Re: VIRUS WARNING

2000-05-11 Thread Steven M. Bellovin
In message <[EMAIL PROTECTED]>, Einar Stefferud writes: > >The first of these "worm/virus/addressbookmailers" was the IBM PROFS >"Chrismas Card" caper that occurred some time in the early 1990's, >long before MS willfully adopted the design. It was in December, 1987. > >Seems to me that this bel

Re: Wireless LAN experiences from the IETF meetings?

2000-05-11 Thread Mark Prior
We are investigating the deployment of a wireless LAN infrastructure (IEEE 802.11) for our building and were hoping to tap into past experiences from wireless LAN deployments at the IETF meetings. Are there any documents online that present "guidelines" for deployment of w

RE: VIRUS WARNING

2000-05-11 Thread Castro, Edison M. (PCA)
That is exactly the same way that all Windows virus work. As a Windows user (as well as other OSes), I can say that people have to be responsible for their actions. Whenever you receive any Email attachment, the only way that attachment can produce any damage is if you run it. At least in my c

Re: Wireless LAN experiences from the IETF meetings?

2000-05-11 Thread Anders Lund
> On Tue, 9 May 2000, "Fred" == Fred L. Templin wrote: Fred> We are investigating the deployment of a wireless LAN Fred> infrastructure (IEEE 802.11) for our building and were hoping Fred> to tap into past experiences from wireless LAN deployments Fred> at the IETF meetings. Are ther

Thought about Security

2000-05-11 Thread Betsy Brennan
I was wondering, does it sound like a good idea to take [EMAIL PROTECTED] out of our address books. This would prevent email virus's from spreading through this forum. Betsy Brennan

Re: VIRUS WARNING

2000-05-11 Thread Valdis . Kletnieks
On Thu, 11 May 2000 08:24:11 EDT, "Castro, Edison M. (PCA)" said: > That is exactly the same way that all Windows virus work. As a Windows > user (as well as other OSes), I can say that people have to be responsible > for their actions. Whenever you receive any Email attachment, the only way >

RE: VIRUS WARNING

2000-05-11 Thread Scot Mc Pherson
I believe the one of the most important holes is html based mail, because the e-mail is processed as a webpage which can be used to download undesirable content. If you configure your e-mail browser to display all messages as text you will close this hole...You will notice my e-mails are nearly 10

RE: VIRUS WARNING

2000-05-11 Thread Vernon Schryver
> From [EMAIL PROTECTED] Thu May 11 06:36:01 2000 > From: Steven M. Bellovin [mailto:[EMAIL PROTECTED]] > ... > > Note the two crucial points -- it ran with the user's permissions, and > > it was explicitly run by the user, rather than by any automatic > > mechanism. > From: "Castro, Edison M

Re: VIRUS WARNING

2000-05-11 Thread Dennis Glatting
Scot Mc Pherson wrote: > > I believe the one of the most important holes is html based mail, because > the e-mail is processed as a webpage which can be used to download > undesirable content. If you configure your e-mail browser to display all > messages as text you will close this hole...You wi

Any comparison Study on MGCP vs H.323, MGCP vs SIP

2000-05-11 Thread Yixin Zhu
Hi, There are studies on the comparision of the two competing protocol SIP and H.323. However, MGCP can also provide call control functionalities. A network with MGCP only (Call agent, MG etc) can provide basic VoIP service too. Then my questions are 1. Are there any comparison study between MGC

RE: VIRUS WARNING

2000-05-11 Thread Lillian Komlossy
Scot, While what you say is true - meaning an all-text restriction on your email browser will prevent "dangerous goods" to be downloaded - it also takes away functionality. We have to find a way to be able to use html based email but restrict it from - say running scripts, executing anything, wri

RE: VIRUS WARNING

2000-05-11 Thread Vernon Schryver
> From: Lillian Komlossy <[EMAIL PROTECTED]> > While what you say is true - meaning an all-text restriction on your email > browser will prevent > "dangerous goods" to be downloaded - it also takes away functionality. We > have to find a way to > be able to use html based email but restrict it fr

Re: VIRUS WARNING

2000-05-11 Thread John Stracke
Lillian Komlossy wrote: > We > have to find a way to > be able to use html based email but restrict it from - say running scripts, > executing anything, > writing cookies, issuing queries, etc... So turn off JavaScript for mail messages. -- /=

Postmortem of ILU to the ietf+censored list

2000-05-11 Thread Harald Tveit Alvestrand
I've checked the logs for the ietf+censored list after the recent ILU virus that was sent to the list, 3 days after the initial release of the virus. 25-30 recipients (out of 147) rejected the message. Many more probably just caught it and deleted it. People are quick to install filters. What'

Re: Wireless LAN experiences from the IETF meetings?

