Re: How can I forward hyperlinks w/out visiting linked site (Outlook 2003)?
From: Steve Hull (msnnews.REMOVE_TO_REPLY_at_steve-hull.com)
Date: 08/30/04
- Next message: lvproductions: "Updated office 2000 to office XP and won't save sent e-mail addresses"
- Previous message: Andy Zhou: "Outlook2003 open and closed immediatly"
- In reply to: Milly Staples [MVP - Outlook]: "Re: How can I forward hyperlinks w/out visiting linked site (Outlook 2003)?"
- Messages sorted by: [ date ] [ thread ]
Date: Mon, 30 Aug 2004 16:05:21 -0400
On Sun, 29 Aug 2004 17:28:30 -0700, "Milly Staples [MVP - Outlook]"
<MillyS@donteventhinkaboutmailingmemvps.org> wrote:
>Sigh, where to begin.
>
>RBLs are useless and exist mostly to charge legitimate email users a fee to
>reinstate their mail address and remove it from the RBL. Check their use
>policies.
Oh, dear, let's begin with the basics, and walk you through this in
itty-bitty pieces:
If Blackhole Lists were useless, then nobody would use them, and
certainly nobody would pay them. In that case, they would just fade
away. I actually went and checked spamhaus.org and spamcop.net's
policies- did you, or did you just shoot from the hip? Neither
organization charges a fee to get removed from their lists. What is
their business model? Spamhaus is free if you want to link your mail
server to it unless you have a high-volume (like an ISP or a large
organization). Spamcop charges end-users a fee to have their email
filtered before it gets to their in-box. If you're downloading spam
over a cell-phone link to your pda/laptop, you really don't care if
Outlook puts it in your spam folder- you've already paid (in terms of
air time) to download the sucker.
Now, the fact that spamhaus is free to small organizations coupled
with the fact that they've been in business for several years suggests
that there are enough large corporations & ISPs paying their fees that
they can keep their doors open. Your opinion of the value of an RBL,
is not shared by these companies customers.
>
>Outlook blocking access and requiring YOU to specifically authorize it to go
>to the web page is NOT a security issue - it is a response to security that
>most people welcome. You tell me, how is Outlook supposed to magically pull
>the information out of its hat WITHOUT going to the web page? If it does
>not have to go there, then then information has been downloaded - how is
>that secure?
Whoa, Nelly! I never said anything of the kind. I started this
conversation off by saying Outlook did the right thing by blocking
access to embedded links when viewing mail from untrusted sources.
What Outlook does not do, and what I asked about, was why Outlook does
not block access to embedded links when forwarding an email from an
untrusted source. You then avoided answering my question by telling
me you thought I was wasting my time forwarding emails to report spam.
>
>Third, in no manner did I ridicule you - I just pointed out that reporting
>the addresses is mostly a waste of time as there IS no such domain as
>@adifajeitraewrh.com or whatever combination of letters you receive. They
>are spoofed, as are the headers and the IPs.
You may be an Outlook guru, but apparently you don't know diddly about
reading and tracing email headers. Of course, that's not entirely
your fault- Outlook intentionally hides the header info. And, it IS
time-consuming to check out each address in a long string of
addresses. Even though 99.99% of the spam has forged return
addresses, there really is a valid email address in all those headers
that identifies the site where the spam was introduced into the
system. Most of the time, that site is an open relay. Guess what:
there are even open relay lists that email servers can check to see if
an email is coming from a known relay point. And, for the most part,
it doesn't cost any money to use these lists, either.
You really should sign up for a free account at spamcop. Then, send
in one of your spam emails. Spamcop does a pretty amazing job of
decoding the email headers, and can automatically generate a complaint
to the proper party. Spamcop keeps track of how much spam is coming
from a particular site. ISPs watch these counters, and many of them
use the counters when they decide to block a host. I know you don't
believe in RBLs, but the spammers certainly do: Optinrealbig recently
sued Spamcop, claiming their right to free speech had been violated.
If Spamcop wasn't effective in stopping spam, Optinrealbig wouldn't
have bothered suing them.
>
>Do as you wish with your time and good luck finding new employment. As for
>how you spend your time, it is of no matter to me. I just know how I choose
>to spend my time, chasing my kitties and avoiding the inevitable ankle sneak
>attacks. Oh, and answering posts to the news groups, hopefully to a more
>grateful and less sensitive audience than this one.
