[comp.virus] naming confusion

luken@ubu.cc.lehigh.edu (Kenneth R. van Wyk) (06/05/89)

David Ferbrache helped me out in my quest for information on the
Little Black Box virus (Thanks David!).  Apparently, this virus is a
strain of the Israeli virus.  ...which brings me to my point.

One of the most frustrating things that I've run into is that viruses
get called different things by different people.  Just look at a
couple of the more common ones - Israeli <=> PLO <=> Russian <=> Black
Hole <=> Little Black Box, Brain <=> Pakistani ... (the list goes on).

I'm not proposing any solutions here because, quite frankly, I'm not
aware of any real good solutions.  Anyone have any suggestions?  My
point is merely to point out the cause for confusion and hopefully
generate some discussion on it.

Ken

RADAI1@HBUNOS.BITNET (Y. Radai) (06/07/89)

  In #128 Ken writes:
>One of the most frustrating things that I've run into is that viruses
>get called different things by different people.  Just look at a
>couple of the more common ones - Israeli <=> PLO <=> Russian <=> Black
>Hole <=> Little Black Box, Brain <=> Pakistani ... (the list goes on).

>I'm not proposing any solutions here because, quite frankly, I'm not
>aware of any real good solutions.  Anyone have any suggestions?  My
>point is merely to point out the cause for confusion and hopefully
>generate some discussion on it.

  I don't think we can prevent multiplicity of names, but some names
are more reasonable than others.  For example, if a user sees a region
of his screen scroll up and leave a black rectangle, it's understand-
able that he should call it the "Little Black Box" if he's never heard
of the Israeli virus before.
  On the other hand, the term "PLO" as a name for the Israeli virus is
entirely inappropriate since it suggests a political motive for the
virus, a hypothesis which, to the best of my knowledge, has never been
supported by *any evidence whatsoever*.  The first person to suggest
this motive seems to have been Vin McLellan, who wrote in a New York
Times article of Jan 31, 1988 that the virus "was apparently intended
as a weapon of political protest".  But his sole "evidence" was the
coincidence of dates which he discovered between the first day on
which the virus would cause damage (it does this only on Friday-the-
13ths) and the 40th anniversary of the last day Palestine was under
the British mandate (May 13, 1988)!  I wrote to him, pointing out how
flimsy his evidence was.  I also pointed out that whatever psychologi-
cal drive motivates most creators of viruses and Trojan Horses else-
where in the world, and whatever motivated the author of the April-
Fools-Day viruses (which were discovered in Israel about the same
time, yet no one claims that *they* were politically motivated), is
quite sufficient to motivate creation of our Friday-the-13th virus
also.  Now I have no doubt that McLellan's intentions were good.  But
as he eventually admitted to me, he "was too quick to assume too much
about this virus, its author, and its intent."  Unfortunately, his
explanation was already accepted by many people, even to the point of
dubbing this virus the "PLO" virus.
  The name "PLO" is therefore entirely inappropriate and I would like
to request readers of this list to refrain from using this name.

  As for the other synonyms for the Israeli virus (btw, I can add 7
more to those mentioned by Ken), I can understand the reason for all
of them except "Russian".  Does anyone have any idea what motivated
*that* name??

                                          Y. Radai
                                          Hebrew Univ. of Jerusalem

rmorey@ORION.CF.UCI.EDU (06/09/89)

  Regarding the "PLO" virus and your suggestion that we not call it by
that name, don't you think that your desire to suppress the link
between the virus and something which obviously offends you (the name
"PLO") is a political tactic?  That particular virus is known to many
people already as the "PLO virus"--now you expect them to have to
worry about changing that name in their minds because it offends
someone?
  Don't forget that viruses offend everyone, most certainly everyone
who reads this net.  We all have a common interest in combating
viruses and their spread but I really doubt that we are going to spend
much time worrying about their names.  I apologize if this offends you
but, given both my interest in international politics and my work in
computers, I don't see how both should be meshed or affected at such a
perfunctory level.
                                              Robert J. Morey

[Ed. In mentioning the confusion in the naming convention for viruses,
I never intended to start a political discussion/war - let's please
not turn this into one.]

NEWTON@NBSENH.BITNET (Barry L. Newton) (06/10/89)

Just as a thought, it shouldn't be too difficult to arrange something
based on a date/time stamp placed upon any *new* virus mentioned on
virus-l.  This would naturally be based purely on the judgement, spare
time and goodwill of the list moderator :-)...It could be as simple as
a text file (document) listing virus-l reference name and known
aliases (as they appear).

