Subject: Re: VIRUS WARNING

From: Vernon Schryver <[email-masked]>
Date: Fri, 12 May 2000 10:44:29 -0600 (MDT)

> From: chris d koeberle <[email-masked]>

> ...
> Indeed, I don't think any of the people who are complaining about the
> "HTML in e-mail" issues would complain about someone sending an e-mail
> with an HTML file as an attachment.  At least, not as I understand their
> arguments against it.

Just as with sending any active MIME attachment including binary UNIX
programs, it depends on the attached HTML file and who sent it.

As as been pointed out repeatedly and as demonstrated with a concrete
example Saturday morning, attached HTML can be a significant security
problem.  I doubt that (probably porn) HTML spam was much of a security
threat, but if you think about it for a little, you can surely see how
such things can be real security problems.

The practice of sending both HTML and cleartext of supposedly the same
message reflects very poorly on those who do it intentionally and on those
who cause MUA's to trick others into doing it unintentionally.  Never mind
the security issues, but consider only the wastes of disk space, CPU
processing, network bandwidth, and the inevitable differences between the
two versions.  If the two messages were the same, then there would be no
excuse for sending both.  If they differ, then one must be wrong, and
sending both is worse than a waste.

Vernon Schryver    [email-masked]

---

From: Jeremy <[email-masked]>
Date: Fri, 12 May 2000 13:38:43 -0400 (EDT)

Can you plase pleaes stop this Virus Thread.

-jeremy

---

From: chris d koeberle <[email-masked]>
Date: Fri, 12 May 2000 13:54:59 -0400 (EDT)

> such things can be real security problems.

I think there's some confusion in terminology, here, possibly on my part.
Some mail clients permit the sending of an HTML _message_, where other
clients will automatically parse the HTML in the message as HTML instead
of plain text.  I am trying desperately to distinguish between this
practice and the ability to attach HTML as a binary file.

Binary attached HTML presents a subset of the risks of all binary
attachments - you may, if you choose to open the attachment, be
disappointed in the results.

HTML as e-mail presents further risks for clients which are willing to
interpret the HTML (Outlook and Outlook Express both do this in their
default configuration.)

-=I would imagine that if 1000 Rwandan's were hacked to death AT THE EXPO,
people would sure have raised a stink.=-

---

From: [email-masked]
Date: Fri, 12 May 2000 14:05:07 -0400

> Can you plase pleaes stop this Virus Thread.

Actually, there *ARE* important issues here.

Would the IESG support the creation of a WG to discuss these, with the
charter of producing a BCP documenting what *should* be done to minimize
these risks in today's internet? 
-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

---

From: [email-masked]
Date: Sat, 13 May 2000 19:31:26 -0800 (PST)

> these risks in today's internet?

Talking about a WG seems premature. The first step would be to start a
discussion list and maybe schedule a BOF. If those steps prove fruitful
a WG would be a possibility.

I can set up a mailing list if you like.

				Ned

---

From: Henry Clark <[email-masked]>
Date: Sun, 14 May 2000 16:34:45 -0400

>Can you plase pleaes stop this Virus Thread.

This thread _is_ the virus...

---

From: John Stracke <[email-masked]>
Date: Mon, 15 May 2000 18:22:00 -0400

> sending both is worse than a waste.

So why does multipart/alternative exist?

--
/==============================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own.|
|Chief Scientist |=============================================|
|eCal Corp.      |"I lost an 7-foot boa constrictor once in our|
[email-masked]|house." --Gary Larson on his youth           |
\==============================================================/

---

From: John C Klensin <[email-masked]>
Date: Mon, 15 May 2000 20:11:45 -0400

--On Monday, 15 May, 2000 18:22 -0400 John Stracke
<[email-masked]> wrote:

> Vernon Schryver wrote:
> 
>> The practice of sending both HTML and cleartext of supposedly
>> the same message reflects very poorly on those who do it
>> intentionally and on those who cause MUA's to trick others
>> into doing it unintentionally.  Never mind the security
>>... 

(i) For those few situations in which there is information
content in a "rich" fancy display form that cannot be rendered
in a weaker form that where it is important to get some idea of
the content through.  This is clearly a judgement call on the
part of the sender, but the usual mindless attachment of an HTML
part to a plain-text message (to which I assume that Vernon is
most strongly objecting) doesn't add any more information, just
a bit of formatting that the receiving MUA could probably figure
out from a text message if the developer and user were
adequately motivated.

