Subject: Re: filtering active content

From: Vernon Schryver <[email-masked]>
Date: Wed, 25 Jul 2001 08:40:27 -0600 (MDT)

> From: "James P. Salsman" <[email-masked]>

> ...
> > Don't some Microsoft MUA's ignore the MIME type and look for
> > what are called magic numbers in the UNIX world?
>
> Sort of; they use the filename extension, not the MIME type.  DOS/360
> lives in the heart of every copy of Microsoft Windows.  Welcome to 1970.

I've read somewhere that they sometimes ignore the 3 character DOS
filename or filetype extension and look for magic numbers in the data.
I've no way of evaluating that, or at least no inclination.

> The correct solution is to find out who at Microsoft refuses to put 
> security safeguards on the address book(s) and allows scripts to 
> fully send messages instead of queueing for approval.  I find it 
> amazing that they haven't implemented such easy fixes in the past 
> couple of years, after things started getting really bad....

That assumes there is such a someone.  Anyone who has worked in a big
outfit guesses that most Microsoft employees who can spell SMTP would
like to apply some of the obvious fixes, but that the organization as
a whole, including customers, resists.

Consider how utterly trivial it would be for the IETF to install a less
ancient version of sendmail than 8.9 on odin.ietf.org, and then do any
of the things that have been suggested for years to stem the flow
of vacation notices and viruses, including 
  - add "precedence: bulk",
  - limiting the size of messages,
  - filtering some or all MIME types,
  - filtering on some MUA stigmata.

Consider the first in particular.  No one says a bulk header would be
harmful.  Everyone admits it would largely fix the flood of vacation
notices.  The worst that is said is that it would not be justified by
any standard, as if the X-Loop header that odin now adds is somehow
justified by a standard or as if odin doesn't pass the precedence
header when it sees it.

If the IETF can't install less ancient software and add 3 or 4 lines
to a single sendmail.cf file on a single computer within 2 or 3 years,
then how can you expect Microsoft to modify bazillions of computers?
If Microsoft customers were as slow to upgrade as the IETF, then even
if Microsoft fixed all of the problems tonight, we could expect to
see no improvement for about 5 years.

Vernon Schryver    [email-masked]

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

> No one says a bulk header would be harmful.

actually, in the past it has been harmful.

- some list expanders used it as a loop-prevention flag - assuming 
  that any message that had precedence: bulk had already been 
  fowarded to the list.

- one mail gateway used precedence for 'priority' and would bounce 
  any message that contained a precedence keyword that it did not
  understand.  IIRC "bulk" was one of those not understood.

the latter mail gateway is probably long gone (and may have been fixed
before it died) but it wouldn't surprise me if some list expanders
still had that behavior.  and the IETF list gets forwarded to lost of
sublists.

that's what happens when people use nonstandard protocol extensions -
without a widely agreed-on definition of what the extension does, 
people will use the extension to do whatever they like - whether it
conflicts with existing usage or not.

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

Keith

---

From: John Martin <[email-masked]>
Date: Wed, 25 Jul 2001 22:44:21 +0200

>I've no way of evaluating that, or at least no inclination.

I know that both Explorer and Netscape do exactly this [for web content]. 
E.g. a filename with ".gif" can still contain an executable... and 
therefore a virus.

I believe you can find more specific details in the Netscape source code at 
mozilla.org.

John
---------------------------------------------------------------
Network Appliance           Direct / Voicemail: +31 23 567 9615
Scorpius 2                                 Fax: +31 23 567 9699
NL-2132 LR Hoofddorp               Main Office: +31 23 567 9600
---------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 13:53:38 -0400

Keith