# Re: Predraft of a new URL scheme: mailmsg

Marc VanHeyningen (mvanheyn@cs.indiana.edu)
Wed, 04 Jan 1995 07:57:12 -0500

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Dirk Herr-Hoyman: "Re: Predraft of a new URL scheme: mailmsg"
- Previous message: Larry Masinter: "Re: Predraft of a new URL scheme: mailmsg"
- In reply to: Rob Raisch: "Re: Predraft of a new URL scheme: mailmsg"
- Next in thread: Paul Hoffman: "Re: Predraft of a new URL scheme: mailmsg"

    To: raisch@internet.com

    Subject: Re: Predraft of a new URL scheme: mailmsg

    In-Reply-To: Your message of "Tue, 03 Jan 1995 16:18:44 EST."

                 <199501032117.AA23831@ahhh.internet.com>

    Date: Wed, 04 Jan 1995 07:57:12 -0500

    Message-Id: <23365.789224232@silky.cs.indiana.edu>

    From: Marc VanHeyningen <mvanheyn@cs.indiana.edu>

> Since URLs are hardly something which the casual user might have
>
> - an overriding interest in
>
> - an appreciation of the consequences of
>
> - comprehensive knowledge of
>
> I would politely suggest that this is a bad idea. For a more in depth
> explanation of the inadvisability of this URL scheme please see:
>
> <mailmsg:president@whitehouse.gov//Death Threat/I'm gonna git you sucka>

This is, of course, a serious concern. As Larry pointed out, similar
concerns also exist for the gopher: URL, since it can be used to spoof
mail messages in less obvious ways.

You'll have to forgive me for noting the incredible irony of this, considering
your past messages to the effect that my noting this security hole was just
"bull". Always good to see someone see the light. :-)

The solution to the gopher problem has generally been to restrict the
functionality so that the SMTP trick won't work (though some WWW browsers,
including a very popular one whose name starts with "N", are vulnerable to
this hole.)

I think it's quite reasonable for software to understand enough about mail
to prompt the user with the content of the message; most users can be
expected to be sophisticated enough to look at a message and figure out if
it's obviously dangerous or illegal. I think there should be a way to
specify a mail message in a URL, and that that's a functionality which
MIME message/external-body has had over URLs for a while.

What's important is to avoid the situation where users are asked something
they can't be reasonably expected to understand, like "Is it OK if I open
a connection to port 25 of 198.137.240.100?"

- Marc

- Next message: Dirk Herr-Hoyman: "Re: Predraft of a new URL scheme: mailmsg"
- Previous message: Larry Masinter: "Re: Predraft of a new URL scheme: mailmsg"
- In reply to: Rob Raisch: "Re: Predraft of a new URL scheme: mailmsg"
- Next in thread: Paul Hoffman: "Re: Predraft of a new URL scheme: mailmsg"