(ii) For situations in which the meaning of multiple rendering
is presumably the same but the string-content is very different.
E.g., one could in theory send a message out in several
different languages, tagging each, and permitting the receiving
MUA to select the message that best matches the
knowledge/usage/skills of the reader.

Of course, the security issues in the latter case are the same
as those that exist anytime you are handed text in a language
you don't understand and some other text that proports to be an
accurate translation of it.

   john

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Mon, 15 May 2000 21:12:12 -0400

Date: Mon, 15 May 2000 20:11:45 -0400
   From: John C Klensin <[email-masked]>

   the content through.  

It seems to be usually the case, for most messages that I've seen, that
there's *no* added value to the HTML version.  I.e., other than adding
<BR> at the end of lines, and using microsoft-specific font settings at
the beginning of each paragraph (usually all the same), there's nothing
to be gained by using HTML except for bloating the message.  

So one question to ask is "why send HTML at all" in those cases?  It
would be nice if MUA's could detect this case, and only send plain-text,
and reserve HTML only for when it's actually adding something of value.

   This is clearly a judgement call on the part of the sender, but the
   usual mindless attachment of an HTML part to a plain-text message (to
   which I assume that Vernon is most strongly objecting) doesn't add
   any more information, just a bit of formatting that the receiving MUA
   could probably figure out from a text message if the developer and
   user were adequately motivated.

I wonder how many people are still using plain-text, non-HTML enabled
mail readers?  It still happens on some mailing list, where someone will
send a base-64 encoded html'ified message (usually using MS Outlook),
and someone will send back "try again in English; I don't read that MIME
crap."

For a long time, if you wanted to guarantee that messages issued by your
MUA would be read, it was wise to send it both in plain-text and HTML
form, with the plain-text form first --- and non-base-64 encoded if at
all possible.  For certain recipients, this is still the case.

							- Ted

---

From: [email-masked]
Date: Tue, 16 May 2000 00:24:23 -0400

> So why does multipart/alternative exist?

Well, when we were designing the MIME spec, we went to great lengths
to cover all the bases - in fact, I've seen one very good use of
multipart/alternative by somebody with crippling RSI.  

He got into the habit of sending commentary to a mailing list as
multipart/alternative - one part being a *very* brief summary of
his commentary (usually a sentence or two tops), and the other being
a message/external-body pointing at a (usually longer) audio file
that he'd record in greater detail - this was in the days before
good speech-to-text software.

Yes, it probably violated the letter of the law just a bit, but
it was certainly in the spirit of it..

Also, remember that we designed it in 1991 or so - the infamous
Green Card Lottery was still 3 years away, AOL wasn't the majority
owner of several northern Virginia counties, and the concept of
a point-and-drool interface for the masses didn't exist yet.

We designed it for the Internet we were hoping for, not for the
one that we actually got....

				Valdis Kletnieks

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 16 May 2000 07:45:42 +0100

>and reserve HTML only for when it's actually adding something of value.

Its not uncommon for sales folks to use bold or colour in fonts to
highlight some item they want the reader to pay attention to.  Its a
matter of opinion whether this is good value.

I will note that I routinely discard all HTML-only or RichText-only email
without bothering to try to read it.  So folks who want me to read something
had better be sending at least US-ASCII plain-text.  Its well known that
I'm an old fogey, so this likely surprises no one.

>and someone will send back "try again in English; I don't read that MIME

I do not normally have an HTML-enabled mail reader at hand at work.  For 
that matter,
its not unheard of for me to read mail over a real TTY (or telnet or
ssh).  My mail readers _do_ comply with MIME, but attachments get
saved to the file system where I can read them by opening a separate
application viewer.  Over a TTY, it is intrinsically hard to display fancy 
text.
For HTML or RichText, I just don't bother with the second application, ever.

>all possible.  For certain recipients, this is still the case.

I'm one of those recipients, so I'd much rather have both plain-text and
fancy, with plain-text first.

Ran
[email-masked]

---

From: Pete Resnick <[email-masked]>
Date: Tue, 16 May 2000 08:29:36 -0700

>and reserve HTML only for when it's actually adding something of value.

Some MUA's do just that.

pr
-- 
Pete Resnick <mailto:[email-masked]>
Eudora Engineering - QUALCOMM Incorporated

---

From: Bruce Campbell <[email-masked]>
Date: Fri, 19 May 2000 13:51:35 +1000 (EST)

On Mon, 15 May 2000, Theodore Y. Ts'o wrote:

tytso> I wonder how many people are still using plain-text,
tytso> non-HTML enabled mail readers?  It still happens on some
tytso> mailing list, where someone will send a base-64 encoded
tytso> html'ified message (usually using MS Outlook), and someone
tytso> will send back "try again in English; I don't read that MIME
tytso> crap."

