Subject: filtering active content

From: "James P. Salsman" <[email-masked]>
Date: Tue, 24 Jul 2001 20:54:10 -0700 (PDT)

Vernon Schryver asks:

>... Is there a reasonable filter than can filter what Microsoft considers
> active content? 

Yes, in the Content-disposition header, change the "filename=" 
parameter to something like "x-filename-kept-away-from-outlook=".  
For example:

--- BEFORE ---

Content-Disposition: attachment; 
 filename="Public Libraries.vbs.doc.lnk"

--- AFTER ---

Content-Disposition: attachment; 
 x-filename-kept-away-from-outlook="Public Libraries.vbs.doc.lnk"

You should still be able to see attachments and their declared types, 
but you will have to dig into the text of the message for the filename.

> Don't some Microsoft MUA's ignore the MIME type and look for
> what are called magic numbers in the UNIX world?

Sort of; they use the filename extension, not the MIME type.  DOS/360
lives in the heart of every copy of Microsoft Windows.  Welcome to 1970.

The correct solution is to find out who at Microsoft refuses to put 
security safeguards on the address book(s) and allows scripts to 
fully send messages instead of queueing for approval.  I find it 
amazing that they haven't implemented such easy fixes in the past 
couple of years, after things started getting really bad.  I theorize 
that the human race is in a darwinian symbiosis with the email worms, 
which, like wolves, cull the weak (less intelligent) from the herd, 
allowing additional resources for the rest. 

Cheers,
James

---

From: Einar Stefferud <[email-masked]>
Date: Wed, 25 Jul 2001 01:48:37 -0700

Seems to me that MSN has made, and is making, a very clear statement 
of its carefully considered regard for the interests of all Internet 
Users of their software systems.

My personal solution is to avoid the use of any MSN system that I can avoid.
So I am voting with my wallet and my fingers.  So far, the only 
impact of this latest annoyance is the trash flowing on this list as 
a result of failure to discriminate between trash and not-trash.

I do appreciate the effort to at least surgically remove the virus 
code from the forwarded mail.  I am not sure why they don't also top 
forwarding the rest of such messages, along with all the notices, 
since it is obvious that there is no useful content in the message 
without its virus/worm code, and then they could also stop sending us 
two notices of removed virus.worm code for each forwarded instance of 
a neutered virus/worm bearing message.

Since it is clear that they are able to recognize the ornery little beasties,
why not go all the way, and just send them all to [email-masked]?

Think of all the mental effort and anguish that this would save us 
from;-)...  I hesitate to try to put a value on it, but it must come 
close to $100,000 by now for this instance.

Cheers...\Stef

>  >... Is there a reasonable filter than can filter what Microsoft considers

<SNIP>... <SNIP>... <SNIP>... <SNIP>... <SNIP>... <SNIP>... <SNIP>... <SNIP>

---

From: "Rahmat M. Samik-Ibrahim" <[email-masked]>
Date: Thu, 26 Jul 2001 09:41:15 +0700

Einar Stefferud wrote:

> So I am voting with my wallet and my fingers. 

Sure (as if other option exists :^) !
Unfortunately, I am still looking for a better "Office like" 
software (including Outlook); since I am not so happy with the 
current whatever (StarOffice, OpenOffice, KDE, GNOME).

>>allowing additional resources for the rest.

regards,

-- 
Rahmat M. Samik-Ibrahim - VLSM-TJT - http://rms46.vlsm.org
- Nimbus 2000: Now on SALE at our platform 9 3/4 outlet --