Leaving aside your opinion of whether reporting spam is a waste of
time, or my opinon of cats, there is a serious issue here. There are
irrefutable facts: web bugs exist, they are implanted in a high
percentage of spam, they often contain code to verify your email
address, and Microsoft thought the problem was significant enough that
they put in protection against inadvertently activating them when
viewing your incoming email. I suggest to you that what they did was
admirable, but they didn't fix the entire problem. They also need to
protect against inadvertently activating web bugs in your outgoing
mail.
Steve Hull
>
>
>--?
>Milly Staples [MVP - Outlook]
>
>Post all replies to the group to keep the discussion intact. Due to
>the (insert latest virus name here) virus, all mail sent to my personal
>account will be deleted without reading.
>
>After searching google.groups.com and finding no answer, Steve Hull asked:
>
>| Yeah, since my programming job got offshored to India, I have nothing
>| better to do than play whack-a-spammer. Last year, my domain name was
>| used to spoof return addresses used in a LOT of spam (look up "Joe
>| Job"), so I had to do a lot of explaining to my ISP why they should
>| restore my service. Ever since then, I do tend to be more proactive
>| in the fight against spam. Most people are happy to have their email
>| automatically put in a spam folder and they just delete it. They
>| never think about the technology behind the process that determines
>| whether or not an email is spam. Ever hear of a Black Hole List?
>| RBL? Spamhaus? Most of the spam filters contact these sources to
>| validate (or invalidate) an email based on its source address. How do
>| these sources build their databases of spam sources? When people
>| report spam to them. (To be fair, they probably get more input from
>| honeypots.) Cloudmark, Bright Mail, and many other HUGE anti-spam
>| software products depend on their user base reporting spam back to a
>| central site where adaptive filters get created as soon as the spam is
>| reported.
>|
>| All that has nothing to do with the fact that there is no good reason
>| why Outlook HAS to visit an URL before forwarding the email on. I
>| have pointed out a legitimate security concern, and asked how to
>| address the issue. You have responded by ridiculing my reasons for
>| wanting the activity blocked rather than focusing on the problem.
>| Perhaps that kind of attitude is why Outlook has had so many security
>| issues in the first place.
>|
>| -Steve Hull
>|
>|
>|
>| On Sat, 28 Aug 2004 17:25:19 -0700, "Milly Staples [MVP - Outlook]"
>| <millys@donteventhinkaboutmailingmeatmvps.org> wrote:
>|
>|| No, Outlook will always need to go out to retrieve the missing
>|| infomration from blocked mails. You must have a lot of time on your
>|| hands to send all the spoofed email to abuse organizations. Most of
>|| this stuff is so faked (headers, IPs, mailing addresses) that the
>|| only people who are affected are those who have had their address
>|| used by the spammer.
>||
>|| --?
>|| Milly Staples [MVP - Outlook]
>|
>||
>|| After scratching one's head,
>|| Steve Hull <msnnews.REMOVE_TO_REPLY@steve-hull.com> asked this group:
>||| Like everybody else, I receive my share of spam, including the
>||| phishy variety. When I get a spoofed email, I like to forward it
>||| on to uce@ftc.gov, spamcop, and any admin of a site victimized by a
>||| phishing exploit. For any of these sites to track down the source,
>||| they need
>||| the full, unmodified email, just as I received it.
>|||
>||| If I receive an email from an untrusted source, Outlook does the
>||| right thing by not displaying any hyperlinked info in the preview
>||| pane. However, if I try to forward an email with hyperlinks,
>||| Outlook wants
>||| to go to the spammer's website, download whatever treat the spammer
>||| has waiting for me, and insert it in my forwarded message. (Not to
>||| mention that the spammer could use the fact that I visited his
>||| website to validate my email address.)
>|||
>||| I really, really, don't like this behavior. If there's a way to
>||| configure Outlook to forward exact copies of an email (and leave the
>||| hyperlinks alone), I'd sure like to know about it.
>|||
>||| Can anyone help me figure this out?
>|||
>||| Thanks,
>|||
>||| - Steve
>
- Next message: lvproductions: "Updated office 2000 to office XP and won't save sent e-mail addresses"
- Previous message: Andy Zhou: "Outlook2003 open and closed immediatly"
- In reply to: Milly Staples [MVP - Outlook]: "Re: How can I forward hyperlinks w/out visiting linked site (Outlook 2003)?"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
