False Alarms and Virus Paranoia

It is probably fair to view the existence of antivirus industry
as a direct  proof of high long term costs
associated with any MS-based solution.
 

This article is a general overview of the social phenomenon that is related to users seeing the virus/malware threats where it does not exits. Less charitable name for this phenomenon is virus paranoia (or more generally malware paranoia).

Part of the cost of malware is irrational fear, fear of unknown, that demonstrate self in various urban myths and the real human propensity to see viruses or malware where there is none.

My second argument is that AV defense should not always mean "on-the fly" scanning. Often other approaches such as Softpanorama Malware Defense Strategy are more effective. Especially in fighting virus paranoia. Anti-virus scanners are by definition always one step behind. That means that the main virus fighting strategy should be creation and maintaining baseline configuration to which you can downgrade any infected PC without trying to understand what is particular virus about and what AV products reliably can disinfect PC from it. Simple Microsoft SFU3.5 + SSH combination, Ghost-based image of C-partition and integrity checker are much more productive approach that rat race of getting the latest signatures or trying to find a product that detects and disinfects particular virus.

A very good, but rarely used approach, is to use  Microsoft Shared Computer Toolkit for Windows XP and keep user files on a separate partition or separate USB drive.

False positives created by bugs in AV signature database

Virus paranoia is sustained by virus hype. As many AV practitioners know too well and a lot of users at least suspect, the virus paranoia and preaching of Virus Armageddon is a marketing trick used and abused by all anti-virus vendors. But the real problem with overselling AV solutions by firms such as McAfee and Symantec is that often cure is worse than the disease. Anti-virus products in their current incarnation actually represent a additional threat to PC stability and substantially contribute to crashes and total cost of ownership of Microsoft platform. For example the cost of false positives is largely ignored in the computer press, but they constitute a vital part of the cost of implementing of any virus protection solution and they are noticeable part of the total cost of ownership of any workstation with AV protection installed.

Periodically AV program are undated with buggy signature database which marks as dangerous legitimate component of OS and make hundreds, something thousands PC unusable for some period which can be several hours to several days. Recent, April 2010, McAfee fiasco is pretty telling in this respect (Scammers embrace McAfee fiasco to pitch fake AV - Computerworld):

Scammers have quickly piggybacked onto news of a buggy McAfee antivirus update that clobbered thousands of computers, security researchers said today.

Early Wednesday, McAfee released a flawed signature update that wrongly tagged a crucial system file in Windows XP Service Pack 3 (SP3) as malware. After the software quarantined the "svchost.exe" file, thousands of PCs, most of them in businesses, crashed and rebooted repeatedly.

Firms are still dealing with the aftermath, with some companies forced to manually reconfigure hundreds or even thousands of systems.

The debacle made news not just in the technical press, but in more mainstream outlets, including the New York Times and USA Today.

And news is scammers' bread and butter. Using their now-traditional technique of poisoning results at major search engines like Google and Bing, "scareware" makers have pushed links touting fake antivirus software to at or near the top of the results lists, said Graham Closely, senior technology consultant with Sophos.

The links appear when users type search terms such as "McAfee update" and "McAfee 5958," the latter a reference to the faulty update's designation, added Panda Security in a post to its company blog today.

"If you click on a dangerous link like this, then you risk the chance of your computer being hit by a fake anti-virus attack, which may attempt to con you out of your credit card details or trick you into install[ing] malicious code onto your computer," said Cluley in a post to his blog.

The erroneous McAfee antivirus update sent to corporate customers running Windows XP Service Pack 3 last week wreaked havoc on a lot of businesses, temporarily shutting down a supermarket chain in Australia, delaying surgeries in Rhode Island hospitals and sending IT departments across the globe scrambling to repair PCs. PC Magazine has more detailed information on what happened, from which it is clear that Microsoft does not adhere to standard update protocol in updating Windows components and as such also should share a blame (Lessons of the McAfee False Positive Fiasco News & Opinion PCMag.com):

I feel really sorry for the McAfee users who got burned by a really bad false positive detection the company put out on Wednesday. Many McAfee VirusScan Enterprise customers using Windows XP SP3 had their svchost.exe (a key Windows system binary which hosts Windows services in its process space) flagged as malicious. I was tempted to feel sorry for McAfee too; we all make mistakes and things must be bad there right about now. But it's hard to feel sorry for them, given what's turned up.

The most shocking revelation was uncovered by Ed Bott at ZDNet: McAfee has admitted to its customers that it followed shoddy quality assurance procedures in this matter. Specifically, the release was not tested on Windows XP SP3, the configuration on which it borked the system. It's hard to think of a worse single configuration to leave out. Late last night McAfee confirmed the report.

