Nick FitzGerald <[EMAIL PROTECTED]> writes:
> Dan Harkless <[EMAIL PROTECTED]> wrote:
> > > Just to clarify, this is only true when using Windows Explorer.
> >
> > Are you sure? My understanding when this last came up a year ago was that
> > email programs (at least the Outlook variants) also obeyed the setting when
> > showing the names of attachments (just as they obeyed the "Hide file
> > extensions for known file types" Windows Explorer setting, allowing the
> > "iloveyou.txt.vbs" email worm).
As an aside, I got a bunch of rejects of my post from Bugtraq subscribers
who use absurd software that doesn't even allow you to use the phrase
"iloveyou.txt.vbs" in the text of an email message (my mail didn't even use
any MIME). Extremely inappropriate for subscribers to a list where names of
viruses and Trojans are guaranteed to be mentioned... (Yes, I realize those
people aren't going to see this mail either -- I'm not going to mangle that
string for their benefit.)
> Well, your understanding is not supported by any experimental testing
> I have done nor any actual testing I have had reported to me.
I assume you didn't test any pre-May-2000 copies of Outlook / Outlook
Express? I believe Microsoft fixed the program so "iloveyou.txt.vbs" would
no longer masquerade as "iloveyou.txt" even if you had "Hide file
extensions..." turned on, so I assume they fixed the NeverShowExt case at
the same time.
> What has repeatedly been incorrectly reported is the **assumption**
> that because Windows Explorer hides extensions and standard common
> dialogs associated with file handling also do, **all** dialogs
> displaying filenames hide extensions. That is not the case.
No, and I didn't think that.
> Arriving at a better understanding of this is complicated by the fact
> that various other parts of the Outlook and Outlook Express interface
> that also display the filename of the attachment are length-limited
> to what they can display, in some circumstances with names numbering
> longer than the low-teens of characters having their ends chopped and
> "..." displayed instead and a similar thing happening with names
> longer than something in the 40s, 50s or 60s of chracters in other
> parts of the interface.
Well, it shouldn't complicate understanding *too* much, since with the
limited-length problem you'll have "..." and with other types of
extension-hiding you won't.
> > Personally I don't feel safe on a new Windows box until I turn off "Hide
> > file extensions for known file types" and then use regedit.exe to find
> > all instances of "NeverShowExt" and rename them to
> > "disabled_NeverShowExt".
>
> 8-)
>
> Definitely a good start!
I wasn't implying that's the _only_ thing I do to new boxes.
----------------------------------------------------------------------
Dan Harkless | To prevent SPAM contamination, please
[EMAIL PROTECTED] | do not mention this private email
SpeedGate Communications, Inc. | address in Usenet posts. Thank you.
