more on Any ideas of what ELN is up to

[David Farber <dave () farber net>]

Begin forwarded message:

From: Rehmi Post <rehmi () media mit edu>
Date: September 8, 2005 4:57:51 PM EDT
To: dave () farber net
Subject: Re: [IP] Any ideas of what ELN is up to


Dave,

Recently I've observed that Symantec Mail Security rejects ASCII
email messages containing lines beginning with two or more hyphens,
such as in the signature appearing in every message to the IP list.
You might try replacing the hyphens with underscores and resending
to test this hypothesis.

IANAMCSE, but this is probably Symantec's hedge against a sloppy
MIME decoder somewhere in the Windows code base. Per RFC1521, MIME
containers are delimited by unique tokens that begin with two hyphens
at the start of a new line.

So now we must all forgo the ability to write arbitrary ASCII messages
in order to (potentially) protect a few from insecure proprietary code.
Just another tragedy of the commons brought to you by Microsoft and our
increasingly security-obsessed culture.

Rehmi


On Sep 8, 2005, at 14:06, David Farber wrote:


> There are no attachments on the msgs I sent and they are sent from  
> the MAC. I am confused. Anyone else see any problems ??
>
> Dave
>
> Begin forwarded message:
>
> From: "Richard J. Solomon" <rjs () goodread com>
> Date: September 8, 2005 9:33:01 AM EDT
> To: dave () farber net
> Subject: something wrong with your messages
>
>
> This is the forth message that was blocked by Earthlink because of  
> a virus embedded in the message.
>
> Richard
>
>
>
>
> > Status:  U
> > X-ELNK-AV: 4
> > X-ELNK-SYS: 1
> > Date: Thu, 8 Sep 2005 08:32:07 -0400 (EDT)
> > To: rsolomo1873 () earthlink net
> > From: EarthLink Support <support () earthlink net>
> > Subject: EarthLink Virus Blocker Alert: Message from David Farber  
> > <dave () farber net> Quarantined
> >
> > **************************************
> > EARTHLINK VIRUS BLOCKER MESSAGE STATUS
> > **************************************
> >
> > MESSAGE QUARANTINED
> >
> > Virus Detected: Malformed container violation
> >
> > Message Details:
> > From: David Farber <dave () farber net>
> > To: Ip Ip <ip () v2 listbox com>
> > Subject: [IP] more on A MUST MUST read on the real world of  
> > disaster prep
> > Date: Thu, 8 Sep 2005 08:26:32 -0400
> >
> > This email included an attachment which EarthLink identified
> > as containing a virus known as Malformed container violation.
> >
> > For your protection, EarthLink Virus Blocker has quarantined the
> > message because the virus it contains cannot be removed or disabled.
> >
> > When a message is quarantined, you should let the sender know that a
> > virus was found in the message they sent to you, and ask them to send
> > a new, clean message.
> >
> > There may be circumstances where you want to download a quarantined
> > message. You should only do so if you have up-to-date antivirus
> > software installed on your computer. Please exercise caution when
> > reading a quarantined message, as it is possible the original message
> > had malicious intent.  Some viruses hide in   email headers and are
> > activated when infected emails are opened. EarthLink recommends you
> > do not reply to the email or click any links contained in the email.
> >
> > To learn how to access this message, please see below:
> >
> > When you receive a legitimate message that can't be cleaned, it's
> > moved to a special Quarantine folder on EarthLink's email system.
> > When this happens, Virus Blocker will send you an email indicating
> > that a message has been quarantined (including message details).
> >
> > When a message is quarantined, the best action is to let the sender
> > know that a virus was found in the message they sent to you, and ask
> > them to send a new, clean message.
> >
> > If you have antivirus software installed on your computer, you may
> > want to download a quarantined message. You should be very careful
> > when reading messages that have been quarantined, as some viruses
> > hide in the headers of a message, so all you have to do is open the
> > message to activate the virus.
> >
> > To download quarantined messages
> >
> > 1. Sign in to My Account using the email address that received the
> >    infected message.
> > 2. On the Email Maintenance page, disable Virus Blocker
> > 3. Check the box to move quarantined messages into your Inbox.
> >
> > Please note that quarantined messages are automatically deleted
> > three days after they are received.
> >
> > Sincerely,
> >
> >
> > EarthLink Support
> >
> > ***************************
> > Powered by Symantec
> > ***************************
> >
> > *********************************************************************
> > This is an Administrative Message from EarthLink. It is not spam.
> > From time to time, EarthLink will send you such messages in order
> > to communicate important information about your subscription.
> > *********************************************************************
>
>
>
>
> -------------------------------------
> You are subscribed as rehmi () media mit edu
> To manage your subscription, go to
>  http://v2.listbox.com/member/?listname=ip
>
> Archives at: http://www.interesting-people.org/archives/interesting- 
> people/




-------------------------------------
You are subscribed as lists-ip () insecure org
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/