Ouch so harsh the criticism ~ though justified

Sandi Hardmeier over at the spywaresucks blog who I have an immense amount of respect for has some pretty harsh words of criticism regarding the blog worm which is spreading via social networking across the internet. I agree with her conclusions that while Robin Schuil may have nothing but the best intentions in posting the blog worm it is irresponsible for people to trust Robin carte blanche. Say for instance Robin replaces the innocuous file with something that is way worse say a WMF file. Now take that a step further what if Robin's site got hacked and the picture were replaced without his knowledge. Or someone saw the distribution potential and attempted to capture the same effect except for malicious purposes. It is all simply a matter of trust just because something seems innocent doesn't mean it is, just think of the Greek's and the Trojan horse if you need a clearer example.

Just to clarify though Robin I think it is a cute idea I would however recommend that you provide a download link for people to host your image. The blog worm can still spread but it should be tamed.

Spyware Sucks : Today's "You're an IDIOT" award goes to...

Comments

[Robin Schuil]

Hi,

Few comments:
a) I'm a "he" not a "she". Thanks for that ;)
b) I understand the concern, but isn't that with every image? For example, your Bloglines etc. buttons in your sidebar are hosted by Bloglines. If they got hacked you would be vulnerable to the same problem.
I don't see why Blog.Worm is more dangerous.

(please copy follow ups to my mail too)

[Psyne]

A) Sorry about the gender confusion I actually tried not use he or she but because I was unsure though somehow it crept back in. I have since fixed it.

B) Your correct that is a concern with every hosted image in this day and age. Years ago images were considered harmless and non exploitable though in recent days those assumptions have been proved false. As for the Bloglines image you are correct and I should be hosting that locally as well. I will try to make that change as soon as possible as well with all non-locally hosted images.

Robin please do not take my criticism as harsh if anything I am a proponent of your idea. I think it is a great concept and even endorse it by posting it on my blog. I would be remiss though writing a blog concerning security and spy-ware and implicitly trusting someone I have never met nor have any true knowledge of their intentions.