2000-05-11 Thread Fred L. Templin
Many thanks to all who have replied to my inquiry regarding Wireless LAN experiences from the IETF meetings. The responses have been very helpful and greatly appreciated. Fred Templin [EMAIL PROTECTED]

Mafiouso Hits Back!

2000-05-11 Thread Mafiouso
$ Hey! $ Check Out This Page: http://mafiouso5.tripod.com $ Everything You Want Mp3s, Pictures, Movies, Hacking, Cracking What Ever Your After, You Will Find It Here. $ Want a HOT Christina Aguilera Background For Your PC $ Just Goto The Link Below And Right Click, Then `

RE: VIRUS WARNING

2000-05-11 Thread Scot Mc Pherson
Lillian, I am not so sure I totally agree. Why exactly do we need HTML based e-mail...Is it really necessary? E-mail is a service for transmitting a written message, and written messages certainly don't require background graphics or a full blown graphically based webpage. There a

Re: VIRUS WARNING

2000-05-11 Thread Valdis . Kletnieks
On Thu, 11 May 2000 13:59:19 EDT, Scot Mc Pherson said: > There is no practical need for html e-mail. It like saying I want to use a > tractor trailer to commute to work everyday, but it needs to consume only as > much gas as an eco car, and go as fast a Ferrari. If the computer industry ad

Re: Mafiouso Hits Back!

2000-05-11 Thread Valdis . Kletnieks
On Fri, 12 May 2000 03:25:27 +1000, Mafiouso <[EMAIL PROTECTED]> said: >Everything You Want Mp3s, Pictures, Movies, Hacking, Cracking > What Ever Your After, You Will Find It Here. Kinda like advertising moonshine at the ATF agent's convention, isn't it? Although it's certainly not evidenc

RE: VIRUS WARNING

2000-05-11 Thread Lillian Komlossy
Scot, ITA we do not need the HTML email for our everyday use. HTML based email is mainly used by the Email-Newsletter companies, (i.e. Whitehat, Exactis, etc...) especially for advertising purposes. We can argue that we don't need it but in reality, these companies live off the daily newsletter

RE: VIRUS WARNING

2000-05-11 Thread Jacob Palme
At 10.11 -0600 0-05-11, Vernon Schryver wrote: > Once you restrict > HTML based email enough to be safe, why bother with anything more than > text and perhaps simple pictures? What is wrong with that. I use HTML-based e-mail mostly to inluce pictures in my messages. A very useful way of using HT

RE: VIRUS WARNING

2000-05-11 Thread Scot Mc Pherson
Lillian, Those newsletters that you have spoken of can quite easily be distributed in text format with the standard html tags that are used in text based messages already. Notice my sig has the standard mailto and http tags which can be recognized by the e-mail browser ("Note this is a tex

Re: VIRUS WARNING

2000-05-11 Thread Valdis . Kletnieks
On Thu, 11 May 2000 15:04:48 EDT, Scot Mc Pherson <[EMAIL PROTECTED]> said: > The necessity to send e-mail in html is NOT. Regardless of whether a list > or commerce wishes to advertise through e-mail, there are already avenues > for distributing material to demographically selected individ

Re: VIRUS WARNING

2000-05-11 Thread Michael H. Warfield
On Thu, May 11, 2000 at 08:36:52PM +0200, Jacob Palme wrote: > At 10.11 -0600 0-05-11, Vernon Schryver wrote: > > Once you restrict > > HTML based email enough to be safe, why bother with anything more than > > text and perhaps simple pictures? > What is wrong with that. I use HTML-based e-mail m

Re: VIRUS WARNING

2000-05-11 Thread John Stracke
Vernon Schryver wrote: What good is HTML based email if it cannot run scripts or even contain links to other HTML content? Well, there's basic formatting: Simple font variations (italics, bold, color, font) are an easy way to add a bit of expressiveness to your text. Everybody says that the

mail sandbox wall authority, inward and outbound

2000-05-11 Thread James P. Salsman
A MUA might ask the console operator for permission to proceed when: 1. A mail message wants to run a program. (e.g., ECMAscripts.) 2. An attachment is executable. (Nearly universal practice.) 3. A program wants to write to a file. (Usually not trapped more than once per execution if at all.

