smear campaign" about it, just working as I always do for the best results.
For the record Ben -- and as I most recently told SecurityPortal.com when they wrote to me day before yesterday asking for my IP ranges so that they
could be excluded from their intrusion system -- I have two ranges of 32 IP's each:
207.71.92.192 => 207.71.92.223
204.1.226.224 => 204.1.226.255
As you may know, the next generation of my work will include a subscription service which autonomously and continually (daily) checks the security of a user's system. At the user's paid request this will *significantly*
increase the incidence of unexpected packets arriving from the GRC domain.
Since I anticipate a corresponding increase in the level of harassment from your defective utilities, if you do not PREEMPTIVELY repair your broken products, I will be forced to make it very clear -- up front in every presentation of the service's subscription agreement -- that the receipt of
an intrusion report generated by any of your utilities will result in the immediate termination of the user's subscription and a refund of their unused balance. The subscription agreement will require them to agree to
uninstall and NOT USE any of your products until the defects in those products have been cured. What other choice have I Ben? Your software is not functioning correctly.
You wrote:
>There is NOTHING to fix. I have posted a message in the help file for the
>user NOT to report 'attacks' from GRC.COM or your IP address. The message
>is there for the user to see IMMEDIATELY upon opening the help file. If
>they do not READ the help it is not my fault that they do not see the message.
I imagine that you know how I feel about that "defense". It's like the spyware purveyors saying that the behavior of their utilities is explained in the fine print of their license agreement. We both know that you can not reply upon user's "reading the manual". (I wish we could!)
>I COULD filter your IP address if they try to report it but I currently
>have no plans of doing any modifications to that portion of the code in
>the near future.
That's certainly your call, but your decision will hurt us both in the long run.
>I would also be reluctant to put the filtering in place since your IP
>address would be useful to attackers in spoofing attacks and negating the
>ability to report legitimate attacks.
Port scans can not be spoofed Ben. They require an authentic IP else the returning packet won't ever come back and report upon the port's status. Furthermore, many other national ISP's and responsible security testing
services *ARE* excluding my IP ranges from their reports.
>ClearICE, ClearZone and ClearRoute simply REPORT on what is found in the
>logs of the various firewall / intrusion detection utilities that are
>being used.
Right, and as you have said -- except that you "have no plans of doing any modifications to that portion of the code in the near future" -- you could easily prevent this problem, but you have chosen not to.
>You would be well advised not to start a 'smear' campaign against my
>tools. As I have stated in the past, ClearICE, ClearRoute and ClearZone do
>not automatically report anything. It is solely up to the user's
>discretion as to what attacks get reported to the ISPs. My software is
>NOT at fault here and you would find the backlash from your attack to be
>most unpleasant.
Your tool is not doing what its user would want. They come to GRC for security guidance and help, and then report attacks from us -- due to the defective operation of your tool -- to us and our ISP. You have stated that you know this could be easily fixed, but that you choose not to. So, again Ben, there's nothing whatsoever "smearing" about my warning our users not to use defective reporting tools.
>Perhaps you should post something on your web site at the point just prior
>to the user issuing the attack against themselves not to report the
>attacks from your server....
We both know that automation wins over asking the user to read anything. You have AUTOMATED the generation of SPAM against my company. Any message from me will have to be VERY STRONG if it is to have any hope of countering
the automatic and automated operation of your product.
>I would like to have this problem resolved as much as you would!
Your actions indicate that you would rather be stubborn. I'm sorry for that.
This is a BIG problem for me, and one that I NEED to resolve. A defective program is misreporting attacks from my company's known-benign services and is generating incorrect and malicious SPAM. That program's author, Ben E.
Brady, has been informed of this deficiency in the operation of his program and has elected to do nothing to effect repair. Therefore, that program is now DELIBERATELY misreporting attacks and aiding in the generation of SPAM
eMail.
You must fix this Ben. The sooner the better. If I can not cause you to cooperate to repair your program's defects, you leave me with no alternative other than to leave you no alternative.
It's your call.
(end of Steve Gibson's email)
As you can clearly see, Steve has threatened the integrity of my company and my software with his false assumptions and negative comments.
I immediately modified the Online Help system again, in order to display the IP address ranges for Mr. Gibson's site in order to further educate the users of the products.
The following email is the email subsequent to the message posted above...
(beginning of Steve Gibson's email)
Hi Ben,
>1. If, as you say, the various firewall software vendors are implementing
>code to not consider traffic from your site as true attacks, then there is
>nothing that I need to do. The situation will resolve itself when people
>upgrade to the next version of the various products.
That's not what I said. I have no knowledge or belief that firewall vendors are doing anything. My note stated that various intrusion monitoring ISP's and third parties are taking responsibility for eliminating false alarms and doing so. You are not.
>2. My software DOES NOT do anything more than read the firewall attack log
>entry and reformat it into the format desired and paste it to the windows
>clipboard. It does not do any AUTOMATED process that sends out any kind of
>email. It is up to the USER to actually start his or her email client and
>send a message, including the drafting of the subject line. This is by design.