If the aforementioned spare time (!) and good will stretch far enough,
another useful add-on would be a cumulative list of virus-l references
kept with each virus name entry.  This is of course quite audacious to
propose, but I think it would enhance the value of the list (and
particularly the archives) considerably.  It seems like a sufficiently
worth-while effort that the member- ship might propose indexing the
archives to their various employers as a project worthy of
institutional support.  (Money, labor, whatever.)  I will.

Barry L. Newton
National Institute of Standards and Technology
(Which is not responsible for my opinions, gaffes, or lapses in judgement)

RADAI1@HBUNOS.BITNET (Y. Radai) (06/12/89)

  Robert Morey writes (#133):

>  Regarding the "PLO" virus and your suggestion that we not call it by
>that name, don't you think that your desire to suppress the link
>between the virus and something which obviously offends you (the name
>"PLO") is a political tactic?

  It's unfortunate that Mr. Morey has read a political motive into my
remarks.  His claims that I'm "obviously offended" by the name "PLO"
and that I'm trying to "suppress" something are products of his
imagination alone and have no basis in reality.  My reason for being
opposed to labelling the Israeli virus the "PLO" virus is precisely
the same reason that I am opposed to labelling it the "DAR" virus, the
"Mongolian" virus or the "Einstein" virus: These names are simply
INAPPROPRIATE.  That's really all there is to it, Mr. Morey.  Of
course, no one can prevent your imagination from concocting other
motivations.  But you have no right to accuse people of them without
evidence, which you certainly don't have in my case since your claims
are false.

>                               That particular virus is known to many
>people already as the "PLO virus"--now you expect them to have to
>worry about changing that name in their minds because it offends
>someone?

  Is changing a name really such a hardship for you?  Suppose it
turned out that the story about the Brain virus originating in
Pakistan was merely a rumor, spread by someone with a hyperactive
imagination, that it really originated in Timbuctoo, and never even
spread to Pakistan.  And suppose on that basis someone in Pakistan
asked us to stop referring to it as the Pakistani virus.  I would
comply immediately.  No problem, no "worry".  Are you so inflexible
that you can't do the same in the case of the so-called "PLO" virus??
If you're offended by the name "Israeli", you can call it the "Friday-
13" virus, the "Little Black Box", or any of about 8 other reasonable
names.  Btw, suppose that someone started calling the Israeli virus
the "Morey" virus and that this name caught on.  Wouldn't you feel
like asking people to stop using this name?  I wonder if you'd be
quite so sympathetic in that case to the plight of people having to
alter their habits simply "because it offends someone" ....

  If you wish to continue this discussion, fine.  But if it's anything
more than a one-sentence apology for attributing false motives to me,
mail your remarks to me personally.  VIRUS-L is not a forum for poli-
tics or slanders.

                                          Y. Radai
                                          Hebrew Univ. of Jerusalem

  P.S.  On another subject:  In Issue 116 (May 16) I posted a list of
20 PC viruses and asked if anyone has comments to send them to me
personally.  It turns out that precisely at that time we had mailer
problems and a lot of mail which was addressed to me didn't reach me.
So if anyone sent me mail and didn't receive a reply, please re-send.

hull@unmvax.cs.unm.edu (Jeff Hull) (06/13/89)

>  If you wish to continue this discussion, fine.  But if it's anything
>more than a one-sentence apology for attributing false motives to me,
>mail your remarks to me personally.  VIRUS-L is not a forum for poli-
>tics or slanders.

Perhaps e-mail to the moderator of this newsgroup/mailing list would
be sufficient to move your discussion with Mr. Morey elsewhere?

>                                          Y. Radai
>                                          Hebrew Univ. of Jerusalem
>
>  P.S.  On another subject:  In Issue 116 (May 16) I posted a list of
>20 PC viruses and asked if anyone has comments to send them to me
>personally.  It turns out that precisely at that time we had mailer
>problems and a lot of mail which was addressed to me didn't reach me.
>So if anyone sent me mail and didn't receive a reply, please re-send.

I was off the net for a month and didn't see your list. would you
please e-mail me a copy?

I am interested in developing a taxonomy of computer software with
special interest in "biological" software, i.e., software capable of
replicating itself, which includes viruses, worms, phages and others,
and a secondary interest in penetration algorithms.  Would you please
favor me with any thoughts you have on this topic?

Blessed Be,

Jeff Hull         ...!ncar!dinl!hull
1544 S. Vaughn Circle	303-750-3538	It was great when it all begaaaaan,
Aurora, CO 80012			I was a regular <USENET> faaaan, ....