Spreading the Virus
May 17, 2000
After the "Love" virus epidemic, the expression "viral
marketing," popular last year, looks... so last year.
Examples of viral marketing ranged from the Real Player to
WinZip, from Adobe Acrobat to... Internet Explorer, the
virus that killed Navigator. The idea was and still is to
infect as many PCs as quickly as possible using the Net as
the transport mechanism for both the product and the buzz
about the product. Calling this "viral," even in the case
of a certain HTML interpreter, is a little extreme. Such
products, even if they occasionally maim their competition,
are not supposed to damage my PC or the files stored on my
hard disk -- notwithstanding the therapeutic benefits of
periodically reformatting and rebuilding one's system.
A true virus is designed to corrupt a system and to
replicate itself across the Net. Pursuing the biological
simile, observers pointed out another problem caused by
Microsoft's monopoly: the lack of genetic diversity in the
PC ecosystem. Because PCs and their software are too similar,
one noxious automaton can do much more damage than would
occur if we had several alternative life forms.
This argument deserves closer examination. True, BeOS, MacOS,
and Linux users were not infected by the Love virus. Had each
system had 25% market share, a single virus could only infect
25% of the population. And, if you assume some degree of
precaution or paranoia on the part of users, sys admins, or
ISPs, the 25% infection rate would be even lower.
We'll quickly dispose of the argument that users should know
better than to open an attachment without questioning its
provenance. Yes, but no. Computers are supposed to serve us,
to make our lives easier and simpler. Computers juggle very
complex tasks under the hood, so they should take care of
virus-carrying attachments for us. But that's where sloppy
technical habits come in. In the name of making things
easier (for whom?), Microsoft engineers have made Windows
too susceptible to manipulation behind the user's back. No
alert asks the user's permission and nothing verifies the
origin of a program that modifies a key part of the system
such as the registry, or that sends e-mail not created by
the user.
It reminds us of a certain Chairman, in a video deposition,
quibbling that the computer, not he, had sent an incriminating
e-mail. We ingrates now realize he was just being prophetic.
Seriously, the fixes in preparation for Outlook will address
these weaknesses without impeding our ability to download and
install software updates from the right sources.
Going back to the eco-diversity argument, it might contain a
hidden flaw. With the Web, all browsers from all OS's need to
adhere to the same set of *ML definitions in order to
faithfully render Web content. In other words, all platforms
are supposed to interpret *ML tokens in the same way. The
unanswered question is whether or not this required
conformity is a path to large scale infections by malicious
applets.
This last word brings up Java and its greater immunity from
attacks -- not absolute, just greater. But, can everything
required for Web navigation be performed solely within the
safer confines of a Java environment? We know the answer:
there is no JavaOS. So, we're left with "mixed" solutions
and unanswered questions. As Web-enabled devices -- a.k.a,
appliances -- proliferate, we'll have to inoculate these
life forms against malicious programs on both server and
client sides of the connection without placing too many
restrictions on the real freedom to innovate.
The frightening thing about the Love virus is that it was
partially botched. In a way, it was a welcome warning against
more efficient plagues, including strains that could do harm
on more than one platform. We acknowledge that no OS, ours
included, is invulnerable, but it is the degree of vulnerability
that matters.