| Monday, November 4, 2002 |
18:30 - DMCA Breach in Progress
|
(top)  |
Let's take a look under the hood of a certain recent e-mail message, shall we?
The following is an e-mail sent from within an enterprise, by a user running Outbreak-- 'scuse me, Outlook, to an Exchange server, destined for another employee accessing that Exchange server via IMAP. This is how the message-- a multi-part message with a Base64 attachment, which I will abbreviate with an ellipsis-- appears in the recipient's e-mail program. Only the names and addresses have been changed to protect the innocent.
From someone@somecompany.com Mon Nov 4 17:33:56 2002
Received: by exchange.somecompany.com
id <01C2846B.5133FFA0@exchange.somecompany.com>; Mon, 4 Nov 2002 17:33:17 -0800
Return-Receipt-To: "John Doe" <someone@somecompany.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----_=_NextPart_001_01C2846B.5133FFA0"
Disposition-Notification-To: "John Doe" <someone@somecompany.com>
X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
content-class: urn:content-classes:message
Subject:
Date: Mon, 4 Nov 2002 17:33:17 -0800
Message-ID: <6107F196AD71B94CB77452F9405ADAAA0FB262@exchange.somecompany.com>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Thread-Index: AcKEa1AiOXXxBet6QYeLMP3WUZ0HnQ==
From: "John Doe" <someone@somecompany.com>
To: "Joe Recipient" <recipient@somecompany.com>
This is a multi-part message in MIME format.
------_=_NextPart_001_01C2846B.5133FFA0
Content-Type: multipart/alternative;
boundary="----_=_NextPart_002_01C2846B.5133FFA0"
------_=_NextPart_002_01C2846B.5133FFA0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<<08250206.txt>>=20
"The only place where success comes before work is in a dictionary." - =
Vidal.
------_=_NextPart_002_01C2846B.5133FFA0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
6.0.6249.1">
<TITLE></TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT FACE=3D"Arial" SIZE=3D2 COLOR=3D"#000000"> =
<<08250206.txt>> </FONT>
</P>
<P><I><FONT SIZE=3D2 FACE=3D"Times New Roman">"The only place where =
success comes before work is in a dictionary." - Vidal.</FONT></I>
</P>
</BODY>
</HTML>
------_=_NextPart_002_01C2846B.5133FFA0--
------_=_NextPart_001_01C2846B.5133FFA0
Content-Type: text/plain;
name="08250206.txt"
Content-Transfer-Encoding: base64
Content-Description: 08250206.txt
Content-Disposition: attachment;
filename="08250206.txt"
UGFja2V0U2hhcGVyIHY2LjAuMGQxNDZYcnZhcmllciAyMDAyLTA4LTI1IDEyOjQ2IGRiZywNCmRp
ZWQgb24gU3VuIEF1ZyAyNSAwMjowNjozMyAyMDAyIFBEVCAoTG9zQW5nZWxlcykNCiAgICAgICAo
U3VuIEF1ZyAyNSAwOTowNjozMyAyMDAyIEdNVCkNCm1vZGVsIDQ1MDAgKHJldiBBKSwgcy9uIDA0
NS0xMDAwMDQzOCwgc2hhcGluZzpPTiANCkNQVSBCcmFuZDogR2VudWluZUludGVsICBTcGVlZDog
NDk5IE1IeiAobWVhc3VyZWQpDQpNZW1vcnk6IDI1NiBNQg0KDQpGaXJtd2FyZTogIHYyLjBnMiwg
Q29weXJpZ2h0KGMpIDIwMDAgUGFja2V0ZWVyLCBJbmMuDQoNClJ1bm5pbmcgVGFzazogSHZFZA0K
DQowMDEgWzAwMDAwMDEuMDAwMF0gVzogQ2hhbmdlIHRpbWVyLSAxMCBwZXIgbXNlYywgdGljayBp
bmNyID0gMQ0KMDAyIFswMDAwMDAxLjAwMDBdIGluIGZpcnN0VGFza1N0YXJ0Q2FsbG91dA0KMDAz
IFswMDAwMDAyLjQ4NDNdIFc6IGNmZ0ZpbGVzRGlmZjogY29tcGFyaW5nIDMyIGJ5dGVzICg5LjI1
Ni9DRkcvQkFTSUMuQ0ZHLDkuNTEyL0NGRy9CQVNJQy5DRkcpDQowMDQgWzAwMDAwMDIuNDg2OV0g
[...]
