Broadband Tech > Security > Security > Steve Gibson - All Bent out of Shape??

reply to 2kmaro

Re: Steve Gibson - All Bent out of Shape??

reply to 2kmaro
Well, IMHO, egos have caused problems for many good people. Sometimes, doing the right thing for the wrong reason, is as bad as doing nothing at all.

Steve has helped the security world quite a bit through out time, however, I have sensed his ego before.
Perhaps it is pride, stress, lack of staff or backing...
Who knows...
I do not see the right to make demands to exclude himself as a positive step in security. Falsifying an IP is not the hardest thing to do.

Perhaps the old "making a mountain out of an ant hill" is in effect here.

Other solutions have been mentioned. A notice to inform the "dough heads" of the world would seem to be the easiest. I have seen people post DSL Reports IP as an attack before. Some people just don't think...

It would appear to me that Brady's program is doing it's job. In reality, a security check is an attack.
Whose liability? Whose problem? It would seem to be Steve's.
I don't feel compromising security by "building in a special exemption" to be a feasible answer.

Of course, I have never used an analyser, and don't plan on using one. If I need to see who is attacking me, I will look it up myself...
And I have a hardware firewall, so really nothing makes it through anyway...
Just my feelings on the liability of it...
--
Inquiring minds want to know...

reply to nekote
I totally disagree with Gibson's tactic on this. As Rocktagon said, DSLR already monitors several lines, mine included, and I had to add DSLR's IP's in the advance security tab setting on ZoneAlarm so that I would not get faulse reports of attacks. DSLR makes that clear in the FAQ.

IMHO, it is the responsibility of Gibson to educate his users to these reports of attacks and ways to get around them. The run-of-the-mill users who are in the process of learning to secure their sites will inevitably over react and/or panic at such alarms until they learn to read them properly. A lot of us have been there ourselves. It doesn't make us big idiots, simply ignorant users in the process of learning. Gibson, instead of dictating to utility companies what they should code into their utilities or not, should concentrate on educating the public, as the guru that he is, in a helpful manner.

I agree with 2kmaro, he seems to have contracted a case of Big Head. Sad.
--
.

reply to 2kmaro

Wierd Info

reply to MeeToo7

Re: Steve Gibson - All Bent out of Shape??

Yea, oh well, no one is perfect.
He made mistakes....we all will do mistakes too.

At least someone did something about the security not being taken serious in the world, and it was Steve Gibson who warned us.....to a certain point.
--
Charter Pipeline MACH 3 Service (1.5mbps/512kbps)
Status: Working excellent! 1532/489!
First hop: Less than 10!

reply to MeeToo7
***Message edited due to having read the rest of this thread. My original post read differently before, as I didn't have Steve's side or enough information to base an intelligent response. I have now changed the wording in the italicized words below to reflect my thinking in a more positive manner.

The suggestion that he, Steve, educate the public is right on. So is your description of the simplicity in what he is seeing, and in fact, is due to the great program that he offers, and by doing so, actually contributes to his own problem by novice users. A combination of some sort of disclaimer/informational announcement re: what the user will see plus a good descriptive explanation of why as a learning tool would be a good addition to his site.

Since Steve has gone a long way in using his site as an educational tool already and has made a clear statement right along with his test page agreement, and since he is obviously going to be doing more educating from the tone of his replies here, I applaud him. My hat's off to him for taking his time to respond and for going more than a mile to try to keep this whole thing from blowing way off the mark, which is where it was headed.***

I, for one, have learned a great deal about what is happening on my system by using ZLA. As a tool, it has been very educational, and I can tell that it will be even more so as this entire security issue evolves. I can also say with certainty that before I had it, I messaged Steve about probing my system when I had asked for a security test! If I had had another type program (such as is described in later portions of this thread)in generating messages for ISPs, I would have used them too. I am the average user (or used to be), and I still have too much to learn and need all the help I can get. If Steve, Matt, 2K, and even Ben and all the others to follow will continue to work together on behalf of all the idiots out there like myself (used to be!), everyone will profit, and some will do so in the monetary sense of the word.