This sort of thing has happened in the past, and the danger of it increases all the time. The nature of malware has forced AV vendors to push out ever more frequent definition updates, to the point where Symantec's "pulse updates" come out every five to 15 minutes. The pressure to keep up with malware—not to mention the pressure to keep costs down—can lead vendors to scrimp on testing. This appears to be what McAfee did.

You might well ask what McAfee is doing scanning Windows system binaries anyway. I know I did. It turns out that they do whitelist these files as a general matter, but in this case things got complicated. Like most security products, McAfee's scan memory for signs of infection. The malware (W32/Wecorl), the definition for which generated the false positive, is one which attempts to attack svchost.exe by inserting itself into the file and modifying the program to run it. It's a classic file virus. McAfee scanned the file because the false positive occurred in a memory scan of the svchost.exe process; this caused it to flag the file.

Exactly what happened is better explained by McAfee in a FAQ it posted last night. Three specific versions of svchost.exe under XP SP3 were affected, and McAfee provides the MD5 hashes. It seems Microsoft changes this file in updates without changing either the size or file version.

If you still need to remediate systems, McAfee has provided a FAQ for that too. McAfee also says it is adding new QA protocols to ensure this don't happen again.

For McAfee this is not the first time they screw customers PCs. See The Great McAfee Fiasco of 2009 - Resaleworld Message Board

Virus and malware as scapegoats in corporate environment

Moreover viruses can serve as a scapegoat -- the phrase "It must be a virus" is a standard in the arsenal of many corporate IS professionals when they do not understand what to do (and many of them really don't know what to do quite often -- MS platform is much more complex then most IS managers would like to assume ;-). 

The term "virus infection" is often used as a synonym for the "unknown PC or network problems that are difficult to troubleshoot", or as a synonym for "A generic Microsoft-software related problem" ? Like ancient people attribute evil to bad gods, IS folks are blaming "a very bad virus" to explain crashes of Microsoft Windows and sometimes to conceal their own blunders.

This paranoid attitude, the seemingly permanent threat of a devastating virus attack is heated by the constant flow of ads and vendor sponsored papers in the computer trade press. It even  created a special E-mail gender -- virus hoaxes -- oriented to users and sysadmins "who should know better".

The level of hype from AV vendors is really amazing taking into account that for almost every major epidemics it was AV tools that failed miserably being unable to cope with the new, often unanticipated,  threat, It is new direction, new angle of  attack that makes virus dangerous and can cause the epidemics, like was the case with MS Blaster and other major network worms in 2001-2005. Copycat virus simply do not stand a chance to create large disruption; you need to find some new widespread vulnerability in order to create a global epidemics.

The way AV software publishers use hype as the most powerful marketing weapons represents one of the most successful misinformation campaigns in the history of the marketing industry and probably should be studied in any book of high-tech marketing.

Symantec, McAfee, and the infamous National (now International ;-) Security Association (private company that started as a lobbyist organization for AV vendors and then successfully moved to firewalls; it was eventually bought by Gardner Group) are really great "doom and gloom" propagandists -- propagandists that Pravda (the leading communist newspaper in the USSR) journalists with their constant theme of "imperialist threat to communist world" can only envy (I know they employ programmers from former USSR region, but I doubt that former Pravda journalists are employed in marketing -- probably local gurus are as good or even better in this particular field ;-).

In marketing materials that one can find on the anti-virus vendors web sites the costs of virus attacks are listed in billion dollars. Cleanup costs on a per-site basis from a single virus attack are estimated at hundred thousand. That makes viruses very close to year 2000 Armageddon paranoia. See Fighting Virus Hype for more examples.

Microsoft -- the enemy within

Another interesting question to answer is to what extent the virus threat is the result of Microsoft architectural flaws - flaws dictated by its revenue oriented  culture. There are several of them that are present in MS DOS and Windows 9x series:

• A incorrect implementation of read-only attribute (as well as other attributes) for files starting with MS Dos.

• A buggy implementation of the program loader (no even simple check for CRC correctness was implemented, although the field did existed in the EXE files header).

• Virus-friendly implementation of IPL in BIOS;

• No compression for executables to make tampering more difficult and time consuming (despite the fact that lzexe, diet and PKlite are around for more than a decade ;-)

• A systematic ignorance of security issues in OLE implementation (MS Office documents are pretty good example).

• hiding of the extension of the files (configurable setting in File Explorer) in versions of Windows starting with Windows 95

This list is outdated and not definitely not-complete as we need to add failure with the firewall implementation despite using many poorly documented and poorly understood network protocols.

