On Wed, Feb 04, 2004 at 03:09:31PM +0000, Chris Higgins wrote:
> Do we ? Are we not better to assume that 'untrusted' means
> just that - and not attribute more or less trust based on
> what we think the data is , isn't that one of the core problems
> in the MS Outlook mail client - it trusts the file-type
> information too much, and passes data onto a helper which
> ignores the file type information and works it out for itself
> and is then happy to act based on new information learned ?
i suppose i agree. the distinction exists because if i just execute
an attachment i sent it off unmonitored and unfettered (except by unix
uid and fs permission rules). if i open it, that means a program is
going to monitor and control what the attachment "does."
but different types of data take different amounts of effort to control
them. a pager might need to avoid certain terminal control chars. an
image viewer might need to avoid resource hogging issues. a postscript
viewer needs to avoid cpu sucking and dangerous postscript commands.
all of them must avoid buffer overflows and other security damaging
kevin at ie.suberic.net ....... financial math: if bill gates & 10,000 homeless
http://ie.suberic.net/~kevin/cgi-bin/blog .. guys are in a room, the average
net worth of each of them is over $1,000,000. now, why do you care what the
average bush tax "cut" was again? ........... http://www.deanforamerica.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 232 bytes
Desc: not available
Url : http://mail.linux.ie/pipermail/ilug/attachments/20040204/cf8ce6fc/attachment.pgp
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!