[comp.virus] Virii

padgett%tccslr.dnet@UVS1.orl.mmc.com (A. Padgett Peterson) (05/23/90)

The nice thing about a small group of people is that we can decide our
own conventions. Personally, I prefer virii for several reasons:

1) Viri is already taken (vir)
2) Virae is possible but equally incorrect.
3) American English will adopt anything.
4) Virii is distinctive, understood by most researchers, and much easier
   than viruses for a two-finger typist.
5) Virii, when spoken, readily lends itself to an intonation a la Yogi Bear.

		Padgett - 10 minutes north of DisneyWorld

padgett%tccslr.dnet@mmc.com (A. Padgett Peterson) (05/14/91)

>From:    p1@arkham.wimsey.bc.ca (Rob Slade)
>Padgett:  We must sue the vendors!

Well, this isn't quite what I said, however what we have here is a
simple lesson in perception and economics. Quality assurance, which
includes sampling and integrity validation (what we are shipping is
what we said we would ship), has a cost.

Traditionally, the most difficult cost centers to justify are security
and quality assurance since anything they find can keep the product
from going out the door. In the case of security, the risk is
apparent, but quality assurance is usually the result of contractual
clauses that specify it.

Most electrical appliances carry the Underwriters Laboratories seal of
approval because vendors have discovered that the seal works both
ways, protecting both the consumer and the vendor.

The problem is that with software, there is no such seal, nor is there
any demand for one. To the vendors, QA is not a justifiable expense at
the disk level since there is no requirement for it. Similarly, if a
problem is discovered, most vendors will try to sweep it under the rug
since to admit that a problem exists would open them to liability and
lost sales. Since at present there is no risk in doing so, it is the
exceptional company that will "go public" with a problem.

The only way this is going to change is if the risks of not "going
public" becomes greater than the risks from "going public". Hopefully,
the cost of either will also make effective QA cost effective. Hence
my comment "bring in the lawyers", not necessarily to sue, but to
explain such concepts as "culpable negligence" in such a way that
no-one can plead ignorance & the corporate managers can go to their
bosses for QA funding with some hope of success.

Unfortunately, as with the SPA, it is probably going to take a few
publicised civil actions before the vendors are going to do the "right
thing", I was surprised a year ago that it had not already happened.
Of course a full recall of all such software is a bitter and expensive
pill for a company to swallow (and why most automotive recalls, while
always publicised as "for our customer's safety" by the manufacturers,
are often the result of a tooth & nail fight with NHTSA (did I get the
letters right ?) before they become official.

At the moment there is no computer industry "NHTSA" (and few qualified
people who would be willing to serve on it).

Having been in the corporate world since leaving the unfriendly skies
of SouthEast Asia. I KNOW that there must be good people at companies
like Packard-Bell who are being forced to follow a "party line"
against their better judgement (incidently, from what I have seen, the
equipment is pretty good and reasonably priced).

However, this does not help the customer with their third largest
investment (?) who finds their PC useless shortly after arriving home,
something that is going ultimately to hurt the entire industry for
some time to come (see below).

>From:    Peter Jones <MAINT@UQAM.BITNET>
>Subject: Re: Packard-Bell (PC)

>Perhaps the recent sightings are due to diskettes remaining in
>storage for 6 months or so.

Quite likely, though the reports of the Azusa are new. However,
considering how these units are sold (department stores, mail order),
that inventory is liable to be around for quite some time to come. You
would think that the manufacturer could at least identify which lots
and models are liable to have infected disks, certainly the two
viruses involved (MusicBug & Azusa) are easy to identify & the
distribution disks reported to be infected (COMBASE, TVGA, & SVGA) are
limited.

In short, while I am sure that Ken will be glad to see an end to this
issue, to me it is a vital one that we can either learn from and
insist on safeguards from those best able to provide them, or have the
interesting experience of repeating it again in another six months or
so.

                                        Warmly,
                                                 Padgett