Re: Postscript in Netscape

[Jeff Weinstein <jsw@netscape.com>]

Dr. Frederick B. Cohen wrote:
> 
> Jeff Weinstein - Electronic Munitions Specialist Wrote:
> 
> ...
> >   If a user configures a postscript viewer that has not had the
> > file operations disabled as a helper app to any web browser then
> > they are opening themselves up for a world of hurt.  The same is
> > true if they just download the file and run their viewer on it
> > manually.  The same is true if they configure /bin/sh as an
> > external viewer.
> >
> >   Obviously everyone should heed perry's warnings and emasculate
> > their postscript interpreters before using them to view files
> > of unknown origin.
> 
> WRONG!!! Netscape claims to be "secure" - hence it is Netscape's job to
> be secure - regardless of the user's use of their product.  Otherwise,
> the ads should read:
> 
>         "Netscape can be used securely by sufficiently knowledgeable
>         users who have emasculated their postscript interpreters before
>         using them to view files of unknown origin, and who have removed
>         all other known, unknown, and/or undisclosed security holes from
>         their systems.  Otherwise, Netscape is insecure and should not be
>         trusted."

  Why did I know you would be showing up in this discussion?  You
wouldn't be related to alice de 'nonymous would you?

  I don't believe that Netscape claims to be some magic bullet that
will suddenly make your system secure when you install it.  We also
don't claim that it will detect viruses.

  Dont you think we've wasted enough bandwidth on this?  I'm sure
most readers of this list are sick of it by now.

	--Jeff

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.