Vulnerability Development mailing list archives

Re: Please do NOT send examples of too long filenames (etc)


From: tom () INFOMATCH COM (Tom)
Date: Sat, 13 May 2000 20:31:49 -0700


On Fri, 12 May 2000, Seth Cohn wrote:

For the second time in recent weeks, security lists I'm on have broken
my mail client by sending attachments WITH THE NOTICE that said attachments
will
break one mail client or another.

For pete's sake, if you are going to submit an example, DO NOT ATTACH IT
DIRECTLY.
Sending it merely breaks the email client of the very people
who NEED to hear about the problem, and in most cases, we don't even get to
see the
email until our client breaks and we fix it.

This seems like common sense, yet it's happened twice now in a short span of

No Seth, you are wrong.  This issue has been discussed numerous times on
many security mailing lists.  Don't rely on others to not send you
messages that won't exploit your (obviously) vulnerable e-mail client.
Don't try to change the world to suit your desire to use an e-mail client.
Not because it's a bad idea, but because it will never happen.  History
has proven this.

PS: In case you are wondering, my e-mail client of choice for sensitive
e-mails is "pine".  No frills, and even if pine is exploited/DOS'd, I lose
nothing.

-Tom


Current thread: