Subject: RE: VIRUS WARNING

From: Vernon Schryver <[email-masked]>
Date: Thu, 11 May 2000 10:11:32 -0600 (MDT)

> From: Lillian Komlossy <[email-masked]>

> While what you say is true - meaning an all-text restriction on your email
> browser will prevent
> "dangerous goods" to be downloaded - it also takes away functionality. We
> have to find a way to
> be able to use html based email but restrict it from - say running scripts,
> executing anything,
> writing cookies, issuing queries, etc... Until that happens, you're right -
> html based email
> is like a runaway train. We have to invent the "brakes" now.

Never mind the other reasons why HTML based email is considered an
abomination by many who understand the issues.  What you want is
self-contradictory.  What good is HTML based email if it cannot run
scripts or even contain links to other HTML content?  Once you restrict
HTML based email enough to be safe, why bother with anything more than
text and perhaps simple pictures?  It's not only programs in email that
are dangerous, but also HTTP references.  Recall the recent disclosures
concerning the use of unique to the target URL's of invisible pages in
email and web sites instead of HTTP cookies.

You want to run your freight train down a long pass with an 8% grade at
100 miles per hour, and not need to worry about it running away.  Maybe
someday there will be some other solution, but today the only tactics
that let breaks control a train in such circumstances begin with going far
less than 100 mph.

You simply cannot have unbridled user-friendliness and security against
bad guys.  No matter what the salescritters and pointy-haired claim,
security and convenience will always be at odds.

Vernon Schryver    [email-masked]

---

From: Jacob Palme <[email-masked]>
Date: Thu, 11 May 2000 20:36:52 +0200

At 10.11 -0600 0-05-11, Vernon Schryver wrote:
> Once you restrict
> text and perhaps simple pictures?

What is wrong with that. I use HTML-based e-mail mostly to
inluce pictures in my messages.

A very useful way of using HTML-based e-mail would also be
to send out forms and fill them in via mail, but this does
not work so well because some mailers does not handle such
messages very good yet.
-- 
Jacob Palme <[email-masked]> (Stockholm University and KTH)
for more info see URL: http://www.dsv.su.se/jpalme/

---

From: "Michael H. Warfield" <[email-masked]>
Date: Thu, 11 May 2000 15:09:04 -0400

> inluce pictures in my messages.

	Yup...  It's real amusing to have your boss looking over your
shoulder just about the time a spammer hits your mailer with an html
message including <IMG SRC=....> tags embedding some of his porno
for you to sample (don't scoff, it has been occuring and has required some
people to do some fast talking).  Another insiduous trick is to use the
refresh tag to bounce you over to his site where he may have other
pleasures for you like pop-up windows when you try to close the window.
This doesn't work as good since I don't think it's as well supported.
But it has been tried and does catch some chumps.  Note that the refresh
tag is not active content and if you are reading E-Mail in a broswer,
it can be real effective and real embarassing.  I don't know how
effective it is in mere html enabled readers like Outlook or Eudora.

	As far as tracking down the perpetrators goes...  How effective
have you been at tracking down the people responsible for spam?

> not work so well because some mailers does not handle such

	Mike
-- 
 Michael H. Warfield    |  (770) 985-6132   |  [email-masked]
  (The Mad Wizard)      |  (770) 331-2437   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!

---

From: John Stracke <[email-masked]>
Date: Thu, 11 May 2000 16:10:06 -0400

Vernon Schryver wrote:

> What good is HTML based email if it cannot run
> scripts or even contain links to other HTML content?

Well, there's basic formatting:

   * Simple font variations (italics, bold, color, font) are an easy way to add
     a bit of expressiveness to your text.
        o Everybody says that the problem with email is that it's not expressive
          enough.
        o To compensate, we've got an elaborate set of conventions for imitating
          what you can do in print and face-to-face (smileys, *asterisks* for
          emphasis, etc.).
        o But new users don't know these conventions.
        o HTML offers the ability to do the same thing more comprehensibly.
          Actual smiley faces, italics for emphasis (just like people are used
          to seeing in print), headings.
   * And, of course, lists and tables are amazingly useful.

And even simple links (never mind forms, applets, etc.) are great for, say,
workflow applications.  When I worked for Netscape, HR made great use of HTML
mail in the internal network.  When I wanted to take some vacation
time, I filled out a form on the HR site; they would send mail to my manager,
with one link to approve and one to deny.  Much easier than paper-based systems,
or even non-email-based online systems (since the vacation request comes into
the inbox you already check, instead of making you go someplace else).

--
/===============================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own. |
|Chief Scientist |==============================================|
|eCal Corp.      |Whose cruel idea was it for the word "lisp" to|
[email-masked]|have an "S" in it?                            |
\===============================================================/

---

From: John Kristoff <[email-masked]>
Date: Fri, 12 May 2000 09:33:02 -0500

> Well, there's basic formatting:
[...]
> And even simple links (never mind forms, applets, etc.) are great for,
> say, workflow applications.  When I worked for Netscape, HR made great
> use of HTML mail in the internal network.  When I wanted to take some

Email is not the web.