Just a quick survey on the last 513 messages seen in the IETF list, based
on X-Mailer header:

	1 Allaire
	1 CrossPoint
	1 dtmail
	1 Eudora
	1 KMail
	1 Lotus
	1 Netscape (Messenger Express)
	1 Posta (Posta elettronica Internet di Microsoft/MAPI - 8.0.0.4211)
	2 Mew
	2 Mulberry/2.0.0
	5 Mutt
	5 VM
	5 Windows (Eudora Pro)
	25 ELM
	29 exmh
	28 Pine		(based on Message-ID strings)
	34 QUALCOMM  (later versions of Eudora)
	37 Internet (Internet Mail Service, another Microsoftism)
	52 Microsoft (Outlook)
	54 Mozilla

Most of these do natively understand HTML email to a certain extent, or
can be configured to pass HTML email to an outside viewer, and a small
number send HTML email by default (based on personal experience).  I don't
know of any in the above list that cannot be convinced to send plain text.

Please remember that the capabilities of a given client are different from
the (possibly bad in some cases) defaults set by the distributers/authors
of a given client.  Perhaps the focus should be on the defaults, rather
than blindly saying ``Mailer X is bad.''

--==--
Bruce.

Sysadmin, APNIC

---

From: Tim Salo <[email-masked]>
Date: Thu, 18 May 2000 23:54:01 -0500 (CDT)

> Date: Fri, 19 May 2000 13:51:35 +1000 (EST)
> From: Bruce Campbell <[email-masked]>
> To: [email-masked]
> Subject: Re: HTML email
> 	[...]
> tytso> non-HTML enabled mail readers?  ...
> 
> 	[...]

If I count correctly, your list contains 284 samples.  I suspect that
a good number of the remaining 229 mail messages were created by older
mailers that don't generate an X-Mailer header.

I assume this message doesn't contain an "X-Mailer: Berkeley Mail forever"
header.

(Ok, ok.  I have been known to use vi as my HTML editor, too...)

-tjs

And, from NANOG (I deleted most of the headers, but I didn't see an
X-Mailer:):

> From: [email-masked]
> To: [email-masked]
> Subject: Please Format Your Posts
> Date: 	Sat, 13 May 2000 22:13:09 -0700
> 
> I know that I am old & curmudgeonly now, but surely I cannot
> be the only NANOG person who uses UCB Mail on occasion?
> 
> Or is it a lost cause to expect people to be concerned about
> the number of characters on a line, when they are arguing
> that we shouldn't worry about the number of globally-known
> routing prefixes?
> 
> 	Sean. (who could buy a fancy email system, 
> 		but doesn't want one at home
> 	       and who could buy a big-iron router, 
> 		but doesn't want one at home)

---

From: [email-masked]
Date: Fri, 19 May 2000 10:12:14 -0400

> 	29 exmh

OK, let's make it 30 for exmh ;)

But seriously, there's a big disparity between counting the messages *posted*
and the MUAs being used to *READ* the messages.  I'm willing to bet that the
traditional posters, the professional lurkers, and the newbies are three
disjoint groups, with quite possibly different expectations regarding mail
software.

I'm willing to bet that the newbies don't know what hit them, the traditional
posters are savvy enough to deal with anything, and the complaints are
mostly coming from the lurkers....

---

From: "Scot Mc Pherson" <[email-masked]>
Date: Fri, 19 May 2000 10:28:30 -0400

Perhaps you could clarify for us, who falls into which category?

-Scot Mc Pherson, N2UPA
-Sr. Network Analyst
-ClearAccess Communications
-Ph: 941.744.5757 ext. 210
-Fax: 941.744.0629
-mailto:[email-masked]
-http://www.clearaccess.net

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Friday, May 19, 2000 10:12 AM
To: Bruce Campbell
Cc: [email-masked]
Subject: Re: HTML email

But seriously, there's a big disparity between counting the messages
*posted*
and the MUAs being used to *READ* the messages.  I'm willing to bet that the
traditional posters, the professional lurkers, and the newbies are three
disjoint groups, with quite possibly different expectations regarding mail
software.

I'm willing to bet that the newbies don't know what hit them, the
traditional
posters are savvy enough to deal with anything, and the complaints are
mostly coming from the lurkers....

