cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1995-10-18 - Postscript in Netscape

Header Data

From: fc@all.net (Dr. Frederick B. Cohen)
To: jsw@netscape.com (Jeff Weinstein)
Message Hash: 90aabcce64fd32413baec2be0f712a17f8325db37eb799fb3149a98c7aa7f6a3
Message ID: <9510181156.AA11525@all.net>
Reply To: <3084DD5B.4AD1@netscape.com>
UTC Datetime: 1995-10-18 11:59:14 UTC
Raw Date: Wed, 18 Oct 95 04:59:14 PDT

Raw message

From: fc@all.net (Dr. Frederick B. Cohen)
Date: Wed, 18 Oct 95 04:59:14 PDT
To: jsw@netscape.com (Jeff Weinstein)
Subject: Postscript in Netscape
In-Reply-To: <3084DD5B.4AD1@netscape.com>
Message-ID: <9510181156.AA11525@all.net>
MIME-Version: 1.0
Content-Type: text


Jeff Weinstein - Electronic Munitions Specialist Wrote:

...
>   If a user configures a postscript viewer that has not had the
> file operations disabled as a helper app to any web browser then
> they are opening themselves up for a world of hurt.  The same is
> true if they just download the file and run their viewer on it
> manually.  The same is true if they configure /bin/sh as an
> external viewer.
> 
>   Obviously everyone should heed perry's warnings and emasculate
> their postscript interpreters before using them to view files
> of unknown origin.

WRONG!!! Netscape claims to be "secure" - hence it is Netscape's job to
be secure - regardless of the user's use of their product.  Otherwise,
the ads should read:

	"Netscape can be used securely by sufficiently knowledgeable
	users who have emasculated their postscript interpreters before
	using them to view files of unknown origin, and who have removed
	all other known, unknown, and/or undisclosed security holes from
	their systems.  Otherwise, Netscape is insecure and should not be
	trusted."

-- 
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

Thread