Re: javascript in thunderbird 3

der Mouse wrote:
>>> Allowing javascript in email is risky anyway.  [...]
>> [javascript danger is at the proof-of-concept stage]
>> Yet, on the flip side of the coin, I can point to over a 100,000
>> reasons (viruses/trojans/malware) that you are susceptable to if you
>> open attachments.
> 
> Only if you insist on using Windows, which is basically like wandering
> around the wrong side of town blindfolded as far as security goes.
> 
> Javascript is approximately equally dangerous everywhere.
> 
>> Yet the developers are NOT making opening attachments impossible!
> 
> Yes, I don't entirely understand that.  But I don't see what that has
> to do with javascript; just because there's danger X doesn't mean that
> blocking danger Y is a bad idea.  If you think attachments are a worse
> danger, do please feel free to campaign for their elimination.
> 
> Not that it matters to me; I don't auto-execute live content of any
> sort in email, and don't "open" attachments, ever.  (I do sometimes
> look at them - with command-line tools, on machines that aren't even
> x86, much less x86 running malware propagation tools masquerading as
> operating systems.)
> 
> /~\ The ASCII				  Mouse
> \ / Ribbon Campaign
>  X  Against HTML		[email protected]
> / \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B


Lets see.
There are 100,000 reasons to make opening attachments impossible
including some that have infected 30 million users and caused 6 billion 
dollars in damage.

But
There are perhaps 33 or so Javascript exploits that could have been used 
at one time in Thunderbird, with no record of any of them having been 
used at all (in the wild)

So lets block Javascript! It's DANGEROUS!

But of course we can let Thunderbird OPEN attachments if the user wants 
to  --  after all, they're NOT dangerous?



And, you yourself 'dismiss' any threats to Mac or Linux from 
attachments.  Simply because all there has ever been for either system 
are 'proofs of concepts'  - EXACTLY what is scaring the bejeesus out of 
developers with Javascript!

So, how would YOU feel if the Developers made opening attachments 
impossible in Mac or Linux - but allowed it in Windows? That is exactly 
how I see their disabling of Javascript.