Subject: RE: VIRUS WARNING

From: Lillian Komlossy <[email-masked]>
Date: Thu, 11 May 2000 14:29:05 -0400

Scot,

ITA we do not need the HTML email for our everyday use.
HTML based email is mainly used by the Email-Newsletter companies, (i.e.
Whitehat,
Exactis, etc...) especially for advertising purposes. 
We can argue that we don't need it but in reality, these companies 
live off the daily newsletters they send out. I believe all of these
newsletters 
are being sent out to people who actually subscribed to receive them.
While the reason is mainly commercial it cannot be ignored. As far as the
bandwidth is concerned - most of those HTML emails don't actually email the
images 
but rather display it via a link from their own server. (Which of course
does not help
bandwidth matters especially if first the run it through a logging agent).
I believe the problem starts when somebody writes an HTML email that can
retrieve, 
write or execute anything on the receiving client's system.
I agree with you - it is contradictory. So is every new technology, even the
more
tangible ones. I'll bet once everybody agreed that there is no need for the
automobile, horses will do fine -  but now we want to take our
tractor-trailer 
to work, on an eco-car style gas-burn, and speed as fast as a Ferrari. Go
figure.

Lillian Komlossy                     
Site Manager                         
http://www.dmnews.com           
http://www.imarketingnews.com  
(212) 925-7300 ext. 232 

-----Original Message-----
From: Scot Mc Pherson [mailto:[email-masked]]
Sent: Thursday, May 11, 2000 1:59 PM
To: 'Lillian Komlossy'
Cc: [email-masked]
Subject: RE: VIRUS WARNING 

Lillian,
	I am not so sure I totally agree. Why exactly do we need HTML based
e-mail...Is it really necessary? E-mail is a service for transmitting a
written message, and written messages certainly don't require background
graphics or a full blown graphically based webpage.

	There are a few reasons why I believe this, one of the most
compelling IMHO
is that graphic content in e-mails increases the size of the e-mail
exponentially, thus greatly contributing to the packet congestion already
extremely evident on the Internet today. I realize that we are developing
new technologies all the time that increase bandwidth, but I think its
terribly inefficient, and dangerous.

	There is no practical need for html e-mail. It like saying I want to
use a
tractor trailer to commute to work everyday, but it needs to consume only as
much gas as an eco car, and go as fast a Ferrari.

Scot

-----Original Message-----
From: Lillian Komlossy [mailto:[email-masked]]
Sent: Thursday, May 11, 2000 11:13 AM
To: 'Scot Mc Pherson'
Cc: [email-masked]'
Subject: RE: VIRUS WARNING

Scot,

While what you say is true - meaning an all-text restriction on your email
browser will prevent
"dangerous goods" to be downloaded - it also takes away functionality. We
have to find a way to
be able to use html based email but restrict it from - say running scripts,
executing anything,
writing cookies, issuing queries, etc... Until that happens, you're right -
html based email
is like a runaway train. We have to invent the "brakes" now.

Lillian Komlossy
Site Manager
http://www.dmnews.com
http://www.imarketingnews.com
(212) 925-7300 ext. 232

>>-----Original Message-----
>>From: Scot Mc Pherson [mailto:[email-masked]]
>>Sent: Thursday, May 11, 2000 10:07 AM
>>To: [email-masked]; 'Castro, Edison M. (PCA)'
>>Cc: 'Steven M. Bellovin'; [email-masked]; 'Brant Knudson'; [email-masked]
>>Subject: RE: VIRUS WARNING
>>
>>
>>I believe the one of the most important holes is html based mail, because
>>the e-mail is processed as a webpage which can be used to download
>>undesirable content. If you configure your e-mail browser to display all
>>messages as text you will close this hole...You will notice my e-mails are
>>nearly 100% text
>>
>>Scot