RE: VIRUS WARNING

2000-05-11 Thread Scot Mc Pherson
strictly speaking the US postal service is not a form of electric or electronic data communication strictly speaking...my sig IS plain text...it is the browser that recognizes that it could be used as a link Strictly speaking RFC2046, section 4.1.3 says pretty specifically: 4.1.3. Plain Subty

Re: WORM WARNING

2000-05-11 Thread Jon Crowcroft
if once it was a virus which it wasnt it surely is a worm now of course, microsoft have succeeded beyond david tenenhouses wildest dreams in active network deployment :-| j.

Re: VIRUS WARNING

2000-05-11 Thread Einar Stefferud
>From Steven M. Bellovin's message Thu, 11 May 2000 07:40:26 -0400: } }In message <[EMAIL PROTECTED]>, Einar Stefferud writes: } [snip]... } }>Seems to me that this beloved "feature" (giving root privs to random }>EMail messages) should (by now) now be fully discredited, and should }>be destined f

RE: VIRUS WARNING

2000-05-11 Thread Doug Sauder
> -Original Message- > From: Castro, Edison M. (PCA) [mailto:[EMAIL PROTECTED]] > That is exactly the same way that all Windows virus work. As a Windows > user (as well as other OSes), I can say that people have to be > responsible > for their actions. Whenever you receive any Email

Re: mail sandbox wall authority, inward and outbound

2000-05-11 Thread Leonid Yegoshin
>From: "James P. Salsman" <[EMAIL PROTECTED]> > >A MUA might ask the console operator for permission to proceed when: > >1. A mail message wants to run a program. (e.g., ECMAscripts.) > >2. An attachment is executable. (Nearly universal practice.) > >3. A program wants to write to a file. (Usual

Re: mail sandbox wall authority, inward and outbound

2000-05-11 Thread James P. Salsman
Leonid, Thanks for your addition: > 6. A program wants to send a file to somewhere. Or any permanently stored >information (like cookie but not limited). Yes: Browser operators may not want to send their files, recordings, pictures, video, or other device inputs to arbitrary sites without

Re: VIRUS WARNING

2000-05-11 Thread Vernon Schryver
> From: John Stracke <[EMAIL PROTECTED]> > --95872F20B70C837D61220742 > Content-Type: text/plain; charset=us-ascii > Content-Transfer-Encoding: 7bit > > Vernon Schryver wrote: > > > What good is HTML based email if it cannot run > > scripts or even contain links to other HTML content?

RE: Any comparison Study on MGCP vs H.323, MGCP vs SIP

2000-05-11 Thread Hubert Chang
Yes, I need this comparison too, please help. Hubert Chang -Original Message- From: Yixin Zhu To: [EMAIL PROTECTED] Sent: 5/11/00 10:55 AM Subject: Any comparison Study on MGCP vs H.323, MGCP vs SIP Hi, There are studies on the comparision of the two competing protocol SIP and H.323. H

Re: VIRUS WARNING

2000-05-11 Thread Michael H. Warfield
On Thu, May 11, 2000 at 06:48:37PM -0600, Vernon Schryver wrote: [...] > All of that can be done in pure ASCII. > You don't have to be Shakespear to communicate with the written word > without more punctuation than existed in 1960. There was no global plague > in 1970 that damage all

Re: mail sandbox wall authority, inward and outbound

2000-05-11 Thread Harald Tveit Alvestrand
At 13:10 11.05.2000 -0700, James P. Salsman wrote: >These sorts of things are less common on the more heterogeneous >Unix world, but Unix mailers are just as culpable. If I wanted to >be consistent, I would demand that anything I run on Unix (without >a special permitted shell) which connects to