Subject: RE: mail sandbox wall authority, inward and outbound

From: Jim Busse <[email-masked]>
Date: Fri, 12 May 2000 11:26:47 -0700

Since you don't know the environment, I won't bother to respond to
vunerability.

Ok.  How can [email-masked] know if the attached executible file is
safe or not?  I can understand in my own context.  I don't have a hope to
understand in someone else's context.

Jim

-----Original Message-----
From: James P. Salsman [mailto:[email-masked]]
Sent: Friday, May 12, 2000 11:08 AM
To: [email-masked]
Cc: [email-masked]
Subject: RE: mail sandbox wall authority, inward and outbound

> From: Jim Busse <[email-masked]>
> Date: Fri, 12 May 2000 10:11:36 -0700
> 
> I get 240 emails/day.
> 
> about 15% have executable attachments, because that's the way developers
use
> mail, we attach self-expanding zip files.
>
> My organization has about 100 people that fall into this category.

First off, not only would you all save space if you stopped 
exchanging self-extracting (executable) archives, but your 
organization would be far less vulnerable.  Use the ordinary 
zip files instead.
 
> I find it unacceptable that you are asking some console operator to
> 1.  Determine if my zip files are legitimate....

By "console operator", I mean you, the user, or whoever is 
sitting at your keyboard when your mail is being read.

Cheers,
James

---

From: "James P. Salsman" <[email-masked]>
Date: Fri, 12 May 2000 16:57:19 -0700 (PDT)

Jim,

Thanks for your question:

> How can [email-masked] know if the attached executible 
> file is safe or not?

If I knew that, I wouldn't be trying to stop complacency 
about the promiscous exchange of self-extracting archives.

The best attempts to address the issues so far involve 
"certificate-signed executables", a cryptological method of 
verifying that some certificate authority approves of a 
given fixed string of bits.  Do a search on that and/or 
"application signing" to learn more.  A caveat in practice, 
though, so far signed executables do not seem to have 
caught on.  At best, they are complicated to get right and 
involve an increased support cost if done wrong.  At worst,
the certificate authorities, who often have a strangle-hold 
on such technologies, often because of poor regulations, 
are too greedy to have helped these catch on yet.

Cheers,
James