Rather than bother with looking at or damaging your boring files, it's
more likely that the person who broke in would redirect your ports or
install a proxy, a bot to launch DoS attacks, a bot to spam IRC users,
or any one of a number of other tools s/he could use to further damage
the 'net as a whole. By taking what security measures you do, you are
being a good netizen rather than just protecting the files you can
afford to shrug off.
Exactly. And if I can take the liberty of wandering even further off
topic, I'm reminded of the role ISPs are now playing in our "world
netizen community" by offering (often optional) malware and spam
blocking. There was a time when I was concerned that ISPs would screw
this sort of thing up ... not have the competence to "do it right".
Like many others, I was opposed to the idea, and sided with those
having the attitude of "I can take care of my own security".
Then Sircam came along and my server mailbox was being dangerously
flooded with many large infested attackments. I became concerned that
my 10meg limit would be exceeded. I realized that this situation, and
my prior attitude, was short sighted. It really doesn't take much
intelligence or knowledge to whomp these obvious critters. I could
spot them on my server and without av scanning simply delete them from
the server. Why in the hell not allow an ISP to do this and save a lot
of wasted bandwidth, annoyance and possibly lost email?
Sobig and some other recent worms have now undoubtedly changed the
minds of many who still clung to the antiquated POV. I've been quite
satisfied with my current ISP's malware/spam blocking since I signed
up for it a couple of months ago. I have no problem zipping a malware
sample and sending to a av vendor. I've received zipped samples from a
couple of guys I work with as well. So I've not experienced any loss
of freedom. The only downside may be lost email due to over-zealous
spam filtering ... but if so, I'm not aware of it.
I'm really happy to see more and more ISPs getting into malware
blocking. It's the logical place to do it. Simply whacking the obvious
stuff that's currently giving high volume problems is all that's
required. And it really shouldn't cause users to be irresponsible and
complacent about their own security. After all, email is just one
intrusion vector ... there are others to be concerned with. Plus the
fact that your ISP may well not block them all.
Art
http://www.epix.net/~artnpeg