Steve Gibson - All Bent out of Shape?? - Security

Author	All Replies
2kmaro Think Premium,ExMod 1 BC join:2000-07-11 ColossalCave	Steve Gibson - All Bent out of Shape?? First - let me go on record as stating that I consider Steve Gibson a good source of security information. He has also strongly supported the ZoneAlarm software firewall since its inception, a support stance that I share with him. But if all that I read in this email from one company is true, then I think Steve is getting a bit of a case of 'the big head' Ben E. Brady of Brady & Associates is a software house, they make software similar to ZoneLog Analyzer for use with ZoneAlarm, BlackICE Defender and WinRoute Pro. These tools simply read those program's log file and present it in a manner for the user to interpret and take action based on their best judgment (which I have to admit, sometimes is pretty poor). Obviously the arguement that Gibson puts forth could extend to ZoneLog Analyzer (which happens to have a feature to exclude certain specified IPs from reporting). Anyhow, I post the entire email I got from Ben E. Brady/Brady & Associates for your examination and comment: ---------- Press Release: March 2, 2001 For immediate distribution.... Steve Gibson, self-appointed Internet security guru, has apparently decided to take on yet another crusade.... This time, instead of attacking the various personal firewall products and their capabilities, he has settled his crosshairs on Brady & Associates, LLC., creators of the very popular personal firewall reporting utilities ClearICE Report Utility for BlackICE Defender, ClearRoute Report Utility for WinRoute Pro and ClearZone Report Utility for ZoneAlarm and ZAPro. Gibson, owner of the Shields Up web site where over 7 million users have 'tested' the security of their computers, has authored a series of email messages to Ben E. Brady of Brady & Associates, demanding that Mr. Brady make changes to his software that would disable the reporting of attacks that have emanated from the Shields Up web site. Stating that users of the popular reporting utilities are 'harassing' him and his ISP by submitting 'attack' reports, Gibson threatened to make public statements of a derogatory nature regarding the utilities, in order to deliberately discourage the use of them and damage the reputation of the products. In a message to Mr. Brady on January 7, 2001, Gibson said ... "I and my ISP (Verio) are being SPAMMED with eMail generated by idiot users of your tools which are using ShieldsUP! then, apparently, simply sending "attack" reports without examining them." In response to the message, Mr. Brady immediately revised the Online Help for the various utilities to make it clear to users not to report attacks from the Shields Up web site. »www.firewallreporting.com/cleari···rice.htm »www.firewallreporting.com/clearr···oute.htm »www.firewallreporting.com/clearz···zone.htm Gibson contends that the software is 'defective' because it allows the user to send attack reports intercepted by the user's personal firewall program without 'filtering' for Gibson's IP address ranges as false alarms to Gibson's ISP, Verio, Inc. Brady has stated "The the utilities do nothing more than paste the pre-formatted attack information parsed from the various attack log files from BlackICE Defender, WinRoute Pro and ZoneAlarm into the Windows clipboard. It is up to the user to invoke the email client of their choice, paste the message into the body of the email and send it to the appropriate email address of the attacker's ISP. I encourage all users to use common sense and discretion in reporting attacks, otherwise the result would be like the little boy who cried wolf." Brady has offered to make changes to the programs, in a manner that would not filter the information but still discourage the user from reporting Shields Up attacks, provided Gibson pays for the development and testing of the modification. Gibson has refused to contract for the changes. Brady states, "It is a matter of principle. Steve wants me to make a change that I feel would compromise the integrity of the information contained in the log files by filtering any attack that is received from his range of IP addresses. The problem is that it would become very attractive for hackers to impersonate Gibson's IP addresses in order to attack other computers. I have offered to create a 'solution' that would not filter the content of the logs, however, Steve is trying to force me into making the changes, using threats of making disparaging public statements about my products, because he thinks the changes would be more in line with the 'wishes of the users of my products'." Among the threats he has used, Gibson has assumed the position that unless Brady & Associates changes their products, he will require that anyone subscribing to his yet-to-be-released 'pay for play' firewall security scanning service remove the reporting utilies from their computers and that if any subscriber to the service were to submit a report of an attack from the Shields Up service their subscription would be terminated. Gibson stated in an email dated March 2, 2001, "As you may know, the next generation of my work will include a subscription service which autonomously and continually (daily) checks the security of a user's system. At the user's paid request this will significantly increase the incidence of unexpected packets arriving from the GRC domain. Since I anticipate a corresponding increase in the level of harassment from your defective utilities, if you do not PREEMPTIVELY repair your broken products, I will be forced to make it very clear -- up front in every presentation of the service's subscription agreement -- that the receipt of an intrusion report generated by any of your utilities will result in the immediate termination of the user's subscription and a refund of their unused balance. The subscription agreement will require them to agree to uninstall and NOT USE any of your products until the defects in those products have been cured" Gibson also stated in an additional email to Brady, "I am, therefore, giving you formal notice -- WELL IN ADVANCE -- that unless you amend your products to prevent