This thread once again points out the many issues there are with security in this technological society, and to everyone's credit, sites like this still exist to help move along the process for the truly uneducated. A big thank you to Steve for laid his body at the doorstep of the masses and to all the rest who have contributed to this thread and so many others that are teaching people like me what we need to know, even though some of the learning is painful. You are all assets to the Internet/computer community.
--
JKK

Age is a very high price to pay for my maturity, so
if I can't stay young, I can at least stay immature!

[text was edited by author 2001-03-05 16:49:36]

Letter to GRC

reply to 2kmaro

Re: Steve Gibson - All Bent out of Shape??

reply to 2kmaro
The fair flip side. A reporting program shouldn't encourage users to just automatically send an abuse e-mail regarding every single knock at the door. Not every "hit" is an "attack." Discretion is essential, not only to separate accidental or non-malicious, albeit perhaps misdirected, at times, traffic from malicious stuff, but to educate users in rational security. On the other hand, asking someone to preconfigure a reporting utility to completely exclude IP's entirely as "positively safe" - "because the site operator said so" is dangerous and... damn it, yes, simple minded. The risks are incredible. There's fault to be found, yes, with the reporting utility: it should NOT encourage blindly sending abuse reports for EVERY hit... heck, one night I kept getting hits for hours ... turned out to be a bunch of gamers looking for a Quake server that had had my dynamic IP earlier... what good purpose would reporting those innocents to their ISP's have served??? ... no harm, just a little scare, for a minute. OK. I just made my point. I'll shut up, now. Steve's still dead wrong. You ask that the reporting feature be linked to a help file and a whois utility... and offer some advice on your scan site, for heaven's sake... you DON'T (especially while calling YOURSELF a security expert) ask a security product manufacturer to essentially poke a nice, big HOLE in their products just to accomodate your huge ego. Heck, I hear that "krACkZ iz US.KoM" caught wind of this, and wants a special rule in there for their latest experimental trojie... hey, equal time and all that!
--
Man will occasionally stumble over the truth, but most times he will pick himself up and carry on. - Sir Winston Churchill

reply to tnm456

Re: Letter to GRC

reply to gwion

Re: Steve Gibson - All Bent out of Shape??

reply to 2kmaro
I believe it should be pointed out that all the responses I see here seem to be based solely on Ben Brady's inflammatory "press release".

But no law says you have to be objective. So have at it.

said by pchelp:

---

I believe it should be pointed out that all the responses I see here seem to be based solely on Ben Brady's inflammatory "press release".

---

reply to pchelp7
pchelp - The fact that the info has been 'one sided' has been noted elsewhere in this thread, please review this comment:
»Steve Gibson - All Bent out of Shape??

reply to shazaam

said by shazaam:

---

A lot of spirited discussion going on about this on the GRC discussion group site. Surprisingly, since Gibson owns the site, much of it is very clear-headed.

»grc.com/x/talk.exe?cmd=xover&gro···feedback
[text was edited by author 2001-03-04 21:39:23]

---

reply to 2kmaro
Well Well Well Steve way to go you have got a big head Ive got an idea Why dont you first blame yourself.I know it is a matter of pride.I have an idea put a warning before scanning to state your ip number 207.71.92.221 and warn people about the logging of Firewalls and to not report.I believe their are way to fix problems sometimes in life Steve you have to look in the mirror and except some responsiblity for your own actions as well,its not always other peoples problems.I thought people would use common sense I guess Im suprised as well to hear people are reporting or reacting to quickly without doing the proper checks for themself.In any event I am going to quite using his site till he can accept some responsiblities for his own actions as well.Theres plenty other Scans you can use

reply to MeeToo7

The problem here is that Gibson is not the only one doing scans. There are numerous sites doing the same thing but he is asking for special treatment. If Brady must exclude Gibson's IP address then he must exclude DSLR's and dozens of other IP addresses. When will it stop? If I start a web site tomorrow and do a port scan, can I ask Brady to do the same for my IP as well? There are several hacker's sites that do scans. I bet some of them do a little bit of sniffing around for themselves as well. So now what?, Should we exclude their addresses as well.

