From: Fred Maxwell <rockbox_at_anti-spam.org>
Date: Tue, 21 Oct 2003 12:31:21 -0400

> It's a disadvantage when one runs mutt on a shell because one
> does not like virii, html tracking codes in spam, and general
> mayhem allowed by html messages.

You don't want to go there with me. I've been technical lead on a project
to produce a commercial C2 secure network workstation, have been doing
computer/network security research and work this morning, and I know the
subject inside and out.

HTML does not have a way to spread computer viruses. You might be able to
use HTML to exploit some flaw in a particular client, but there is no HTML
mechanism to allow the silent installation or execution of code on a remote
system. If there were, viruses would be spread by simply visiting web pages
and the virus would affect an entire platform (e.g., Windows 2000)
regardless of which browser was being used. Nor does HTML allow "general
mayhem."

HTML tracking "codes" in Spam rely on poorly configured systems. Why would
you ever allow your e-mail client to make HTTP requests to untrusted web
servers based on receipt of e-mail from untrusted senders?

> Think about the
> possibility that the one person on earth who has the answer
> to your question is running UNIX mail(1) and can't read an
> html message at all. It's all about going to the lowest
> common denominator: text.

The text is still in English -- even if there are HTML tags interspersed
throughout, so it's not impossible to read HTML e-mail without an HTML
client.

*******************************************************************
Again, the answer is for the listserver to run stripmime.pl. It's silly to
expect hundreds of people on this (or any) mailing list to always remember
to post in plain text, without fail, especially when the most popular e-mail
clients ship with HTML e-mail on as the default.
*******************************************************************

Regards,
  Fred Maxwell
Received on 2003-10-21