---

From: "Scot Mc Pherson" <[email-masked]>
Date: Thu, 11 May 2000 15:04:48 -0400

Lillian,
	Those newsletters that you have spoken of can quite easily be distributed
in text format with the standard html tags that are used in text based
messages already. Notice my sig has the standard mailto and http tags which
can be recognized by the e-mail browser ("Note this is a text message too"),
that directs the user to the necessary info if they are inclined without
ramming the website down their throat.
	You are correct in stating that html e-mail does not necessarily and
ordinarily does not contain the actual graphical content, but it does "call"
the content in question the moment it is opened. This is transmitting an
entire webpage through e-mail because in fact a webpage is just the html
code which "calls" all the hrefs that exist elsewhere, whether on the local
host or not.
	I certainly agree that html e-mail is also dangerous due to the ability to
link the content local to the e-mail readers host. It creates the ability
for the sender of an e-mail to gather information that may not be considered
sensitive or otherwise plainly undesirable. It also opens the ability to
introduce agents and other infectious material to a host that would
otherwise require a user's physical acceptance of such material.
	The necessity to send e-mail in html is NOT. Regardless of whether a list
or commerce wishes to advertise through e-mail, there are already avenues
for distributing material to demographically selected individuals. Its
called the WWW and creating hypertext links in an e-mail to direct a user to
desired content is certainly MORE than enough, and also solves part of the
congestion problem, because the user must take the time to visit the site in
question as opposed the site making a visit to each and every recipient of
the message, whether they care about this week's issue of the newsletter or
not.

The issue here is not about whether it is technologically sound, but whether
we are able to market the masses with or without their expressed consent. If
a user wishes to visit a commerce's or industry's website they will
certainly follow the link provided in the e-mail. It is a different story to
simply place the web content directly in front of the user, and this begin
to cross the line of harassment and invasion. Its like the difference
between receiving an invitation to an open house, and finding out that the
open house is coming to YOUR house.

	Technology doesn't have to contradictory...it is our (ietf) purpose to
ensure the internet is used efficiently and in the mass's best interests.
This doesn't mean regulation, but it does mean providing proper avenues to
get where ever a person wants to go. I will state again, that it isn't our
business to prevent access, but it is our business to make sure that people
can and do access in the appropriate manner in such a way as to ensure each
and every user is satisfied. I mean it would be really silly if you FINGERed
a site and got a webpage to display the information.

Analogously -html e-mail is a lot like the Microsoft windows is it good for
consumers or bad. HTML e-mail like Microsoft windows has made content
browsing easier and closer to ubiquitousness, but at the cost of user
education. If there is no reason for a user to learn how to use the web or
the rest of the net, then why should they???

-Scot Mc Pherson
-RF Engineer
-ClearAccess Communications
-Ph: 941.744.5757 ext. 210
-Fax: 941.744.0629
-mailto:[email-masked]
-http://www.clearaccess.net

-----Original Message-----
From: Lillian Komlossy [mailto:[email-masked]]
Sent: Thursday, May 11, 2000 2:29 PM
To: 'Scot Mc Pherson'
Cc: [email-masked]'
Subject: RE: VIRUS WARNING

Scot,

Lillian Komlossy
Site Manager
http://www.dmnews.com

-----Original Message-----
From: Scot Mc Pherson [mailto:[email-masked]]
Sent: Thursday, May 11, 2000 1:59 PM
To: 'Lillian Komlossy'
Cc: [email-masked]
Subject: RE: VIRUS WARNING

Lillian,

Scot

-----Original Message-----
From: Lillian Komlossy [mailto:[email-masked]]
Sent: Thursday, May 11, 2000 11:13 AM
To: 'Scot Mc Pherson'
Cc: [email-masked]'
Subject: RE: VIRUS WARNING

Scot,

Lillian Komlossy
Site Manager
http://www.dmnews.com

---

From: [email-masked]
Date: Thu, 11 May 2000 15:31:39 -0400

> the message, whether they care about this week's issue of the newsletter or

Strictly speaking, part 1:  E-mail as a while is not a necessity.  The US
Postal Service has a 200 year record of delivering large amounts of material
in a reasonably cost-effective manner.

Strictly speaking, part 2:  A case could be made that there should *NOT* be
hypertext links in a text/plain segment of an E-mail.  RFC2046, section 4.1.3
says pretty specifically:

4.1.3.  Plain Subtype

   The simplest and most important subtype of "text" is "plain".  This
   indicates plain text that does not contain any formatting commands or
   directives. Plain text is intended to be displayed "as-is", that is,

OK? Got that?  In other words, it's *PLAIN* text.  You want hyperlinks,
use text/html or some other type that is defined to support them....

