Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!purdue!mentor.cc.purdue.edu!akl
From: akl@mentor.cc.purdue.edu (Rob Tillotson)
Newsgroups: comp.sys.amiga
Subject: Re: Yow! Is this SUPPOSED to be here!?
Message-ID: <1323@mentor.cc.purdue.edu>
Date: 14 Feb 89 22:12:33 GMT
References: <8677@louie.udel.EDU> <1316@mentor.cc.purdue.edu> <7630@xanth.cs.odu.edu>
Reply-To: akl@mentor.cc.purdue.edu (Rob Tillotson)
Organization: Bored Students Anonymous
Lines: 40

In article <7630@xanth.cs.odu.edu> tadguy@cs.odu.edu (Tad Guy) writes:
>In article <8677@louie.udel.EDU> smith@aic.nrl.navy.mil (Russ Smith) writes:
>>[ finds virus-like strings in the warp executable on xanth.cs.odu.edu ]
>
>In article <1316@mentor.cc.purdue.edu>, akl@mentor (Rob Tillotson) writes:
>>     As far as I know it is supposed to be there.
>
>I don't care how useful this is, this kind of functionality just isn't
>appropriate.

     Why isn't it appropriate?  Warp's purpose is to compress entire disks
for transit, preserving all data including the boot block.  It seems to me
that checking the boot block for known viruses when it is transferred is a
very appropriate idea.  In fact, *not* checking for viruses in a program
such as Warp would be highly irresponsible given its function.  Remember,
not everyone uses a standard virus checking program, and those who do are not
necessarily going to be using it at the moment they unwarp or boot a recently
unwarped disk.

>I wonder how many other observant people noticed those strings, and
>ended up discarding the software?  They probably did the right thing.

     I would certainly be suspicious of such strings in a program that had
nothing to do with boot blocks, but Warp does.  Considering that Warp does
have a reason to be checking for viruses, I would try to find out whether that
was indeed their function, rather than discarding the program entirely.  I
figure it is always better to give such a program the benefit of the doubt and
figure out *why* it looks like it has a virus, rather than throwing possibly
harmless code out the window because it looks a little bit suspicious.

G'day, eh?
--TS

Disclaimer:  I didn't write Warp, I just use it every now and then.  And
Purdue probably doesn't care.

-- 
Rob Tillotson                           Usenet:  akl@mace.cc.purdue.edu
320 Brown St. #406                      BITNET:  ROBT@PURCCVM
West Lafayette, IN 47906                  Fido:  1:201/40.302