From: Chris Holt <amiga2k_at_cox.net>
Date: Tue, 21 Oct 2003 15:36:24 -0400

On Tue, 21 Oct 2003 12:31:21 -0400, Fred Maxwell wrote:

> You don't want to go there with me. I've been technical lead on a
> project to produce a commercial C2 secure network workstation, have
> been doing computer/network security research and work this morning,
> and I know the subject inside and out.
>
> HTML does not have a way to spread computer viruses. You might be able
> to use HTML to exploit some flaw in a particular client, but there is
> no HTML mechanism to allow the silent installation or execution of code
> on a remote system. If there were, viruses would be spread by simply
> visiting web pages and the virus would affect an entire platform (e.g.,
> Windows 2000) regardless of which browser was being used. Nor does
> HTML allow "general mayhem."

I would think the problem is solved for all by going back to the good old
RFCs (does anyone remember those???) Regardless of it's benign nature or
danger to stoopid clients, if the HTML is an attachment or part of a
multipart MIME message IAW the RFCs, it is much easier for everyone to
deal with.

That said, it really shouldn't be that hard to "do it right". Hell, even
Eudora Mail on my Palm handles HTML in the body of a message pretty well.

Chris
Received on 2003-10-21