Re: "Bugbear" virus in Linux?

From: Peter T. Breuer (ptb_at_oboe.it.uc3m.es)
Date: 07/13/03 

Date: Sun, 13 Jul 2003 10:50:43 +0200

Rod Smith <rodsmith@nessus.rodsbooks.com> wrote:
> In article <tudpeb.868.ln@news.it.uc3m.es>,
> "Peter T. Breuer" <ptb@oboe.it.uc3m.es> writes:
>>
>> Rod Smith <rodsmith@nessus.rodsbooks.com> wrote:
>>> In article <8gqneb.ro3.ln@news.it.uc3m.es>,
>>> "Peter T. Breuer" <ptb@oboe.it.uc3m.es> writes:
>>
>>>> The
>>>> observation that some people run as root some of the time only raises
>>>> the probability of virus trasmission, it does not guarantee it, and it
>>>> does not make virus transmission a real concern.
>>
>>> So you're now saying that Linux viruses are POSSIBLE, but that they're
>>
>> No I am NOT saying that! Where do you get that idea from? I said, and I
>> quote: "[running as root some of the time] only raises
>> the probability of virus trasmission, it does not guarantee it".

> If the probability increases, that means it must be greater than 0; hence,
> it's possible.

Your "hence" is wrong! Having a probability of transmission greater
than zero does not imply that a virus is possible. I really refuse to
do this baby-arithmetic. PLEASE review your studies of dynamic
stochastic systems.

I even explained it to you ...

>> Raising the transmission probabilities does not turn a virus from being
>> impossible to possible, it merely increases the size of the off-diagonal
>> entries in the transmission matrix. That leaves the virus "impossible"!
>> It /still/ fails to have a transmision expectation larger than its
>> expected lifetime, if you must have further explanation of the obvious.
>> A virus which does not spread is not a virus.

> You're talking about a virus that spreads and continues to remain viable
> over time. That's a much higher bar than the mere existence of a virus,

Well, it's a prerequisite to having the name "virus". A virus that cannot
spread is not a virus, and it cannot spread if the expected number of
systems it will infect in its lifetime is less than one, and the
expected number of systems it can infect is calculated from the
tramsmission probability matrix ...

> including spreading to a limited number of systems, even if it's not very

I refuse to argue with a man who cannot grok simple markovian probability.
The probabilitities being > 0 does not imply that the expected spread > 1!

> successful (that is, it dies out naturally). If you want to say that a
> Linux virus is impossible to be successful in the sense of continuing to
> spread indefinitely, then please say so; shortening your statement to say

No, it does not SPREAD. Not "spread indefinitely". It will contaminate
a minute number, most probably none, of secondaries, and then go down in
history with a whimper. It will not SURVIVE.

> that the virus is flat-out impossible is misleading.

It is impossible. The virus will not spread. So the virus cannot
exist, since it will merely be one of the large class of programs that
do not spread.

>> GO TAKE A LESSON IN ELEMENTARY STATISTICS AND EPIDEMIOLOGY! You are
>> annoying me with your incomprehension.

> There's no need to be rude. FYI, I hold a PhD in cognitive psychology. As

I'm not being rude, I'm being frustrated by a person sho seems to think
that because the entries in the probability matrix are nonzero, that
the expected spread will be> 1. Not so.

> such, I've taken graduate-level statistics classes, although admittedly no
> epidemiology classes.

Tough - I know exactly what sort of rank correlation classes you have
taken. Some of my best friends were animal psych doctoral students,
while I was teaching math. You need to understand that the thing just
does not spread. It is a non-virus because a virus that does not spread
is not a virus - what are we supposed to do? Come and ogle at it on
your machine?

>> NO they are NOT possible. Learn some mathematics.

> You seem to be using the word "possible" in a different way than I. Your
> definition includes successful long-term spread. Mine doesn't; mine just

No, it includes SPREAD. I am simply asking that the total population
affected in the epidemial outbreak be greater than about 2. I do not
require that the virus persist indefinitely (epidemiology will say that
it should always persist forever at a low level, but we know that
when the "low-level" goes below 1, it's dead).

> assumes that the virus can spread from one system to another, not that it
> will continue spreading forevermore. Furthermore, your view ignores the
> possibility of changes in culture, available tools, etc., which might
> make a virus that couldn't survive for long today a real threat in the

It won't get to the future.

> future. It's very hard to predict what cultural changes, software bugs,
> new software products, and whatnot might occur, thus making claims of
> something being "impossible" because of current common practices shaky at
> best. I believe you're also using "impossible" to refer to very
> low-probability events, albeit those with probabilities greater than 0.
> I'm not. If the probability is greater than 0, it's not impossible.

Oh yes it is, but you don't seem to understand the difference between
probability > 0 and expectation > 1. Expectation of affected machines >
1 is what I am talking about. The probability of spreading may well be
> 0! It's irrelevant.

> Period. It may be so improbable that it's not worth worrying about, but
> if that's what you mean, please say so.

I mean exactly what I am saying.

> This will be my last post on this topic; I'm not interested in further
> debating the meaning of the word "impossible" or responding to
> increasingly rude comments.

Then stop being rude yourself - it's offensive to mess up on your maths
in such a childish way.

Peter

Relevant Pages

  • Questions about Avian Flu
    ... This lead me to find out how the virus is transmitted between ... birds. ... Spread between birds ... Fecal shedding for 7-14 days after infection ...
    (uk.business.agriculture)
  • Re: Bad news: Mac virus
    ... Reports surfaced today that a new virus is slowly spreading ... The virus continues to spread ... Mac users usually have a relatively lower risk of viruses than their ... Apple employees were likely another ...
    (comp.sys.mac.system)
  • Re: "Bugbear" virus in Linux?
    ... > the probability of virus trasmission, ... If the probability increases, that means it must be greater than 0; ... > A virus which does not spread is not a virus. ... Linux virus is impossible to be successful in the sense of continuing to ...
    (comp.os.linux.misc)
  • Re: Saudis fear niggerborne polio outbreak during Hajj
    ... > Kingdom Moves to Halt Polio Spread ... > 19 countries currently reporting polio cases. ... > virus, the spokesman said, adding that polio immunization for the cited ... > fears the virus could spread within the Kingdom or be carried by pilgrims ...
    (alt.religion.islam)
  • Re: Mac OS X virus (or trojan) in the wild
    ... "Mac Rumors reports on what may be the first virus to affect OS X ... The virus is said to also spread via Bon Jour instant messaging." ... apps) and in the modern internet-era sense (spreads to other machines ... Spotlight) so whenever these apps are run, they execute the malware, ...
    (comp.sys.mac.advocacy)