MDAwMDAwMCAwMDAwMDAwMCAwMDAwMDAwMCAwMDAwMDAwMCAgLi4uLi4uLi4uLi4uLi4uLi4uLi4N
CjB4MDNiNjA0YjQ6IDAwMDAwMDAwIDAwMDAwMDAwIDAwMDAwMDAwIDAwMDAwMDAwIDAwMDAwMDAw
ICAuLi4uLi4uLi4uLi4uLi4uLi4uLg0KMHgwM2I2MDRjODogMDAwMDAwMDAgMDAwMDAwMDAgMDAw
MDAwMDAgMDAwMDAwMDAgMDAwMDAw
Notice anything.... strange about this message?
If you're at all familiar with the raw-source structure of MIME messages, you will. I'll give you a hint: a proper MIME-encoded message would be a little bit longer.
There is no MIME separator at the end of the encoded attachment. It just breaks off. There should be a ------_=_NextPart_001_01C2846B.5133FFA0-- after the end of the encoded section, symmetrical with the one at the beginning of that block. But there isn't.
This means the attachment does not show up in any e-mail client that properly parses MIME. (Of course, it shows up just fine in Outlook, which doesn't give a rat's turd about requiring things like </TABLE> tags or closing MIME separators.)
This problem occurs whenever a user sends a message via Outlook to an Exchange server, and the recipient retrieves the message via IMAP. It doesn't happen if the recipient uses POP3, nor if the recipient is on a remote server to which the message must be relayed via SMTP.
Because, you see, Outlook communicates with Exchange in an internal DCOM-based proprietary Microsoft format. I'm sure it's very nice, and provides all sorts of nice features and hooks for Exchange to handle the message with, and it makes things nice and smooth when Outlook clients retrieve the message via IMAP.
But if Exchange has to relay the message on via POP3 or SMTP, it must translate it from its internal format to the standard mail format. The bitch of it is that it uses an entirely different rendering engine to serve the message to an IMAP client than to convey it via POP3 or SMTP. The internal structure of the message is totally different depending on what protocol you're using to access it.
And the IMAP translator is broken. People using IMAP, and clients other than Outlook, are out of luck when it comes to attachments, because whoever wrote this brain-dead translator apparently didn't allocate a big enough buffer for the message or something, or simply didn't bother to emit the closing separator because hey, Outlook doesn't require it-- and it just cuts the hell off.
You know, I have had it up to here with this crap. The software Microsoft produces is utter garbage, and it actively deters customers from doing work. This isn't a tool, it's an impediment-- and whoever is responsible for writing it, if there were such a thing as certification for software engineers, should be stripped of his or her credentials.
Those who promote Microsoft as some kind of paragon of software design and recommend it as a provider of mission-critical enterprise-class software-- this kind of incompetence is what these people are endorsing. This is the mediocrity to which we're condemning ourselves by not demanding that software be held to a higher standard than the bare-assed minimum that can be sold to the unsuspecting, overworked IT manager and the petty corporate bean-counter.
Some companies have already had to pay for this kind of negligence. Motorola, for the better part of the year 2000, had no e-mail at all because their Exchange server went completely belly-up-- and the Microsoft experts who they'd hired to come out and work on it full-time were unable to fix it for months on end. No internal e-mail communications. None. All because someone decided that Microsoft is the Way, and that anybody who doesn't go with the flow is just building sand castles while the tide comes in.
These kinds of stories are going to get more frequent, too-- not less. Sooner or later the failure will be quite catastrophic, and we'll weep for deliverance.
But by that time it will be far, far too late.
Thank you very much, Your Honor.
|
|
