Re: 'cross site scripting' CERT advisory and MS

From: Alexander Schreiber (Alexander.Schreiberat_private-CHEMNITZ.DE)
Date: Fri Feb 18 2000 - 04:46:41 PST

  • Next message: Ran Atkinson: "MMDF"

    On Thu, 17 Feb 2000 flynngnat_private wrote:
    
    > David LeBlanc wrote:
    > >
    > > What I recommend specifically for using Outlook (probably also applies to
    > > other mail readers using IE as a HTML viewer) is:
    > > 1) Set it to run in the Restricted Sites zone
    > > 2) Edit the Restricted Sites zone into what I call maximum paranoia mode -
    > > turn EVERYTHING off.  IIRC, cookies are off to begin with, but this gets
    > > them turned off for sure.
    >
    > Wouldn't it be better to set the Internet zone for high security and
    > then set the browser to use the Internet zone? The restricted zone requires
    > entering the list of untrusted systems while the Internet zone says
    
    Sorry - but having to specify the list of _untrusted_ systems for a
    restricted zone sounds broken to me - this means that by default you trust
    everybody, unless specified otherwise. I think the other way around (i.e.
    giving a list of _trusted_ systems) is the correct way to go. Or am I
    horribly mistaken here ?
    
    Regards,
           Alex.
    --
    ------------------------------------------------------------------------------
     EMail : alsat_private              | WWW : http://www.thangorodrim.de/
     If privacy is outlawed, only outlaws will have | Ceterum censeo Parva Mollia
     privacy. (Philip Zimmerman, author of PGP)     | esse delendam.
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:35:55 PDT