--On Friday, August 07, 2009 06:01 -0400 Rich Kulawiec
<rsk(_at_)gsp(_dot_)org> wrote:
On Fri, Jul 31, 2009 at 02:36:31AM +0400, Cheney, Edward A SSG
RES USAR USARC wrote:
The idea is that security vulnerabilities on the internet
occur most significantly as a result of client-side scripting
from documents transmitted across HTTP.
Even we grant for the purpose of argument that these are the
"most significant", and I see no evidence that they are, these
are not Internet security vulnerabilities.
These are (a) web browser and (b) operating system
vulnerabilities, and are quite readily mitigated by making
sensible choices about both. Further mitigation is possible by
using in-band filtering/blocking (such as HTTP proxies which
filter or block traffic) or by using browser extensions (e.g.,
NoScript). These are much simpler and directed solutions that
are available immediately, without any need for protocol
engineering.
If, on the other hand, poor choices of web browser and/or
operating system (or mail client, for that matter) are made,
then it really doesn't matter whether traffic moves via HTTP
or SMTP or anything else: those systems WILL be compromised.
...
Reinforcing this point, I note that there are several MUAs that
interpret HTML in a very limited environment, preventing
execution of scripts, web bugs, etc., rather than
indiscriminately invoking full browsers each time an HTML
message comes in. And, as Rich points out, those precautions do
not require protocol engineering, much less convincing those who
develop and send messages to adopt different tools and
procedures.
john