Hmm you mention skipping html to avoid buffer overflows? well adding another element will certainly increase the probability of buffer overruns, but HTML in itself is not more likely to contain buffer overflows than MIME is.. Often buffer overflows have been found in From:, To:, Date: fields etc.

In my opinion the only way to make systems more secure is to encapsulate the system more. It will for sure be slower, but you gain control by virtually controling everything in a sandbox before executing. Stack-guards can easily be implemented etc. Stupid users can be avoided, but their actions can be handled...

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/221/25186#25186