Friends dont send friends HTML email!: wired
Submitted by charlie.collins on Tue, 02/06/2001 - 22:43
Tagged:
I just ran across an article on Wired (one of the new TotSP sources) that is in complete concert with what I have been preaching for a few years. DONT send HTML or Javascript EMAIL.
I was not explicitly aware of the exploit that Carl Voth had exposed in mail readers that enable this by default (OUTLOOK and NS6.) This is the crux of the article and has garnered a lot of attention lately. However I was aware that this is VERY ANNOYING and that security problems abound with it. What I mean is that while NO email is really secure in any way (unless encrypted but some means) HTML based email and Javascript opens up an entire Pandoras box if possibilities not just viewing email content. Its stupid and insecure and many people DO NOT use HTML email readers or trash messages that contain Javascript-HTML by default (yours truly.) There a thousand Javascript based exploits from simple denial of service to malicious fake prompts and or redirects, just all sorts of problems.
Here is my simple credo that applies to web apps and email, whatever, "client side BAAAAD!" (With the hand swipe like the Hetfield Napster cartoon.)
Sending people Javascript email is offensive (and recruiters do it to me constantly, "fill out this form", uh, yeah, right away) and potentially dangerous. For that matter Javascript at all is BAAAAD whenever something can be done server side (back to my credo.) Send the people a link back to a web page, dont send them HTML or Javascript email.
Mini Javascript RANT (or more of it)
<rant>
Javascript in general is also BAAAAD! NEVER put some Javascript on a web page that is critical to the page (ie use it for rollovers and that crap if you must, but CSS is better, or where programming for multiple possibilites and checking for its presence with an alternative if it is absent-disabled.) Pages that rely on Javascript exclusively for form validation or navigation or application features are stupid (they are generally NOT ECMAscript compliant and wont work in real browsers, Opera, NS6, Lynx, etc.) NEVER do on the client side what should be done on the server side. If you have a form to validate, then validate it, but not with something I can disable. The web full of very sloppy Javascript (and admittedly, I have learned this the HARD way) that breaks client browsing requests, wont work in many major browsers and makes for a sloppy application (imagine the data if I can still submit the form with crap in it just by disabling my Javascript.)
</rant>
Firends dont send friends email: wired







Comments
Re: Friends dont send friends HTML email!: wired
Re: Friends dont send friends HTML email!: wired
Re: Friends dont send friends HTML email!: wired
Re: Friends dont send friends HTML email!: wired