I will certainly determine exactly how your system operates before taking a public position so that I am not incorrect about any of my assertions.
However, the fact remains that I and my ISP are receiving a substantial flow of eMail generated by your software. All such reports are formatted similarly, including the clear statement/advertisement that the report was generated by ClearICE, ClearZone, or whatever, and soliciting the purchase of same. We are NOT receiving ANY similar reports from anywhere else, therefore you software stands alone in its deliberately harassing misbehavior.
>3. I would rather not be in a dispute with you and I am sure you will find
>that if you were to contact me via telephone that I can be quite
>reasonable. I am not trying to be contrary in the least.
>
>If you would like to discuss this, I can be reached at 559-591-8229
Unfortunately, you have now invoked your attorneys and have stated that you will be reviewing my previous note with them. In order to avoid problems with hearsay, I must now constrain my communications to written correspondence.
Furthermore Ben, there is nothing whatsoever unclear or misunderstood about our positions which would be clarified by telephone. You know EXACTLY what it is that I require and EXACTLY what my problem is. And, moreover, it has
been DELIBERATE since I first contacted you on January 7th earlier this year.
In your January 7th, 2001 communication to me you stated:
"Your request for me to take responsibility for how the users of ClearICE, ClearZone or ClearRoute in submitting reports is like you asking Ford Motor Company to control drunk drivers. Your request for me to implement code in
my products to prevent the reporting of 'attacks' from the ShieldsUp site is like asking Ford Motor Company to implement a device that would not allow a drunk driver to start the car!"
I confess that I fail to understand how this analogy pertains.
You then said ...
"If I were to 'intercept' the reports of your domain that would be, in effect, censorship, something that will not take place in my products."
I beg you to rethink your position on this matter. I can not fathom your position and there is no question but that your software is not functioning in accord with the wishes of your users.
______________________________________________________________________
Steve.
(End of Steve Gibson's email)
As you can see, as far as Mr. Gibson is concerned the only way he can 'solve' the problem, to his satisfaction, is to attack my software and continue to make false statements that my software deliberately attacks his site. His rather weak argument that my software should perform as the user's would wish would result in a much LARGER problem for Mr. Gibson, as most of the users have requested that I actually make the product do the reporting to the ISPs automatically. What Mr. Gibson doesn't want is EXACTLY what the users DO want.
I have spent a great deal of time and energy explaining to people, in person, on the phone, via email and within the Online Help that to make the program operate in this fashion would NOT be the responsible thing to do... For those of you that have not seen my Online Help, here is an except that has been there since January 2000...
(Start of quote from ClearICE Online Help)
Before reporting attacks it is necessary to determine the level of threat to your system the attack poses. The reporting of attacks could have been more automated, however, the choice not to do so is a very conscious one on my part for a very good common sense reason.
It is imperative that good old human judgment be used in determining what attacks should actually be reported. BlackICE Defender gives us a severity number that is calculated based upon specific criteria about the attack when it is intercepted.
My rule of thumb is to report attacks if they are of a severity of 59 or above.
The reason for this is simple. Attacks below 59, in my opinion, are handled adequately by BlackICE in terms of the action it takes against the attack. It also helps the ISPs that would receive attack reports to not be overwhelmed by reports of superfluous attack reports. Please use good judgment in reporting attacks, ensuring the cooperation of the ISPs in helping to curb the rising incidence of hacking on the Internet.
Do NOT report attacks from the Shields Up web site as these are not actual attacks!
(End of quote from ClearICE Online Help)
You can see the last line in the paragraph is actually referring to the Shields Up site and specifically tells the user not to report the attacks. This was the modification that Mr. Gibson agreed to on January 7, 2001.
The modification I made to the online Help on 3/3/2001 is as follows in a LARGE, CLEARLY UNDERSTANDABLE font and at the very start of the Online Help page...
(Quote from ClearICE, ClearZone, ClearRoute Online Help)
NOTE: Please read before reporting attacks !!!
DO NOT REPORT ATTACKS FROM THE
SHIELDS UP WEBSITE !!!
These are not true attacks, they are received as a result of YOUR request to have your computer's security tested.
The IP Addresses range from:
207.71.92.192 through 207.71.92.223
AND
204.1.226.224 through 204.1.226.255
(End quote from ClearICE, ClearZone, ClearRoute Online Help)
You will also note that I suggested that Mr. Gibson call me on the telephone and discuss the matter with me and he makes the decision, on his own, not to do so.
In my opinion, it was not, and is not, appropriate to filter out the information in the log files. This data should remain intact in order for the user to realistically determine the level of threat against their computing resources and configure their security defenses appropriately.
I hold this opinion even more vociferously in light of the fact that Mr. Gibson's own web site states that someone has 'reverse engineered' his IP Agent to allow intrusion attempts to be directed to unsuspecting computer users, in an attempt to masquerade as the Shields Up test, even though in the email message above, Mr. Gibson states that a scan cannot be spoofed...
It is exactly actions such as this that demand the solution to the problem be well thought out and prudently implemented. For the purposes of expediency I will post the exact verbiage from his web site below...
(Quote from Gibson's web site)
10/28/99 — News of the moment . . .
