"People running around bashing MS and Outlook" have a reason for doing so.
Have you already forgotten the VBS worm plague of 2000/2001? What software did they use? Let me give you a hint -- Outlook. If Microsoft would not allow its clients to be automated to such an extent, and then advertise it as a 'useful feature', we wouldn't have nearly as many problems as we do today. It's all because of Microsoft's MAPI that we do. I agree, some of the problem is user ignorance, but they aren't being taught the truth. What is the use of allowing a program to rifle through your contacts, and send the same message to all of them? None.
ISPs can only filter if a virus is known -- the first stages of any outbreak will be missed by ISPs. Frankly, I think attachments PERIOD aren't a good idea. But, things like the IMG tag DoS in HTML news can only be solved by eliminating HTML. Gradually, people will realize their mistakes with attachments. We have malicious stuff in HTML that people don't even realize they've been hit with. Case in point -- the infamous 'Scriptlet.TypeLib' exploit that led to Kak, and BubbleBoy.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/58/10551#10551