Bugtraq mailing list archives

Re: HTML email "bug", of sorts.


From: Alex Prestin <wakko () bitey net>
Date: Sun, 19 Aug 2001 16:19:12 -0400 (EDT)

On Sun, 19 Aug 2001, David F. Skoll wrote:

Use a non-HTML mail browser.  Also, write a script to call that URL with
thousands of bogus e-mail addresses to poison the spammer's database.


A lot of people have been suggesting this (and it's something I personally
already do), but this doesn't help people who use and prefer HTML-capable
clients.  Yes, HTML email is the scourge of the Internet and should be
banned in my opinion, but the fact of the matter is that more people have
it enabled now than not, and the cute little cards and pictures their
friends, family, and coworkers send them on personalized
"letterhead" isn't going to be convinced (and might not even be able to be
taught how) to turn off HTML.

What I was more interested in finding out is how admins and people who
*are* technically adept can filter these types of things out on a massive
scale (on their mailservers, for example) *without* affecting the delivery
of legitimate mail.  The problems I see with this approach are:

1) how do you determine what's legitimate HTML email and what isn't?  Can
pattern-matching of web bugs be as easy as "*.gif\?.*" or something
similar?

2) where is this type of filter ethically the right thing to do?  on a
server at work?  (I would think "yes".)   What if you work at an ISP?  (I
would be less inclined to think "yes" if I might somehow be restricting
the experience of paying customers.)  

Opt-out mail filtering might be a workable solution for those users not
wishing their emails to be tampered with in any way, as long as they know
the ramifications of that decision.  

- A.P.


Current thread: