Re: Another new worm???

[edebill () MAIL PCORDER COM (Erik Debill)]

On Mon, Jun 26, 2000 at 09:23:53PM -0700, Blue Boar wrote:
> Someone had asked who uses the scripting features in e-mail clients.  If
> you count Notes, I've seen some fairly involved applications written in
> Notes.  An old employer of mine did their entire purchase order system
> in Notes.

Massive scripting combined with a very buggy client.  The features
that are /supposed/ to be there don't work reliably.  I can't imagine
they've done a good job with security.  The databases it uses to store
messages get corrupted regularly (mine just lost track of which of the
500 messages in my inbox had been read).

Don't forget that just about everything is also exposed through a web
interface - so you have an additional vector for doing bad things.
(Is it possible to create a message that appears substantially
different in the Notes client and via the web? Formatting changes.
Tables disappear.  Perhaps it would be possible to create messages
that read two different ways?)

Attacks on the replication facility would be interesting as well.
(This is a facility whereby a user can download a working copy of a
frequently used database to their local machine and then keep that
copy synchronized with the master - at the least creating
"interesting" things in the local copy would be fun.

Erik