full-disclosure - Proposal: how to notify owners of compromised PC's

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: phil at tux.obix.com (Phil Brutsche)
Subject: Proposal: how to notify owners of compromised
 PC's

petard wrote:

> This is in fact our preferred mode of operation at example.com, as it
> allows maximum client interoperability, or did anyway... It was
> our only mode of operation at that time. When this happened with my ISP,
> unannounced,

Lemme guess... Cox Cable?

> At any rate, blocking port 25 is a half-assed solution to a problem that
> needs to be solved at the MUA, not the MTA or MSA.

Someone's irresponsible use of their MUA is not the only problem. 
Blocking outbound TCP port 25 stops a virus/worm and spam problem that's 
caused by more than just crap like the Mydoom variants.

It may be "half-assed" but it's easier and more effective than getting 
you-know-who to fix their sorry excuses for mail clients and/or getting 
end users to not be such morons.

-- 

Phil Brutsche
phil@....obix.com