---

From: "Michael H. Warfield" <[email-masked]>
Date: Fri, 19 May 2000 10:01:39 -0400

> disjoint groups, with quite possibly different expectations regarding mail

	Ok...  So, let's try a different kind of survey.  Let's try the
kind of survey that hit CyperPunks a year or so ago.

	We post an html message containing some hostile java script.
I've got one that puts up a window proclaiming "HTML is inappropriate
in E-Mail" and then closes your browswer when you hit OK.  I've got
another that opens TWO windows proclaiming "HTML is inappropriate in
E-Mail" each time you hit OK in one (that one is a mother to kill).
That does a quick "smoke test" survey of how many people have and html
enabled reader with javascript enabled.  :-)  Voting is tabulated by
counting screaming.

	Round two...  Someone sets up a nasty web page (with good logs) and
and then sends out an HTML message with a meta-tag refresh that bounces
the reader to the web page.  Now we get a quick and automatic feedback
on how many people have html enabled readers that honor the refresh
meta-tag.

> mostly coming from the lurkers....

	You can have lots of fun with HTML and especially have lots of
fun with people who have HTML enabled readers.  Only Outlook does it
better (with everything IT currently honors).

	Mike
-- 
 Michael H. Warfield    |  (770) 985-6132   |  [email-masked]
  (The Mad Wizard)      |  (770) 331-2437   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!

---

From: "RL 'Bob' Morgan" <[email-masked]>
Date: Fri, 19 May 2000 12:17:10 -0700 (PDT)

Sorry to prolong (and further degrade) this already overlong thread, but
somehow the one-upsmanship (or -downsmanship I suppose) about who has the
most primitive email environment reminded of the venerable item below. My
only excuse is that it's a Friday in May ...

 - RL "Bob" (proud Pine user, of course)

---

        WARNING: Nerd humor follows

>From: [email-masked] (GUNNAR HORRIGMO)
>Subject: Re: Help with XMS mailer on my Game-Boy?
>Date: Sun, 8 Nov 1992 18:53:02 GMT