I sincerely believe that 80% of virus/worms problems are due to serious architectural flaws in the Microsoft OS architecture (or let's call them more politely "technical compromises" adopted for the sake of backward compatibility and preserving the market share). My point is that from this point of view any Unix is superior to Microsoft OSes. Of course UNIXes have their own security problems (and unlike Open BSD bloated Red Hat 8,9 or 10 is a big security problem in itself, just due to the amount of installed packages; the slogan of Red Hat seems to be "no week without critical patch" which can be considered to be an interesting way to justify the color of hat ;-).

Unix probably should be used as a server, especially, when security is really important or when money are the problem or both.  For desktops the additional cost of AV defense should be calculated into the total cost of ownership of Microsoft platform. For a large organization with, say, ten thousand PC users the cost of AV defense is usually well over 300K a year  of $30 per year per user (at least one person + some probably equal investment in AV software, its maintenance and updates). That's not much ($30 per year per user is approximately the same that company spend on coffee).

Generally speaking the AV situation on Microsoft platform is often close to absurd.  Double extension hiding is the most recent example of  "road to hell is paved with good intentions" situation with security. I would like to know the name of Microsoft executive who in his/her  blissful ignorance approved this stupid trick and single-handedly created the whole new family of mail worms.

Moreover the real danger of viruses/worms on Microsoft platforms created the whole range of unproductive and even stupid behaviors. For example many organizations religiously update signatures of  F-prot, McAfee , Symantec or other scanner, despite using the version of AV software that is more than a year old. They just do not understand  that a typical AV scanner without each year updates is pretty much useless and new threats are not covered by an older versions no matter what signatures are used. 

In many cases the money spent on AV defense should better be spend on improving patching level of installing new versions of  Microsoft software or OSes. For example most users do not understand that Office 2000 is to a large extent is immune to old macro viruses and new macro viruses do not stand a chance due to increased awareness and existence (although far from being perfect, but still useful) heuristic scanners.

I would not like to go so far that to claim that all virus scanners are essentially useless. That's not true even if we (incorrectly) assume that even the best of them systematically let new viruses go undetected in each major epidemics, until it's too late.

What I would like to stress is that AV scanners are not the only solution. They should be supplemented with other tools. Right now it should integrity checkers and System Management Tools.

Moreover AV scanners in the "on the fly mode" often produce too much helpdesk tickets and often create more problems than they solve due to bugs and tricky interactions with other software.

If you add this to the fact that in large enterprise environment scanners are often so out of date that they are practically useless, one can agree that they belongs to the category of tools that introduce more problems than they solve.

You need to be more flexible and try to combine them with other approaches, that might be more effective and generic that signature based scanning.

For example, for home users using Netscape Messenger instead of Outlook is often the most efficient way to fight the latest Outlook based worms. Netscape Messenger is a pretty adequate mail client that is not much worse than Outlook functionality (and it provide simple text based database of messages that is much easier to recover then proprietary Outlook format).

The other question arise: where exactly do you need to deploy anti-virus solutions? On the client, on the server, or on the proxy?

The anti-virus industry marketing slogan is "no price is too high for anti-virus security" and they would like to sell you all three solutions. But what if the last two of them are completely unnecessary? Why pay to snake oil salesmen who speculate on the fear and very primitive level of understanding of computer viruses by IS professionals? As most viruses are entering the computer via mail stream it is often better to implement a simple proxy that blocks all attachments with executable extensions then to deploy the wonder of software engineering like Symantec (which periodically screw Norton Antivirus and Norton Utilities to the extent that is really dangerous to have them on  the desktop) or, God forbid,  F-secure desktop antivirus.

Blocking executable extensions in attachment is very simple and efficient proxy-based measure that should be considered before everything else. It considerably diminishes (but not completely eliminates, see miMail worm) the danger of  mail worms/viruses for the desktop.  If somebody propose you to installs AV software before implementing this measure he/she is either simply ignorant or somewhat connected to AV vendors or both ;-)  There is no productive use of attachment with executable extensions in the current Internet-connected environment. Even most ignorant users are now able to unpack archives.

As for the desktop, scheduled for lunch runs of  some simple virus scanner (or integrity checker) might still be an alternative to on the fly scanning on the desktop (current worms usually do not hide itself and even Unix find command can serve as a virus scanner for most of them). 

The same is even more true for the server. It's very dangerous to install AV software on the server and if it is used in the on the fly scanning mode then performance goes down the tubes.

