Subject: Re: 7. BCP - Default Settings (was Re: [Asrg] 0. - General - Consent and SoBig)

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 24 Aug 2003 15:09:16 -0400

At 03:36 PM 8/24/2003, [email-masked] wrote:
>On Sun, 24 Aug 2003, Yakov Shafranovich <[email-masked]> wrote:
> >[Mod. moved to BCP area]
>
> >At 11:57 PM 8/23/2003, [email-masked] wrote:
> >>On Sat, 23 Aug 2003, Kee Hinckley <[email-masked]> wrote:
> >> >At 1:01 PM -0500 8/23/03, [email-masked] wrote:
> >> >>Most of these recipients who allowed this worm to infect their
> >> >>computer probably
> >> >>would NOT have had authorized those senders to send attachments at 
> all, let
> >> >>alone EXECUTABLE attachments.
>
> >> >The fact that they are so used to getting attachments that they click
> >> >on one without thinking would seem to indicate otherwise.
>
> >>Most of them are probably used to getting image or text attachments, or WAV
> >>files maybe, and never dream that these are executable program (or
> >>probably even
> >>how to tell the difference).
>
> >>I still contend that most users would have a VERY small number of senders
> >>authorized to send the executable attachments, and thus would be spared the
> >>angst of most of these worms and viruses.
>
> >This is best addressed within the BCP area. Would anyone like to volunteer?
>
>What are you asking us to volunteer to do?  I'd like to help, although my 
>time
>is limited (and unfortunately I've not got a salary to count on keeping the
>bills paid...)

There is an existing RFC on BCPs for mail admins, RFC 2505, 
(http://www.ietf.org/rfc/rfc2505.txt). It needs to be updated. There are 
also various other documents in that area like BCPs for end-users. What I 
am asking is for someone to take charge of this area and start working on 
some documents. And even if you do not have the time to collaborate, you 
can give some time to review the documents and comments on them, with 
others who have ample more time to actually write them.

Yakov

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Knowles <[email-masked]>
Date: Sun, 24 Aug 2003 23:09:03 +0200

At 3:09 PM -0400 2003/08/24, Yakov Shafranovich wrote:

>>What are you asking us to volunteer to do?  I'd like to help, 
>>although my time

	I don't have a salary coming in, either.  I imagine this is not 
an unusual problem in the current financial climate of the industry.

>  (http://www.ietf.org/rfc/rfc2505.txt).

	Reading it now.

>                                          It needs to be updated.

	I haven't gotten all the way through it, but it doesn't seem to 
be that out-of-date.  Do you have any specific issues with it?

>                                                                   There
>  are also various other documents in that area like BCPs for end-users.
>  What I am asking is for someone to take charge of this area and start
>  working on some documents. And even if you do not have the time to
>  collaborate, you can give some time to review the documents and
>  comments on them, with others who have ample more time to actually
>  write them.

	I can certainly participate on a team of reviewers and editors.

	I would also be willing to coordinate this effort, until/unless 
someone more qualified steps forward, or someone objects.

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 26 Aug 2003 23:25:07 -0400

At 01:23 PM 8/25/2003, [email-masked] wrote:

>I wonder how many typical end-users would even know that such a document 
>EXISTS,
>let alone where to find it?

Thats part of our task as well - to determine the best way to getting the 
info to them, perhaps via ISPs.

>I could probably do the same.

Please coordinate with Brad if you want to concentrate on BCP are specifically.