the generation of the eMail my ISP and I have been receiving as a result of the receipt of TCP packets from machines within my domains, all suspense of the use of your products WILL BE A LICENSE REQUIREMENT for the use of my future software and services" Brady said "I have a great deal of respect for Steve, he's done a great service to the Internet community at large, to a great degree he has made the various manufacturers of personal firewall products 'toe the line' with respect to producing a quality product. What he is trying to do here is nothing short of forcing my utilities into censorship on the net." He added, "What Steve doesn't seem to understand is that when he professes to be the best gunfighter in the west he had better be prepared to back it up... and be able to defend himself against anyone that would try to shoot him out of that position. He's made himself out to be a very big target. I have urged all users of ClearICE, ClearRoute and ClearZone to act in a responsible manner with regard to using my products, this has been clearly evidenced in the Online Help file that is available to each and every user of the products." ------------ My personal opinion? Gibson has got a bad case of swelled head - I believe that it should be up to the end user of such products to determine which IPs to report on or not, to include for examination or not. I think a "recommended" list of ones to exercise great caution on is a good idea, but the risk of spoofing an address is there, so no address should be excluded automatically. As a matter of fact, wasn't that the basis of Gibson's LeakTest: that no program should be given permission to use the internet through a firewall just because of its name?? Whoa, Steve - rethink this a little. It is not the products that are faulty, it is the training of the user who bought it.
	to forum · permalink · 2001-03-04 02:01:18 ·
2kmaro Think Premium,ExMod 1 BC join:2000-07-11 ColossalCave	BTW: If anyone notes that all of this has a flavor of two kids on the block refusing to yield right of way on the sidewalk, as: Move over! No, YOU move over! Make me! No, YOU make me! You can't make me! You can't make me either! Well, I have to agree, I see more than a touch of that here.
	to forum · permalink · 2001-03-04 02:06:50 ·
Rocktagon Slightly Bent Premium join:2000-11-04 Chattaroy, WA	reply to 2kmaro hehe, Jeez, wouldn't a simple warning message stating: Use of this scan requires tcp packets be sent to your machine. These will show up on firewall log's as an attack. Please disable logging during this portscan or disregard packets form IP xx.xxx.xx.xx Seems pretty clearcut to me. What a big deal about nothing. Does Justin hear about complaints to secure.me about the portscan's from this site? I would imagine a little education to the folk's asking for the service would go over better than harassing software developers trying to enhance the firewall log understanding. Sheesh....... -- nam et ipsa scientia potestas est SCooTER2
	to forum · permalink · 2001-03-04 02:11:44 ·
Rxdoxx Premium,Mod join:2000-11-03 Middle River, MD kudos:11 Host: Software Washington & Balti.. Philadelphia & Nor..	reply to 2kmaro Now I can get some sleep. I had one vote left thanks 2k, I can see Steve's point but the threats???? sad sad sad. -- Rogaine on my hard drive didn't eliminate the bad spots
	to forum · permalink · 2001-03-04 02:12:48 ·
2kmaro Think Premium,ExMod 1 BC join:2000-07-11 ColossalCave	I think Gibson is trying to push them out of business - so that his pay-for-play service can take over. Perhaps he has dreams of becoming a Baby Bill G.?? Rocktagon- a BRILLIANT suggestion - so common-sense oriented that I passed it along to abuse@verio.com myself in a recent email. [text was edited by author 2001-03-04 02:48:31]
	to forum · permalink · 2001-03-04 02:27:50 ·
nekote join:2000-12-16 Hopkinton, MA	reply to 2kmaro Yes, two stubborn heads that don't seem to have the sense or grace to work out any number of reasonable accommodations (aka compromises). For my stupid $.02, I'll go with Steve, though I don't care for the tone very much. I'd prefer a more matter of fact, "because of the volume of these reports, we will be forced to modify the popular free "Shields Up!" to decline to run on machines using your firewall, unless we (you and us) can come up with a better way to skin this cat. We're both right. How can we make this work? How can "white hat" testers work with "black hat" detectors so we can both benefit the Internet community? We eagerly await an opportunity to jointly create something even better! IF not, very most regrettably, we do not see any other alternative than to act unilaterally." Well, it's just my sorry ass try at a little sensible diplomacy. -- Democracy is the worst form of government, except for all other forms of government. - Winston Churchill
	to forum · permalink · 2001-03-04 02:38:55 ·
Wxman Premium join:2000-09-02 Caledonia, MI	reply to 2kmaro Doesn't this all come down to the end user. You have to use common sense when using any program that analyzes logs that you have on your system. If you request a security scan of your system and get numerous hits, doesn't it make sense to find out where these hits are coming from. You don't blindly start sending out complaints about the offending IP. If you do, then you are the problem not the software. Both of these guys make good points, but I have to believe that Steve is off base here. Wx
	to forum · permalink · 2001-03-04 04:42:47 ·
CJ join:2000-07-18 USA	reply to 2kmaro I knew I never really liked him for a reason. Don't get me wrong. I think he has good information, but as 2K made mention to, I think he has a big head, and maybe he is trying to put someone out of business. Bill Gates didn't do it by threatening people. He simply made a better product. Maybe he should put a WARNING on his website that states that it will put instances in your firewall logs. BOY, that sounds like a great idea. Simple too. Ah hell, that's too easy, and I won't get my 15 mins of fame that way. If I need info on security...... I come here. Nowhere else. I may be a second or third party to his info. But I'll never be a first. Thanks for listening to me rant.