While in some cases there might be a reason (or let's say tradition) to install a resident ("on the fly") scanner of the desktop, on the server it is definitely just waist of money and an invitation to problems.

Some people goes as far as to install them on Netware servers, thinking that scanning of all files will prevent infected files getting to desktops. Usually if NetWare file server spread the viruses than it is definitely misconfigured. In old days the most common example is that login.exe is writable to the user and became infected, see also Best samples of virus hype). Now the main reason is that sharing of files is usually too lax.

For client-based scanner the situation is such that the number of ticket that scanners produce in the environment with say o at least 10K desktops probably far outweigh the damage from the viruses. 

Let's discuss MS VBA-based macro viruses -- which were the most relevant in the corporate in 1996-2000. For simplicity let's assume that we work in MS Word environment (VBA is available for Excel and other programs as well, so threat is more generic). For MS Word what you really need is to know is if document is in native MS Word format and if yes what macros are present. Then you need integrity checker for these macros. That's it. And it should be free option programmed by this sackers from M$ at no cost. But what this suckers present to unsuspecting users. a crappy warning screen that looks like a marking for AV industry and contain almost no useful information. A palliative (but nevertheless helpful) solution is to use RTF instead on native MS Word format whenever possible (see AV_Secrets/doc2rtf). It has its own problems but at least to check if the document is in RTF format can be performed very easy and blazingly fast.

IMHO big corporation and government are often really ripped off by AV vendors -- I just forgot how much US Department of Defense paid McAfee for its AV solution in 2000 or so (15 millions bucks ???). Here again power breeds contempt and until recently Microsoft did not respect users enough to bother about this "minor" problem.

A decade ago boot viruses were a problem. Mostly it were primitive viruses like Form. Again here the best defense was not to install a commercial AV program, but to modify BIOS to check integrity of a boot sector and/or block loading from the floppies that are not write-protected (easy to implement for flash BIOSes). The last simple measure can save from 90% of boot virus attacks. IMHO millions of dollars spend on AV-protection from boot viruses were mostly wasted and should be considered as an additional component of the cost of ownership of Microsoft platform.

I would like to stress it again and again that in the absence of AV API on the fly virus protection usually negatively affect not only performance, but the stability of the system as well.

Although file viruses are now almost extinct, in the past they were the most sophisticated malware. But even for old polymorphic file viruses situation with scanners is not that simple and integrity checkers were often a better solution. 

While scanners are useful for finding old file viruses (probably the only type of viruses for which scanners are really useful) and finding Trojan programs (Back Orifice, etc.), even with network updates the substantial portion of PCs still have outdated signatures and outdated engines (BTW the AV products that can update scanning engine (Trend Micro) are superior to those that cannot).

The cost of  distribution of AV signatures in a large organization adds probably half to the total AV protection costs. And short cycles of deployment and emergency upgrades, of course, cost money and sometimes a lot of money.

The popularity of "on the fly" scanners for personal users can IMHO partially be explained by existence of "warm human being not particularly familiar with computer" and millions of dollars that I paid for them should be counted as a part of the cost of MS OSes. IMHO it adds to the cost of Windows ($200 in many countries, with upgrade like $80 ) at least another hundred bucks -- making it closer to $300 and often making OS 10% to 20% slower.

Moreover scanners are overused -- now they usually scan a large percentage of executable -- and many non-executables (just in case scanning of .rtf files, etc).  For example, in most corporation they are configured to scan files with extension RTF, as Microsoft Word detect the type of the file irrigating of the extension and a file with the extension .rtf can contain regular MS Word document with virus macros ;-). This is another Microsoft "virus-friendly" solution that keeps AV industry afloat :-).  It might be better periodically scan the files and detect and rename all files that have extensions that does not correspond to their type.

But Microsoft position on this matters was clear and simple -- why bother? With no choices in selection of OS due to bundling it with PCs the user will pay money anyway, and it's not a bad idea to create a new multimillion industry from own bugs :-). To certain extent it proves historical importance of Microsoft.  At the same time Microsoft already have perfectly suitable technique to ease this problem at least for its own software (which is dominant in a corporate environment, anyway) -- signing of executables like Active-X controls would be an excellent solution to the problem. But so far Microsoft prefers to be a passive observer.

And final observation. Any AV system does not operate in vacuum. As in every other software engineering task the quality of personnel is of paramount importance. If personnel is "under qualified" or engaged in "IS turf wars" than no matter how expensive protection is it will not help much. The same applies to computer security consultants. There is no substitute for expertise in computer security. Often that is not the case with security consultants (see misinformed) and the chances that organization will fall victim to such "professionals" in the absence of strong  local  IS personnel is quite high.