Many "back room" problems with my WinNT server are all fixed. (Thank goodness!) The persistent resource leak has been plugged (it was my fault) and the intermittent server crashes have been cured (those were Microsoft's fault for poor dual NIC handling and faulty asynchronous I/O implementation in their server). So the site is really running well. I'll be answering my backlog of eMail over the weekend, then I'll write the combined, permanent, freeware utility combining the functionality of NoShare, LetShare, IP Agent, and the new warp-speed port scanner.
In other news: IP Agent has been hacked!
Actually, it was reverse-engineered. Someone loaded the program into Windows then reverse-engineered my algorithm for encoding IP addresses into web URL strings. The result is an unauthorized "variant" called IPA:
( a small picture of a dialog box appears here on the site)
As you can see, IPA's main feature — and the stated reason for its creation — is its ability to accept any IP address entered by the user. This means that my ShieldsUP! facility can be "subverted" and used to probe and scan any other machine on the Internet.
Is this a huge problem? No. I'm not concerned for two reasons: First, it can't be used for any sort of "high-speed bulk scanning." The ShieldsUP tests are deliberately simplistic in nature, merely checking for connectable TCP/IP ports. Many other much more powerful scanners are readily available from every hacker site on the Net. Secondly, the application containing the final version of the IP Agent functionality will establish a brief two-way dialog with my server code for the sake of verifying that we're probing the machine that's actually running the Agent. This "hand-shake authentication" will have the side effect of preventing any third-party scanning of other machines.
(End of quote from Gibson's web site)
In recent messages on this thread, Mr. Gibson states that he believes I harbor a grudge against him for his current opinion with regard to the use of BlackICE Defender.
I could care less what firewall product people use. I have products for three of the personal firewall software packages on the market and I am currently researching several of the others in anticipation of developing a new second-generation reporting tool called Firewall Prism, to provide an alternative cross-firewall reporting tool to home an small business users that is reasonably priced and provides the necessary flexibility in producing hard copy reports and facilitating the analysis of the firewall log data. It will also incorporate many of the features that are in my each of my existing products but not in each other.
I don't hold grudges against ANYONE and people that know me personally and have knowledge of this particular situation can (and would, independently) certainly attest to the fact that I have been more than willing to provide a solution that is best for the user community.
They also know I will not be 'bullied' into making changes to my software by Steve Gibson, who, by creating a 'trojan' last December caused a complete upheaval in the Internet Security industry by 'throwing his weight around' in the press and the public forum of his web site by making statements about the various firewall products on the market.
His "Leaktest" program was nothing more than coercion on the industry to make the various firewall vendors change there software to operate the way HE thought it should operate. I am all for improving the firewall products in the marketplace, however his tactics have destroyed his credibility with many people in the industry, including me.
For someone to think, as Mr. Gibson does, that ANYONE would hold a grudge against him for 12 years, indicates, at least the possibility, of some measure of insecurity or even psychosis. This is ludicrous. As I said in press release, and I still state here, I have a great deal of respect for Mr. Gibson's abilities with assembly language and his abilities in educating the many people he has within the subject of Internet security. However, as a result of these discussions, I now hold him in a great deal less esteem.
There have been a few people that have stated it was not appropriate for me to issue the press release in the comp.security.firewall newsgroup. I disagree with this view. It was necessary for us to preempt any attack by Mr. Gibson, due to his false assumptions regarding our software. Our software products are the ONLY means of income my wife Rita and I have. We live in an agriculturally based rural community, located in the Central Valley of California where there is almost 20 percent unemployment in the general population and much higher percentages in the fields of 'hi-tech'... so unlike most of you that receive a regular paycheck, the only responsible thing I can do in order to maintain our financial obligations is to vociferously defend our revenue stream.
Many of you have made very good suggestions with regard to the 'solution' to this disagreement. I have taken the necessary steps to implement each of them, not because it is the will of Steve Gibson, but because it makes sense for the user community. You will also note that I still have 2 more applications to modify, (which puts me off-schedule for some other work that needs to get done) and then begin the headache of distributing the updates to the masses. I modified ClearZone first because it was the easiest to do and would cause the least negative impact on the installed user base. Is the modification done the way I would like to have it done, not on your life... What is required is time to design an appropriate solution and effect its implementation. Unfortunately you can tell a ditch digger to dig faster, but you cannot tell a software developer to think faster... the physics just are not the same. (and yes, I do know a thing or two about neurophysiology, I worked for a man that had a Ph.D. in the subject)
I, like many of you, would like to have this resolved soon. As a matter of fact, I sincerely wish that Steve had never had his problem in the first place. However, it's time for Steve to assume much of the responsibility for creating the situation, in the first place, by implementing his web based port scanner without the appropriate statements in place to educate the users of his Shields Up site. You will also note that the statement that as now on his site are particularly anemic in their effectiveness due to the size of the font used as well as the position in relation to the buttons that actually execute the various scans... In reality, this warning to the users should be displayed prior to the user ever seeing the button that will execute the scan.
Ben E. Brady
Brady & Associates, LLC. | |
|