John

---

From: [email-masked]
Date: Fri, 12 May 2000 10:51:39 -0400

> > use of HTML mail in the internal network.  When I wanted to take some

On the other hand, e-mail does a MUCH better job of some things than the web
does.  In particular, if you do workflow via e-mail (especially with PGP or
other authentication/encryption), you can send the object to the next person
that needs it, and *NOT* expose it to the rest of the world.

If you do it web-based, you then have all the ugly issues of getting it onto
the webserver, setting access controls on it so that only the intended person
can get at it, etc etc etc.

Incidentally, this is exactly the same issue as "attach a file to an e-mail"
versus "send the recipient a note, copy the file to a ftp/web server, wait
for him to retrieve it, and then remember to clean it up afterwards".

Let's face it guys - unless we collectively come up with a better way to
do it, there's going to be a continued push towards having more "push" style
interaction via e-mail.  RFC1440 (Sender-Initiated File Transfer) appears
to be essentially dead, and no new contenders have arrived....
-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

---

From: "Michael H. Warfield" <[email-masked]>
Date: Fri, 12 May 2000 09:58:52 -0400

> not work so well because some mailers does not handle such

	And of course, a day after posting my earlier reply to this message,
I receive this example of how useful HTML is in E-Mail:

	[...]
] X-Mailer: DiffondiCool V3.1.1 (W95/NT) Delfino Solutions (Build: Nov  7 1998)
] Mime-Version: 1.0
] Date: Fri, 12 May 2000 21:33:03 +0800
] Content-Type: multipart/mixed; boundary="----=_NextPart_000_007F_01BDF6C7.FABAC1B0"
] Content-Transfer-Encoding: 7bit
] 
] This is a MIME Message
] 
] ------=_NextPart_000_007F_01BDF6C7.FABAC1B0
] Content-Type: text/plain; charset="iso-8859-1"
] Content-Transfer-Encoding: quoted-printable
] 
] 
] ------=_NextPart_000_007F_01BDF6C7.FABAC1B0
] Content-Type: text/html; name="unknown.htm"
] Content-Transfer-Encoding: quoted-printable
] Content-Description: unknown.htm
] Content-Disposition: inline; filename="unknown.htm"
] 
] <html><head>
] <meta http-equiv=3D"refresh" content=3D"0;URL=3Dhttp://myad.cn99.com">
] </head></html>
] 
] ------=_NextPart_000_007F_01BDF6C7.FABAC1B0--

	Well gooollllleeeyyyy.  I wonder what that piece of crap was
suppose to do.  I'll bet this spammer thought I was stupid enough to
be using an HTML enabled reader that would just bounce me right to
his spam site where he would not only hit me with his cruft but
he would also know that his E-Mail hit paydirt and he had a good
address on this host.  All without any active content at all.  Oh
well...  Guess he failed on this one.  How many chumps do you think
he might have succeeded with?

	I got hit with three copies of it (various permutations of
my addresses).  I'll probably see more before the day is out.  BTW...
According to the Received-By headers, the point of origin was in .cn,
so it will be a bloody cold day in hell before I'm able to do anything
about this clown.  Grrr...

	If people wouldn't use HTML readers, this trick wouldn't work
at all, and I wouldn't have to tolerate this cruft (yes, I know, they
would try something else but at least it wouldn't be this morally
offensive).

	Mike

---

From: chris d koeberle <[email-masked]>
Date: Fri, 12 May 2000 12:04:08 -0400 (EDT)

> for him to retrieve it, and then remember to clean it up afterwards".

Only if the e-mail client in question automatically executes the attached
file.

Indeed, I don't think any of the people who are complaining about the
"HTML in e-mail" issues would complain about someone sending an e-mail
with an HTML file as an attachment.  At least, not as I understand their
arguments against it.

At any rate, it is certainly not "exactly the same issue" - people have
expounded upon the differences already.

-=I would imagine that if 1000 Rwandan's were hacked to death AT THE EXPO,
people would sure have raised a stink.=-

---

From: "Michael H. Warfield" <[email-masked]>
Date: Fri, 12 May 2000 11:50:29 -0400

> with an HTML file as an attachment.  At least, not as I understand their

	Wrong...

	We object to is so strenuously that we've added global blocking
filters to majordomo at our site in "taboo-body".  We've had one two
many come through with a hostile java script worm in it and then
had a few dozen people complain that we're distributing viruses and
a few hundred get burned by it.  BTW...  The site in question has
over 70 mailing lists with almost 50,000 unique addresses subscribed
to one or more lists.  We can't tolerate html on the mailing lists
at all, if for no other reason than the administrative headache that
occurs when hostile content (active or not) propagates over any of the
lists.

	Mike