Love-Bug Virus Replays Melissa Hysteria
© Conrad Weisert, Information Disciplines, Inc., 7 May, 2000

Déjàⁿ vu

Last year the Melissa virus was the big news story. This weekend it's the so-called "love bug" computer virus spread worldwide by E-mail. Once again news media are both overstating the impact and misinterpreting the phenomenon.

Where's the villain?

Worldwide efforts this weekend are focused on identifying the dastardly perpetrator. Hope is expressed that he¹ will be severely punished for disrupting business and government activity.

Two theories about his location are being advanced. Both of them are misleading: The main villain is neither in the Philippines nor in Australia. The main villain is in Redmond, Washington.

System software flaw invites viruses in

Like Melissa the love-bug takes advantage of one of the stupidest design innovations in the 40-year history of operating systems. In many graphical user interface systems an icon represents either:

1. An executable program
2. A data file

• If that item is an executable program, you invoke it and turn control over to it.
• If the item is a data file you invoke some other program, according to a predefined association between file types and programs.

But if the list is being displayed under control of a program, e.g. a word processor, then when you click on an item:

• If that item is a data file understood by the program you open that file for processing.
• If the item is an executable program or data file of some other type, then the program in control complains that the file format is unrecognized or illegal.

At least that's what's supposed to happen. A few programs emulate the operating-system context, so that you can actually invoke a program when you think you're just opening a file! Microsoft Outlook is such a program. In fact, the term "open" has now been extended to mean "launch" or "execute". Hence the popular warning "Don't open E-mail attachments."

Those who defend that mess claim that it makes things easy for the user, who no longer needs to understand the difference between a program and a data file. I doubt that any user ever actually drew benefit from being able to treat programs and data the same way, but in any case the debate should now be moot in the face of the catastrophic damage this scheme keeps inflicting on its users.

Users must take responsibility

Given the vulnerability of our operating systems and E-mail programs, users must take control. Don't open, launch, execute, select, or click on an unsolicited E-mail attachment. And let's tell our operating system vendor that we don't need or want this kind of "making it easy" innovation.

¹ -- It is always assumed that virus perpetrators are male. So far, the ones that have been identified have been.

Return to IDI home page.