Subject: PINE458 problem

From: Barry Landy <[email-masked]>
Date: Wed, 5 Nov 2003 22:50:08 +0000 (GMT Standard Time)

Using the Win32 version of Pine458 I find that it has stopped being able
to open the appropriate application for attachments. For example faced
with an octet-stream describing a .doc it says

"attachment OCTET-STREAM unrecognised. Try open by file extension
(.doc)"

When responding Y it works fine, although inconveniently Y is NOT the
default.

Reverting to Pine455 the document gets opened in the right application
(WORD in this case) without any fuss.

-- 
Barry Landy                        Home:        +44-1223-570417
192, Gilbert Road                  College:     +44-1223-332058
Cambridge CB4 3PB                  Efax:	+44-870-458-0205
Email:[email-masked]

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Jeff Franklin <[email-masked]>
Date: Wed, 5 Nov 2003 16:08:15 -0800 (PST)

> When responding Y it works fine, although inconveniently Y is NOT the

This was changed to be a little more paranoid when opening attachments.
In this particular case, since typically only the fact that
application/octet-stream is displayed without some digging, we felt it
safest to warn before reverting to the file's extension.  If the
originating client had labeled the attachment as what it actually was (as
application/msword), pine wouldn't have whined (not entirely true, it
still would have asked to view an external attachment unless the
quell-attachment-extra-prompt feature was set).

It sounds like the quell-attach... feature should also quell this extra
bit about opening by file extension.  We'll go ahead and change that
unless there is a large outcry.

Jeff

---

From: Mats Dufberg <[email-masked]>
Date: Thu, 6 Nov 2003 01:57:30 +0100 (CET)

>From a security point of view, there is now difference. If you have
configured your system to try to open every ".doc" file with MS Word is no
more unsafe than having done so for application/msword files.

Mats

-----------------------------------------------------------------
Mats Dufberg                                      [email-masked]
Blaoarvsgraend 42                                  +46-8-38 48 59
SE-162 45 Vaellingby, Sweden                      +46-70-258 2588

---

From: Jeff Franklin <[email-masked]>
Date: Wed, 5 Nov 2003 17:18:58 -0800 (PST)

> more unsafe than having done so for application/msword files.

You're right that there is no difference in how it is opened.  The
question is what is a sufficient level of warning that a person should get
that they are about to do something potentially dangerous.  The (recent)
default behavior is to warn any time someone is about to do something
outside of pine, which is about as much as we can do.  More sophisticated
users should have a way to turn off the nagging.

Jeff

---

From: Barry Landy <[email-masked]>
Date: Thu, 6 Nov 2003 07:53:07 +0000 (GMT)

For what it is worth the sender is an AOL customer, so I guess the
failure to specify application/msword is widespread.

On Wed, 5 Nov 2003, Jeff Franklin wrote:

:>On Wed, 5 Nov 2003, Barry Landy wrote:
:>
:>> "attachment OCTET-STREAM unrecognised. Try open by file extension
:>> (.doc)"
:>>
:>> When responding Y it works fine, although inconveniently Y is NOT the
:>> default.
:>
:>This was changed to be a little more paranoid when opening attachments.
:>In this particular case, since typically only the fact that
:>application/octet-stream is displayed without some digging, we felt it
:>safest to warn before reverting to the file's extension.  If the
:>originating client had labeled the attachment as what it actually was (as
:>application/msword), pine wouldn't have whined (not entirely true, it
:>still would have asked to view an external attachment unless the
:>quell-attachment-extra-prompt feature was set).
:>
:>It sounds like the quell-attach... feature should also quell this extra
:>bit about opening by file extension.  We'll go ahead and change that
:>unless there is a large outcry.
:>
:>Jeff
:>

---

From: Mats Dufberg <[email-masked]>
Date: Thu, 6 Nov 2003 18:07:13 +0100 (CET)

> users should have a way to turn off the nagging.

It should be the same warning for opening something based on content-type
or "extension". Yes, you should be able to turn it off.

*

A feature request in this area is to be able to dynamically select a
program for an attachment.

Mats

---

From: Gopi Sundaram <[email-masked]>
Date: Thu, 6 Nov 2003 11:09:31 -0600 (CST)

On Wed, 5 Nov 2003, Jeff Franklin wrote:

> We'll go ahead and change that unless there is a large outcry.

Here's my small outcry. I'd rather an additional config option be used
to quell this behavior. If Pine is making a decision for me, I'd like to
know about it. When I choose to open an attachment and it is of a known
mime-type, then Pine is making no decision on my behalf. But when it
infers something based on the filename, it is.

With the extra config option, I have the ability to launch attachments
of known type without question, and be prompted for attachments of
unknown type.

-- 
Gopi Sundaram
http://www.zrox.net/Mail/Pine/

---

From: Jeff Franklin <[email-masked]>
Date: Thu, 6 Nov 2003 11:16:58 -0800 (PST)

> failure to specify application/msword is widespread.

I shouldn't have implied that the sending client was at fault.  A client's
ability to correctly label mime-type depends upon a lot of things.  For
instance, if the system itself isn't set up correctly (like a lack of some
mime-type information in the Windows registry), then the client has little
other option than to label it "octet-stream".

Webmail clients have an even harder time of it, with the web server having
to make assumptions of the attachments that get handed to it.

Jeff

---

From: Jeff Franklin <[email-masked]>
Date: Thu, 6 Nov 2003 11:30:45 -0800 (PST)

> or "extension". Yes, you should be able to turn it off.

The extension warning is an extra one.   This was intended for the case
where content-type displayed to the user is an image, but the file
extension itself is something like .exe.  image/gif should always open
whatever program is supposed to handle .gif files, but if there is no
entry for image/gif, the next thing to do would be to open by file
extension, in which case we probably want to warn.

> program for an attachment.

We'll consider adding something like this.  Some changes already made in
4.60 might address this a very little bit also.

Jeff

---

From: Jeff Franklin <[email-masked]>
Date: Thu, 6 Nov 2003 11:39:45 -0800 (PST)

> infers something based on the filename, it is.

I guess a small outcry is just as good as a large one.  We'll likely just
go ahead and make it a separate feature.  I see your point about wanting
to preserve the behavior of the quell-attach... feature as is.  That
doesn't change the point that Mats was making, which was that it is
equally unsafe to open by mime-type as it is to open by extension.
Hopefully this is a happy compromise.

Jeff

---

From: Robert Larmon <[email-masked]>
Date: Thu, 6 Nov 2003 12:51:57 -0800 (Pacific Standard Time)

> Hopefully this is a happy compromise.

Jeff, we would definitely appreciate this as an additional feature as
well.  Some of our users have asked about it, and it would be nice to make
it auto-magically work for them.

Thanks!

Rob

_________________________________

Robert Larmon
Senior Systems Analyst
USC Law School Computing Services
[email-masked]
_________________________________

---

From: Jeff Franklin <[email-masked]>
Date: Thu, 6 Nov 2003 15:02:31 -0800 (PST)

> it auto-magically work for them.

That settles it.  We'll go ahead and make it a separate feature.

Jeff