Some Open Source Alternatives

With the software distribution in place it is often better to use simpler and more flexible program that distributed by commercial vendors. Using scripting language to implement scanner that detects and delete a particular network worm is a matter of minutes (all you need is the exact understanding of locations and names of the files and registry keys that the work uses).

Flexibility of open source permit almost instant reaction to new threats. 

The first level of protection is email server. For Sendmail that is probably the most popular MTA there are several variants:

• Almost any scripting language spam filter can be adapted for executable attachment blocking.

• There are several specialized milters like milter-virus  capable for blocking executable attachments.

• MIMEDefang,  Renattach or simple Perl script can be used for renaming executable attachments.

Qmail has its own Qmail virus scanner. 

It is also possible to implement a SMTP proxy in front of SMTP server. See for example MessageWall. It offers filtering via header and body checks, DNS-based blacklists for IP addresses (DNSBL) and domains (RHSBL), DNS-based distributed checksumming (DNS DCC) similar to Vipul's Razor, and Open AntiVirus pattern scanning. Unlike many existing ISP-level filtering solutions, it offers customization of filtering features on a per-address basis. Unlike SpamAssassin, it communicates via SMTP, so it works with any MTA. It also supports scoring based on rules with a rejection threshold; this allows hybrid warning/rejection configurations based on how many and which rules a message matches. 

For home computers POP3 Virus Scanner Proxy  makes sense instead of "on the fly" scanning. Brave people who know Perl well can also try to use Perl-based SMTP daemon like perl-esmtpd

For ftp downloads Viralator can protect your network from viruses by enhancing squid proxy server with a virus scanner. Before a user can download a file, the proxy passes the file to the Viralator script which, in turn, uses a virus scanner to scan, disinfect, or delete the download.

For individual viruses I would recommend to use Perl File::Scan  module that allows users to make virus scanners which can detect  typical worms and viruses. It include a virus scanner and signatures database.

Why Code Signing is Important AV Measure

With all its flaws Microsoft platform is the most popular platform in existence (flaws are logical continuation of strong points ;-). that means that it is reasonable to find a solution that is less radical that the outright switch to the other platform. My proposal is to use Java  and ActiveX code sighing solutions. It looks very promising indeed. Code sighing was introduced as a response to a challenge of electronically distributed programs, but it is equally important for virus/worm protection. There are several viable implementations:

• Microsoft Authenticode -- a system developed by Microsoft that permit sighing all kind of executable code. Authenticode was publicly announced in June 1996 as part of Microsoft's IE 3.0 rollout -- a rollout that included ActiveX components. Authenticode describes a series of file formats for sighing Microsoft 32-bit EXE, DLL, and OCX files. The signed file contains x509 v.3 digital certificates a public key need to verify the Authenticode signature.
  
  Authenticode cannot sigh com files and 16-bits EXE files but is in view of current situation that value of old format diminished it the extent that this is not a minor problem. The archive format is a cab (cabinet) file formed by cabarc tool. The signing procedure uses the freely available sign code tool. http://www.microsoft.com/workshop/prog/security and http://www.microsoft.com/java/security/secfaq.htm
   

• JAR format -- An archive format jointly developed by Sun and (former) Netscape -- essentially ZIP file with digital signatures.
   

• WWW Consortium Digital Signature initiative.  The W3C Working Group ("DSig") developed a standard format for making digitally-signed, machine-readable assertions about a particular information resource. More generally, it is the goal of the DSig project to provide a mechanism to make the statement: signer believes statement about information resource.

  • W3C Sample Code Library for DSig and PICS - PICS/DSig Standard Library
  • DSig Background Resources
  • W3C Security
  • Live DSig sample implementation by Riccardo Sabbatini
    • Sign - http://www.csr.unibo.it/ra/sr.htm
    • Verify - http://www.csr.unibo.it/ra/v.htm

Unlike the encryption technologies there is no export control for signed executables.  

Webliography

• Softpanorama Anti-malware Page

• McAfee fiasco

  • Scammers embrace McAfee fiasco to pitch fake AV - Computerworld
  • Lessons of the McAfee False Positive Fiasco News & Opinion PCMag.com
  • McAfee To Pay For PC Repairs After Patch Fiasco - Slashdot

• Microsoft Authenticode

• Christy Walker DOD taps McAfee for anti-virus software (PC Week, July 16, 1997 )

• Nikolai Bezroukov. An Overview of The Seventh International Virus Bulletin Conference (VB’97).  v.2.01; Oct. 21, 1997

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March, 12, 2019 y>