Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding issue

["Greg A. Woods" <woods@xxxxxxxxx>]

[ On Friday, September 17, 2004 at 14:08:33 (+0200), Borja Marcos wrote: ]
> Subject: Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047 
> encoding issue
>
>       If someone builds faulty software which generates bad MIME headers, 
> such messages should be treated as hostile messages and dropped. 
> Period.

You are 110% correct.

Thank you very much for saying that, and I would suggest that at the
current time it is something which cannot be repeated too many times.

Far too few software developers understand the idea of "failing safely".

Passing on "cleaned" or "de-fanged" messages is a guaranteed way of
failing catastrophically.

-- 
                                                Greg A. Woods

+1 416 218-0098                  VE3TCP            RoboHack <woods@xxxxxxxxxxx>
Planix, Inc. <woods@xxxxxxxxxx>          Secrets of the Weird <woods@xxxxxxxxx>