(Yes, I *know* people violate this all the time.  Doesn't mean we should
encourage it *more* just because we don't like text/html....)

-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

---

From: Jon Crowcroft <[email-masked]>
Date: Thu, 11 May 2000 22:17:39 +0100

if once it was a virus 
which it wasnt
it surely is a worm now

of course, 
microsoft have succeeded beyond david tenenhouses wildest dreams
in active network deployment

:-|
j.

---

From: Jacob Palme <[email-masked]>
Date: Fri, 12 May 2000 19:51:29 +0200

> graphics or a full blown graphically based webpage.

Why should not graphics be of value in e-mail, when it is of
value in most other media like web pages, books, newspapers,
magazines, etc? Why should the e-mail medium not benefit
from graphics to enhance understandability and readability?

The size of the messages is really not an important issue.
Nets and disk space is not very expensive.

What is important, however, is writing time versus reading
time. Including graphics and neat formatting will increase
the writing time, but will, by making the message easier
to understand, reduce the writing time. This means that
neatly formatted messages give a cost/benefit gain, if
the number of recipients of a message is over a certain
limit. Thus, neatly formatted messages are more worth the
cost if you are mailing to a large mailing list than to
a single recipient.

In some cases, of course, neat formatting is so important
that it is worth the cost even with very few recipient.
For example, when I send error reports on computer software
to the developers of the software, I often include screen
shots showing how ther software does not work properly.
In such a case, the graphic is a very good way of persuading
the developer that something really is wrong with his
software.

At 15.04 -0400 0-05-11, Scot Mc Pherson wrote:
> in text format with the standard html tags that are used
> in text based messages already.

Is the issue you are discussing whether to include the
graphics as body parts of the e-mail sent, or just include
<IMG> links, so that the recipient can retrieve them
through HTTP when reading. This is again a cost/efficiency
issue, you will have to compute the cost of sending and
storing all these images, versus the cost and time delay of
getting them from the source when reading them. In some
cases, the original image may not be retrievable through
HTTP for the people you are sending the mail to. For
example, you may want to send, in e-mail, an image from
an Intranet not available outside your company. In that
case, you have to include the image with the mail.

At 15.04 -0400 0-05-11, Scot Mc Pherson wrote:
> Regardless of whether a list
> for distributing material to demographically selected individuals. 

World Wide Web is *not* a good medium for distributing
news, since it does not have very good "news control", i.e.
facilities for a user to get lists of what is new and
selecting from these. E-mail, Usenet News and forum
software are much better for news distribution.

At 15.04 -0400 0-05-11, Scot Mc Pherson wrote:
> we are able to market the masses with or without their expressed consent.

This is, I believe, the crucial point. HTML in e-mail
has got a bad reputation, not because the idea of
graphics in e-mail is wrong, but because it is
used, tooo much, by people sending us things
we would prefer not to get.
-- 
Jacob Palme <[email-masked]> (Stockholm University and KTH)
for more info see URL: http://www.dsv.su.se/jpalme/

---

From: Salvador Vidal <[email-masked]>
Date: Mon, 22 May 2000 18:53:23 +0200

Hello Jacob,

>from graphics to enhance understandability and readability?

Much more, I like the posiblity to add inteligence on e-mail address and
HTML not only in the body, I like it i.e. in the "acuse de recibo" (sorry I
dont know the name of this in English it´s when you sing that you get a
message), for instance in this mesage I can  put bottons when people in
this list can click, one saying you are idiot, another go ahead i like it,
other I don´t understand you,... so I can get feedback for the people in
this list that don´t reply but maybe like to click in a buttom.

Of course not only text buttoms, you know painters when something is bad
say that its purple, something neutro they call it green, something cool is
yellow, so may be a painters list group want a "acuse de recibo" of one
colour and when you put a message you get a mix of the colours in a picture
as feedback, or musicians do something similar with music, or yoguis that
can control they heart pulsations transmit their pulsations for
coordination of their hearts in a yoga experience,... who knows the best
way to get the feedback goal of simbiosis whith others?, we cann´t put
limits to cultural manifestations but those which come from security and
privacy issues as well as give efective filtering posibilities for users.

Best Regards,
Salva