	to forum · permalink · 2001-03-04 06:41:08 ·
gwion wild colonial boy Premium,ExMod 2001-08 join:2000-12-28 Pittsburgh, PA kudos:1	reply to 2kmaro Ahhh, Steve's always getting all bent out of shape. Poor guy needs some tranquilizers. Takes himself altogether too seriously, in my way of looking at things. Good intentions, good advice, mostly, and a service to the community, don't get me wrong, but way to tense, and way too serious about himself. Steve, you're a good fellow; I thank you for making security accessible to the "mainstream" non techie community. However, get a grip. You are NOT the NCSA; you are NOT the NSA; there ARE people out there who are better at this than you are; don't make a career of trying to find fault with everyone and everything; "let he who is without sin," and all that... we all love your page; it's your ego we could do without. On a whole, the first time I saw your page, I thought it was snake oil, just because of all the hyperbole and self-laudatory rhetoric. Lighten up, crack a joke, once in awhile... but, please, stop trying to come off as though you were qualified to teach computer security to the DoD and the NSA, and quit scaring poor little surfers half to death, sometimes. Keep telling them the truth, of course, but take life a little more gently... you won't be able to do anyone any good if you have a massive heart attack at your keyboard from the stress of being caught being wrong, once in awhile... if I took that attitude, I would be dead years ago, for all the times I've been wrong about one or another thing! That's just my opinion... I like Steve's pages, now that I've read through them, and realize that he's pretty well grounded and sincere in his crusade... but, hey, maybe we should take up a collection and buy him a copy of an old Billy Joel tune... "Angry Young Man?" -- Man will occasionally stumble over the truth, but most times he will pick himself up and carry on. - Sir Winston Churchill
	to forum · permalink · 2001-03-04 08:19:53 ·
Wildcatboy Invisible Premium,Mod join:2000-10-30 Toronto, ON kudos:2 Host: Security Product V.. Security	reply to 2kmaro A case of swelled head it is. It's more like a joke to me. It's not Brady's fault that some people are idiots. I think Gibson should put his following comments " I and my ISP (Verio) are being SPAMMED with eMail generated by idiot users of your tools which are using ShieldsUP! " on the front page of his web site and then ask those idiots not to use his tools. So Mr. Gibson just in case you end up reading this thread I like the contributions that you've made but now you are just pissing me off. I guess we should start promoting other on line scans instead of yours. What you need to understand is that there are already several online scans ( Including DSLR's ) and of course the idea of line monitoring is not a new one either and it's not like you came up with the idea. As for the Binding information there are several good sites doing the same and we've been promoting them because they are more clear and easier to understand by those so called idiot users. Now why would we want to come to your site? I'll tell you why, because every now and then you happen to offer some good ideas that are worth reading. Once you discredit yourself like this those ideas are no longer valuable and we no longer need to make that occasional trip to your site and you no longer need to worry about us idiots. Now all we need is for someone to send Mr. Genius an email to come and read this thread. We might as well post something pointing to this thread on his own site for all those idiot users to read. Boy, a bad case of swelled head it is. -- You can catch the Devil, but you can't hold him long.