>[email-masked] (Randy Wong) writes:
>>[email-masked] (Daniel M Silevitch) writes:
>>>[email-masked] (Steven Marcotte) writes:
>>>>[email-masked] (Babak Gohari) writes:
>>>>>[email-masked] (Tilden-Master of Illogic) writes:
>>>>>>[email-masked] (David Lutz) writes:
>>>>>>>[email-masked] (Daniel M Silevitch) writes:
>>>>>>>>[email-masked] (Brat Wizard) writes:
>>>>>>>>>[email-masked] writes:
>>>>>>>>>>Michael Schmahl [Black-Robe Mage] writes:
>>>>>>>>>>>[email-masked] writes
>>>>>>>>>>>>22161-bunz writes:
>>>>>>>>>>>>>Brett G Person writes:
>>>>>>>>>>>>>>[email-masked] writes:
>>>>>>>>>>>>>>>IronEagle writes:
>>>>>>>>>>>>>>>>Matt Welsh writes:
>>>>>>>>>>>>>>>>>Right! I run System V on my VIC-20!
>>>>>>>>>>>>>>>>Hmmmm...well, I am getting SVR4 for my HP 48SX.....
>>>>>>>>>>>>>>>HA! _I'm_ just finishing up a port of VMS for my Timex Sinclair!
>>>>>>>>>>>>>>>Top THAT!
>>>>>>>>>>>>>>I'm running NextStep on Atari 2600 Video Game System.
>>>>>>>>>>>>>Just last night I was able to get Windows to boot on my Sears PONG
>>>>>>>>>>>>>game.
>>>>>>>>>>>>I am replying to this message with my built-in VAX Mailer on my
>>>>>>>>>>>>Game-Boy.
>>>>>>>>>>>>I just installed a 10 Gigabyte Drive to handle all the replies!
>>>>>>>>>>>>However, it only runs at 230,000 Baud due to the large drive
>>>>>>>>>>>>slowing it down.
>>>>>>>>>>>I fear I will not be getting news any longer...  The batteries on my
>>>>>>>>>>>calculator-watch are running out.
>>>>>>>>>>My calculator-watch is solar...  And if I turned off the lights, NO
>>>>>>>>>>ONE would be getting news...
>>>>>>>>>Feh. I'm so slick NASA just awarded ME the TERADATA contract to run on
>>>>>>>>>my TV remote! They liked my proposal mainly because I'm ALSO able to
>>>>>>>>>shoehorn in the TEXAS SUPERCOLLIDER computations between commercials!
>>>>>>>>>Beat THAT!
>>>>>>>>Well, well, well. SSC calculations, huh. I built a system out of 2
>>>>>>>>inches of wire, 3 pennies and a AA battery that does realtime
>>>>>>>>calculations of particle vectors during the Big Bang. A complete
>>>>>>>>simulation of the first 2 years of the life of the universe, accurate
>>>>>>>>to the theoretical limit, takes about 5 seconds.
>>>>>>>And you guys think you are so great.  I just spent the last half hour
>>>>>>>getting X11 to run on my slide rule.  I am still having problems
>>>>>>>connecting it to the net around here, but I would welcome any
>>>>>>>suggestions.
>>>>>>So what!!! I'm running Xinitrc, TWMRC, Internet, and 27 muds off of a
>>>>>>paperclip.  Not to mention the fact that I am designing a new form of
>>>>>>television with 7000 pixels based off a piece of tissue paper.  Next!!!
>>>>>Man, that's baby stuff.  I'm running a particle accelerator utilizing
>>>>>matter-antimatter reactions in my doorknob, and calculating everything in
>>>>>the fourth dimension using a single dip switch and a large glass of water.
>>>>Child's play, I have an old piece of cheese that is, at this very moment,
>>>>raytracing an actual model of the universe five hours from now, while
>>>>at the same time calculating the heat produced from the new intel
>>>>Pentium.
>>>And you people think that you are hackers! I'm currently engaged in a
>>>project which involves simultaneous simulation of multiple universes (To
>>>see what would happen if various constants change. Pi=8.4 is an interest-
>>>ing one.) My hardware consists of a single wooden pencil (no paper). With
>>>it, I can do real-time simulations of 2^32 universes in parallel.
>>You guys are wimps!!  I've just finished converting a microwave oven into a
>>paradimensional teleportation device.  The only problem I'm having so far is
>>that my breakfast bagel keeps disappearing!!  May have to eat it raw . . .
>Sorry, that's my fault.  I'm afraid that the high-energy laser-pumped
>negentropic vortex generator I made from my own nostril hair, which is
>currently cranking out entire new universes at the rate of 7.6 per picosecond,
>was breaking the FCC emissions limits and gronking your microwave's control
>panel.  It should work properly now.  Also, my cat Arthur was FTPing hundreds
>of terabytes of PD software from Epsilon Eridani in the year 4741 A.D. over
>the faster-than-light Ethernet interface I built for him, and this may have
>been loading the Net a little yesterday.  My sincere apologies to everyone who
>noticed any performance degradation.
Damn, I thought I was doin' some really advanced R&D. But I only have a
humble feather pen with built in spell checking. It checks all languages
since Adam & Eve plus a few forthcoming languages. But after what I've seen
here, that's not good enough for a Nobel Prize..I have to work harder...
Maybe some of the languages from outer space will help ?? I just have to
use my FingerNail Time&Universe Transporter(tm) to get there and learn them.

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Fri, 19 May 2000 16:35:58 -0400

Date: Thu, 18 May 2000 23:54:01 -0500 (CDT)
   From: Tim Salo <[email-masked]>
   X-Loop: [email-masked]

.... and it's likely that most of the 229 mail messages created by
"older mailers" don't deal with HTML, and possibly not with MIME,
either.

					- Ted

					(who is still using emacs RMAIL
					to read his mail)

---

From: Graham Klyne <[email-masked]>
Date: Sun, 21 May 2000 08:48:56 +0100

>I can set up a mailing list if you like.

Loath as I am to subscribe to yet another mailing list, one dealing with 
ways to control the spread of malicious content is one that I think would 
be very worthwhile.

#g

(Who uses an 8-year old version of Microsoft Word, in part as a precaution 
against macro viruses ;-)

------------
Graham Klyne
([email-masked])

---

From: Graham Klyne <[email-masked]>
Date: Sun, 21 May 2000 09:08:46 +0100

>it was certainly in the spirit of it..

Interesting...  nothing is new under the sun, etc.

Recently, in considering designs for content negotiation in e-mail, I 
considered exactly that model (which is, as far as I can tell, entirely 
within the letter of the law).  In the end it was rejected for purely 
pragmatic reasons -- that proper support for multipart/alternative is not 
sufficiently widely available.

(I've just been to WWW9, where one of the themes has been mobile data.  One 
recurring idea there was the extent to which the problems of mobile data 
and accessibility for persons with constrained abilities are, at a purely 
technical level, facets of the same problem.)

#g

------------
Graham Klyne
([email-masked])