Re: Security

New Message Reply About this list Date view Thread view Subject view Author view

From: Kai Henningsen (kaih@khms.westfalen.de)
Date: Sun Mar 11 2001 - 13:44:00 CST


chl@clw.cs.man.ac.uk (Charles Lindsey) wrote on 05.03.01 in <G9q3Ds.DK1@clw.cs.man.ac.uk>:

> In <86snkw1dh2.fsf@animal.interhack.net> Matt Curtin
> <cmcurtin@interhack.net> writes:
>
>
> >>>>>> "Charles" == Charles Lindsey <chl@clw.cs.man.ac.uk> writes:
>
> > Charles> Many have argued that "spam", massively crossposted or
> > Charles> multiposted articles
>
> >Isn't spam specifically massively multiposted? I thought we were more
> >pedantic than to include massively crossposted articles under that
> >definition. (It's an annoyance, for sure, but one cancel will kill
> >it, and even remotely modern user agents will not show the article
> >once it's been seen...)
>
> The consensus seems to be that corssposting also counts as spam, but the
> square root as much as multiposting (Bredbart index, and all that).

That is a consensus I am definitely not aware of. Massively crossposted
stuff is sometimes called "velveeta"; calling it spam tends to get
corrections at least in news.*.

Please completely take out crosspostings from that part. They do not
belong there.

> >This is all true and highly applicable right now, but I would prefer
> >to see this generalized. The reason is that the direction of HTML is
> >_away_ from such things as APPLET, IMG and similar cruft, toward a
> >generalized OBJECT. I think it sufficient to say
>
> Hmm! I'll believe that when I see it. I guess the dreaded Java[script] is
> going to be hanging around the web for quite a few years to come :-( .

He's talking about syntax. OBJECT does all of these things, plus ActiveX
and whatever crap people come up with next; but at least it has a halfway
sane syntax and you don't get a new variant for any new stuff.

> >Having said all of that, I'm also hesitant to go so far as to say that
> >executable code us unlikely to have a valid application in Netnews. I

I'd go so far and make that "extremely unlikely". I can think of no good
reason to have such code; anything I can think of is a giant gaping
security hole, *and* I can think of a better solution for every such case,
even ignoring "just don't do that" which will often be right.

Well, except for the case of wanting to attack someone's computer.

MfG Kai


New Message Reply About this list Date view Thread view Subject view Author view


This archive was generated by hypermail 2b29.