[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Painful USA Today article (was RE: ANN: RESTTuto

• To: xml-dev@l...
• Subject: Re: Painful USA Today article (was RE: ANN: RESTTutorial)
• From: Joe English <jenglish@f...>
• Date: Thu, 23 May 2002 14:05:47 -0700
• In-reply-to: <8BD7226E07DDFF49AF5EF4030ACE0B7E06621C40@r...>
• References: <8BD7226E07DDFF49AF5EF4030ACE0B7E06621C40@r...>

Dare Obasanjo wrote:
> [Joe English]
> > [Outlook] will never be as secure and virus resistant as
> > traditional Unix MUAs which HAVE THE GOOD SENSE NOT
> > TO AUTOMATICALLY RUN EXECUTABLE PROGRAMS THAT ARRIVE
> > IN THE MAIL.
> >
>
> Strong claims. Please back them up.


Ten years ago, the very idea of an "email virus" was
considered laughable.  Today, Outlook is one of the
primary distribution vectors for viruses.


> Of the major Outlook virus incidents that have occurred in the past few
> years can you seriously claim that even 50% of them were a result of the
> ability to "AUTOMATICALLY RUN EXECUTABLE PROGRAMS THAT ARRIVE IN THE
> MAIL" and not social engineering?

Not with any authority, since I'm not familiar with the details
of what the virus authors have been up to lately.  But unless by
"social engineering" you mean "convince a substantial percentage
of Internet users to use a notoriously insecure program as their
mail reader," then yes, that's precisely what I claim.


> However you may simply be claiming that the ability for users to receive
> or run attachments is a feature that should not be enabled by MUAs in
> today's hostile Internet.

I wouldn't go that far, but MUAs should definitely *not*
automatically invoke executable programs from untrusted sources.
Not in today's hostile Internet, not in yesterday's more
benign Internet, not even in the trusting environment of
yesteryear's ARPANET and UUCP-based networks.  *Everybody*
knows this, or at least everybody ought to.

Word documents and Excel spreadsheets, by virtue of scriptability,
are in effect executable programs.  Until very recently they
didn't even have a sandbox mode to restrict what macros could do.
Like I said earlier, Word and Excel and the like are the real
culprits, not Outlook, but the fact that Outlook would automatically
fire these programs up and feed them untrusted data makes it
culpable.



--Joe English

  jenglish@f...

• References:
  • RE: Painful USA Today article (was RE: ANN: RESTTutorial)
    • From: "Dare Obasanjo" <dareo@m...>

• Prev by Date: Re: Painful USA Today article (was RE: ANN: RESTTutorial)
• Next by Date: RE: Painful USA Today article (was RE: ANN: RESTTutorial)
• Previous by thread: RE: Painful USA Today article (was RE: ANN: RESTTutorial)
• Next by thread: RE: Painful USA Today article (was RE: ANN: RESTTutorial)
• Index(es):
  • Date
  • Thread