	to forum · permalink · 2001-03-04 09:48:24 ·

rtoday join:2000-11-05 California	reply to 2kmaro (My previous comments made from ignorance of the issue are removed.) [text was edited by author 2001-03-05 10:36:06]
	to forum · permalink · 2001-03-04 10:24:32 ·
gwion wild colonial boy Premium,ExMod 2001-08 join:2000-12-28 Pittsburgh, PA kudos:1	reply to Wildcatboy I took a look at his page for the first time in quite awhile. hehe... sometimes... anyone remember the character on SNL a few years back? I was picturing it... Network security... yeah, network security, that's the ticket... I perfected... nooo, I invented that concept, yeah, I invented it... that's it... everyone else learned it from me. Back when I built my... nooo... when I built "the" first firewall... yeah, the first firewall... Sound like a good parody skit for the next "DSLR Follies?" -- Man will occasionally stumble over the truth, but most times he will pick himself up and carry on. - Sir Winston Churchill
	to forum · permalink · 2001-03-04 10:28:30 ·
Zhen-Xjell Prolific Bunny Premium,VIP,ExMod 2001-04 join:2000-10-08 Bordentown, NJ	reply to 2kmaro So the true essence of Steve finally shines through. Amazing. Sometimes I wonder if he doesn't hype security too much so that he can get a base of paying customers. He may have contributed a lot on the net, but now everyone else is catching on or has caught on. With Steve's big head, I'm willing to bet it'll burst soon enough.
	to forum · permalink · 2001-03-04 11:18:19 ·
EmilioG Whats This? Premium join:2000-09-19 New York, NY	In true journalistic manner, I would first like to hear Steve Gibsons side on this. I make no judgments either way for now. I would have first tried to contact Steve G. to hear what he has to say, just to be fair.
	to forum · permalink · 2001-03-04 14:11:56 ·
Hpower Roflmao join:2000-06-08 Glendale, CA	reply to 2kmaro Morning everyone, I think now I can watch some more NBA games rather than having to worry about who will be trying to attack me. (The lakers won yesterday against the Grizzlers?) Those logs are nice things, and I have been ignoring them for a quiet while. Actually, I have disabled them, when I used zonealarm. I just thought of logs take space, and fragmenting your hard drive. Thanks for the warning message, 2kmaro. One step ahead. -- Charter Pipeline MACH 3 Service (1.5mbps/512kbps) Status: Working excellent! 1532/489! First hop: Less than 10!
	to forum · permalink · 2001-03-04 14:17:29 ·
EmilioG Whats This? Premium join:2000-09-19 New York, NY	My sentiments exactly. I don't worry about such things too much. I secure my machines as best as possible and i don't keep anything "sensitive" on HDD. All my top secret espionage documents are on Zip Disks.
	to forum · permalink · 2001-03-04 14:35:02 ·
Zhen-Xjell Prolific Bunny Premium,VIP,ExMod 2001-04 join:2000-10-08 Bordentown, NJ	reply to EmilioG said by EmilioG: In true journalistic manner, I would first like to hear Steve Gibsons side on this. I make no judgments either way for now. I would have first tried to contact Steve G. to hear what he has to say, just to be fair. Reading the quote that he called those people "idiots" does not show him to be humble at all in my mind.
	to forum · permalink · 2001-03-04 14:52:47 ·
2kmaro Think Premium,ExMod 1 BC join:2000-07-11 ColossalCave	reply to EmilioG EmilioG - Mr. Gibson does not condescend to respond to any emails I send to his office@ address - at least not to date. I kind of figure that his comments in the email to Brady & Associates spoke for themselves in truth. If the email is false, then Ben Brady has opened himself up to a liabel suit, as the intent (if not simply to inform) was malicious. So either the email is true and we've caught Steve out shopping for 10-gallon hats, or it is false in which case Mr. Gibson will soon own a new software house! I believe you've had luck in contacting Gibson in the past, perhaps once again??
	to forum · permalink · 2001-03-04 14:53:49 ·
Hpower Roflmao join:2000-06-08 Glendale, CA	Weird, well I don't think he is THAT busy....is he? E-mails are the second fastest way to talk to someone, next to phone calls. We should not always listen to the 'most knowledgable person', but rather think twice about what THEY say, and compare it to many others who have the same interest as 'the best' does. Maybe thats why I haven't launched my microsoft outlook express yet. E-mail is kinda risky now these days. -- Charter Pipeline MACH 3 Service (1.5mbps/512kbps) Status: Working excellent! 1532/489! First hop: Less than 10!
	to forum · permalink · 2001-03-04 14:59:22 ·
2kmaro Think Premium,ExMod 1 BC join:2000-07-11 ColossalCave	Maybe he is that busy. I noticed that his 'personal' page on his site hasn't been updated or added to since 1999. LOL! Maybe he hasn't had a life since then??;)
	to forum · permalink · 2001-03-04 15:00:57 ·

Broadband Tech > Security > Security > Steve Gibson - All Bent out of Shape??

Steve Gibson - All Bent out of Shape??