Subject: value of standards

From: Peter Nõu <[email-masked]>
Date: Thu, 04 May 2000 20:16:56 +0200

At 18:02 2000-05-04 Lillian Komlossy wrote:
>The whole world will not switch over to Unix
>- the average user will always be more confortable with Windows

The whole world might not be comfortable with Windows but many, 
many of my collegues around the world work at companies where 
they have absolutely no say on the choise of either OS or email 
client. The CIO/CTO (blame him or her instead!) (simply) made 
the (safest) decision and went for the Exchange/Outlook combo 
with added Office integration :-) And the users had no say whatsoever.

Rather than making fun of or scream "stupid", why don´t we keep 
developing and arguing for standard based 'solutions': because 
that's what ms is selling with a fair amount of success. Maybe 
TCO (total cost of ownership) calculations comparing "standard 
combos" with MS offering, taking virus downtime into account would help?

/peter

     ---------------------------------------------------------------
    "The sheepdog is shown its possibilities, he learns what life is
     like for a good dog and is invited to walk in a rational world
     whose farthest boundaries are defined by grace."
                                         --Donald McCaig, Nop's Hope

     [email-masked]              Nöu How, Firma
     Tel +46 70 515 7602        Stadshagsplan 10
     Fax +46 70 617 1602        112 50 Stockholm
     Cellular +46 70 515 7602

---

From: Keith Moore <[email-masked]>
Date: Thu, 04 May 2000 15:25:37 -0400

> Rather than making fun of or scream "stupid", why don't we keep 
> developing and arguing for standard based 'solutions':

You mean like RFC 2046?

   The recommended action for an implementation that receives an
   "application/octet-stream" entity is to simply offer to put the data
   in a file, with any Content-Transfer-Encoding undone, or perhaps to
   use it as input to a user-specified process.

Gee, I sure am glad that the vendor of this software followed the standard
and offered to save this body part to a file.

(note that it says "user-specified process" as opposed to the insecure 
default action so graciously provided by the vendor)

RFC 2046 also says (section 9):

   Implementors should pay special attention to the
   security implications of any media types that can cause the remote
   execution of any actions in the recipient's environment.  In such
   cases, the discussion of the "application/postscript" type may serve
   as a model for considering other media types with remote execution
   capabilities.

and the section on application/postscript does indeed describe risks that
are similar to those in visual basic.

Perhaps unfortunately, RFC 2046 doesn't come right out and say
"DON'T EXECUTE CONTENT IN EMAIL MESSAGES".

Then again, it doesn't say DON'T CUT YOUR CUSTOMER'S ARM OFF either.

not that it would matter if it did...

Keith

---

From: John Stracke <[email-masked]>
Date: Thu, 04 May 2000 17:01:15 -0400

> Then again, it doesn't say DON'T CUT YOUR CUSTOMER'S ARM OFF either.

Don't be silly; a vendor would never cut a customer's arm off.  How would
they pull out their wallet to pay for the next upgrade?

--
/===============================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own. |
|Chief Scientist |==============================================|
|eCal Corp.      |Some days, it just doesn't pay to gnaw through|
[email-masked]|the straps.                                   |
\===============================================================/

---

From: [email-masked]
Date: Thu, 04 May 2000 23:10:52 -0400

> not that it would matter if it did...

There's simple inability to correctly implement the protocol,
and there's unwillingness to correctly implement the protocol.

I'm still not sure which is more easily curable with a baseball bat... ;)

				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech