Previous Next

Home Up


MSWord and HTML Documents in E-mail


E-mail sent as a Microsoft Word document set me off on this, but it's not really limited to just that. I'm seeing an upswing in E-mail sent in proprietary, non-standard formats that assume you have a particular application for a particular operating system installed to read it, attachments in formats that include executable code in them, attachments that are self-extracting archives or self-decompressing files or otherwise have to be run as programs, and in fact attachments such are electronic greeting cards that are openly and blatantly programs you are expected to run to get the contents. In all cases, the senders never bother to ask whether I can handle such attachments, or whether those attachments are acceptable to me if I can handle them. I find this sort of stuff dangerous and rude and arrogant.

For the dangerous part, let me say that I've been on the Internet since it was called ARPAnet, on BITNET back when that was 10 times the size of ARPAnet, on Usenet when it was mainly carried via UUCP over dial-up lines and hadn't heard of TCP/IP yet, and on BBS systems and on-line services longer than that. In about 20 years worth of being connected to the on-line world, there has always been one iron-clad rule that everyone followed and considered so obvious that you had to be insane to question it: never, ever run a program that someone else gave you without checking it thoroughly first. Viruses, trojan horse programs, just plain buggy or incompatible software, they were all things that you didn't want to have on your computer and that you stood just too great a chance of getting bit by when you accepted programs from people and places you didn't know. This rule applied to programs from BBS systems. It applied to programs from CompuServe and Genie. It applied to stuff people sent over BITNET. It applied to software you FTP'd over ARPAnet or that people mailed to you. It applied to programs posted to Usenet.

So, given all that, what changed? What, after all those years, suddenly makes it safe to accept executable programs from unknown sources? As far as I can tell, nothing changed and it's still not safe to accept executable programs from people or places you don't know and especially without running them through a gamut of checks and tests first. So, when such a program shows up in your mailbox, why would any sane person's first response not be to simply delete it unread?

The same things apply to HTML in E-mail. HTML-formatted messages can download Java, Javascript, VBScript and ActiveX from the network when you read them, opening you to all the problems of executable content. Worse, since the content isn't in the mail itself, it's a lot harder to scan the mail for problems as it comes in. In fact it may be impossible, since the server that delivers the problem content can see who's asking for it and easily serve up something innocuous to the scanner and switch to the dangerous stuff when the user opens the message.

For rude, think back over the years to all the times and situations where people have to provide information to other people:

Suddenly, though, it's become acceptable to just send information to other people in whatever format you prefer, without bothering to ask them what format they want things in. What happened to suddenly make behavior acceptable that would, anywhere else, would flat not have been tolerated? At the very least, isn't it just common courtesy to check with the recipient first, instead of deciding for them what they're going to get?

HTML also poses problems here. First, you're assuming that the recipient is running on a graphical system. This is a problem for people on the road or who have slow connections, who either have only the equivalent of a VT100 text terminal or who don't want to waste time on large graphics and the like. Sure you can create HTML that works perfectly on text-only displays, but that reduces you to text-only pages so why bother including the HTML tags, why not just format and send the text plain? And when you start introducing color settings, fonts and the like, you make a lot of assumptions about what colors the recipient likes ( or can even see, think about the large minority of men who are red/green color-blind for a moment ), what fonts they prefer, and so on. Admittedly HTML isn't quite as bad as the others, but it's still annoying to have people assume I'm using a Web browser to read my mail without checking first.

And, of course, all of the above cause major headaches for people who may be blind and have to use text-reading software or text-to-Braille conversion equipment. Graphics, fancy fonts and all the rest may be nice, but they cause problems here.

As for arrogant, this mostly applies to people who send mail as solely an MSWord document, or an Excel spreadsheet, or a PowerPoint application, or as a single attachment bundled up inside Microsoft's application/ms-tnef archive format. In all such cases, when you do that you are assuming #1 that the recipient is running Microsoft Windows, #2 that they own and have installed the relevant applications, and #3 that they want files in those formats. That is an awful lot to assume without ever even asking them what sort of computer they have. How would you react if people started sending you mail in formats you can't handle, and when you asked them to resend they said it was your job to track down and install the software to read their mail?

In a choice bit of irony, Microsoft themselves are making my points for me. Every time they upgrade their programs they introduce a new file format that is not readable by older versions of those programs. Now all the people running Windows 95 and Word95 who are happy with the combination and don't want to upgrade are dealing with unreadable mail from people who have upgraded to Word97 or Outlook 98. And it's only going to get worse with Office 2000, which will introduce yet more file formats that aren't readable by Word95 or Word97. And their increasing use of "active content" and embedded executables using WordBasic and VBA is causing an outbreak of macro viruses far exceeding any previous virus outbreak on record, and there's no way of stopping it while still using their applications. As the headaches associated with this stuff increase, I think the general opinion is going to more and more mirror my own: this sort of stuff just isn't acceptable.


Previous Next

Home Up


tknarr@silverglass.org