The problem I see here is that Gibson is asking for Special treatment because he thinks he is more important than others. Besides I don't own Brady's software but Gibson's address shows in my firewall log. If I decide to send a complaint using ZA's log, is he going to tell the world not to use ZA anymore. How about Norton's log and Tiny's log and ... . I am trying to be objective but it gets harder and harder to do so, specially when I don't read anything from Gibson to see what his point of view is.
--
You can catch the Devil, but you can't hold him long.

reply to MeeToo7
MeeToo - Have to distinguish between the firewall product and the firewall log utility here. It is not the firewall itself that Gibson is griping about, it is the reporting tool(s).

I just checked my copy of ClearZone, the tool that does the analyzing of the log, and there is not an option to exclude IPs from reporting at all.

With ZoneLog Analyzer, there is an option to "TAG" an IP as Friendly or Unfriendly. Seems I recall suggesting this to Matt sometime back and he agreed it was a good idea. This is the kind of thing that Gibson is looking for Brady to include in his logging.

The thing here, like WCB says, are the analyzer makers supposed to keep up with all of the sites doing security probes? It would seem that Gibson doesn't care so long as HIS site's IP gets golden treatment. Hogwash!

Gibson and Brady seem to have some animosity and Gibson is trying to weild his 'power' to force Brady to make changes to his software. The problem does NOT demand a software solution.

Bottom line: I like ZoneLog Analyzer better than ClearZone anyhow!;) It has the option in it already that Gibson wants from Brady - now, what happens if I don't stick Gibson's IP in it? See - it still boils down to the End User dealing with the problem, not the programmers.

reply to 2kmaro
I appreciate the comments left by those folks who felt that hearing only Ben Brady's side of this story might not be completely fair.

After a flurry of private eMail Friday with Ben, during which both sides of the dialog became increasingly heated, it was pretty clear that Ben and I were at an impasse.

It was then that he unilaterally wrote and published a one-sided document -- quoting me well out of context -- and naturally expressing his side of our "dispute".

He told me that "I'd be sorry" ... and I suppose he was right, since I am. But I'm not sorry for the reasons he imagined, since I'm not much worried about the consequences of Ben's publication. I'm more saddened that we have been unable to reach an amicable resolution.

Ben publicly posted over in comp.security.firewalls (where you can see and verify it for yourself) that he would be willing to update his programs to prevent their generation of false and incorrect eMail reports from contact with my ShieldsUP! servers ... if I were to pay him $20,000. But, frankly, that seems out of line to me, and perhaps a bit like extortion.

Like many of you here, who apparently feel that my ego has expanded to take over the West Coast (except I suppose that Bill Gates is here too , Ben's real issue seems not to be as much about security reporting problems, but more about my public dislike for BlackICE Defender, which I have publicly stated I think "cries wolf" too much and scares folks. He and I have gone around about that before, and he seems to still be annoyed with me for that reason.

But, in any event ... I had hoped that this whole mess would blow over and resolve itself. But having just discovered this thread at DSL Reports, it seems that I will be forced to create and post a public statement to explain and defend myself against the decidedly one-sided portrayal which Ben has created.

In the meantime, I wrote a note over in comp.security.firewalls yesterday, which I'll copy here so that you can get some sense for my position in all this.

And to those of you who expressed some acknowledgement for everything I've freely given to the Internet security community over the past year and a half, and the greater PC community during the past fifteen years ... thanks for the thanks.

Steve Gibson.