Excerpts from direct: 31-Oct-91 Re: trojan horses in RFC XX.. Nathaniel
Borenstein(_at_)thu (506)
he says "If my friend sends me a program, it should
run." He ignores how esasy it is to forge mail in the current Internet
environment. As long as this is the case, his position invites
disaster, though I agree with it in principle.
Though I agree in principle with Nathaniel's position here, it is the
job of my mail software to tell me accurately from whom my mail was
sent! Failure to do so is a bug in some protocol. There is a decision
to make: how to live, given that such a bug exists, until the bug is
fixed. Weighing the expected cost against the expected benefit (not
*possible* cost -- living in earthquake land makes one aware of the
difference :-).
The important thing to realize is that there are shades of gray here,
and we should accommodate them. For example, if "sunsupport(_at_)parc" sends
me a script to run that purports to fix some bug, I generally check the
headers, then run the script. If "foo(_at_)some(_dot_)net(_dot_)address" sends
me a
script to run, I read the script first, and often don't run it. Of
course, in neither case do I want to say "Yes" (or "No") 100 times --
just once will *usually* suffice.
Bill