Slashdot Mirror
A Medireview Approach To Stopping E-Mail Attacks
dcsmith writes: "This article at the Need To Know web site reports that the free(as in beer) e-mail arm of Yahoo has been replacing certain words in messages received by yahoo.com e-mail accounts. In an apparent attempt to forestall cross-site scripting attacks, 'mocha' becomes 'espresso' and 'free expression' becomes 'free statement'... My personal favorite - since medieval contains the text "eval", it is altered to 'medireview' ... Check Google for the number of web sites containing medireview." Kwelstr points to this story at New Scientist as well.
my wrong on line
handybundler
... what a "cross-site scripting attack" is and how changing the word "mocha" to the word "espresso" makes it all better?
I think that Yahoo shouldn't be changing any words in e-mails unless the users specifically choose to turn that "feature on". I mean if i send anyone a e-mail i expect it to arrive as i sent it. What is the point of a global mail that picts what you can and can't write about.
Dan Mayer: my blog, essays, art, etc
* zuul plays taps for those who gave their karma
------------
I emailed my yahoo.ca account, cut and pasted the /. story text
Nothing got changed, did anyone even verify this?
postie second, second postie, postie second!
That word replacing thing goes against our right of free staement
GoatPigSheep, the 3 most important food groups
I can't believe it...a slashdot editor actually spelled "medieval" correctly.
"Teachers leave us kids alone
That word replacing thing goes against our right of free STATEMENT
GoatPigSheep, the 3 most important food groups
Even if there's some great effect, wouldn't it be easy to replace the word only if it appeared in a script? Or does IE extend it's baffling type guessing to parts of documents as well?
This seems like a clumsy, low brow solution, not to mention the fact that they're causing their own kind of information corruption. So, if I'm search for medieval, now I have to sit and write down the variations on the them. The four letter combination eval pops up in thousands of words (my guess). It seems to me that this is creating one problem to try and solve another.
"I've heard WinXP removed the cmd/command prompt."
No, Microsoft didn't remove the CMD.EXE or COMMAND.COM prompt from Windows XP. But Windows XP has reduced functionality, in many ways, not just in the command line. The command line is a big embarrassment because of its limited capabilities, but at least in Win 95 it worked. With every version since then it has worked less well. (There are two kinds of command prompt, and, according to Microsoft employees, the differences between them are not documented.)
The command line prompt sometimes begins to display short file names. Microsoft employees say that Microsoft has no fix, although someone not connected with Microsoft did make a work-around.
Cutting and pasting into a command line program often puts successive extra spaces before each line. Microsoft employees say that there is no plan to fix this.
The fast paste mode that is in Windows 98 is gone in Windows XP. Microsoft employees say there is no plan to fix this.
When using the command line interface, Windows XP doesn't always update the time. After several hours, the time reported to command line programs can be several hours in error.
There is a DOS program called START.EXE that can be used to start other programs. But it does operate the same way as in other versions of Windows. It starts a program, but cannot be made to return control to the command line program as previous versions did. There is no technical reason for this; it is just one of the shortcomings that are allowed to exist.
People often say that DOS has gone away. But Microsoft still calls the command line interface DOS, and in Windows XP Microsoft has added new programs for configuring the OS that work only under DOS.
Sometimes when you press a key while using Windows XP, it is seconds until there is any response. Apparently there is something wrong with the CPU scheduler in XP, because there are a lot of complaints about this in the forums and MS people have said that they are working on it. On one particular fresh installation of XP, on an Intel motherboard with either a Matrox G550 or an ATI Radeon video adapter, it requires 18 seconds to display a directory listing of 94 items. This is apparently related to a bug in the video software, not the adapter drivers.
Something is wrong with the Alt-Tab display of running programs under Windows XP. If there are a lot of programs, not all of them are displayed. The order jumps around in a seemingly random way.
Although articles often say negative things about Microsoft, I've never seen an article that fully documents how bad the situation really is. Microsoft's management is so bad that the company has become self-destructive. For example, Windows XP is spyware. Here is a list of ways Windows XP connects to Microsoft's servers:
- Application Layer Gateway Service (Requires server rights.)
- Fax Service
- File Signature Verification
- Generic Host Process for Win32 Services (Requires server rights.)
- Microsoft Application Error Reporting
- Microsoft Baseline Security Analyzer
- Microsoft Direct Play Voice Test
- Microsoft Help and Support Center
- Microsoft Help Center Hosting Server (Wants server rights.)
- Microsoft Management Console
- Microsoft Media Player (tells Microsoft the music you like)
- Microsoft Network Availability Test
- Microsoft Volume Shadow Copy Service
- MS DTC Console program
- Run DLL as an app
- Services and Controller app
- Time Service, sets the time on your computer from Microsoft's computer.
- Microsoft Office keeps a number in each file you create that identifies
your computer. Microsoft has never said why.
- Microsoft mouse software has reduced functionality until you let it connect
to Microsoft computers.
These are just the ones I know. There may be others.So, if you use Windows XP, your computer is dependent on Microsoft computers. That's bad, not only because you lose control over your possession, but because Microsoft produces buggy software and doesn't patch bugs quickly. For example, as of July 7, 2002, there are 18 unpatched security holes in Microsoft Internet Explorer. This is a terrible record for a company that has $40 billion in the bank. Obviously, with that kind of money, Microsoft could fix the bugs if it wanted to fix them. Since the bugs are very public and Microsoft has the money, it seems reasonable to suppose that top management at Microsoft has deliberately decided that the bugs should remain, at least for now.
It seems possible that there is a connection between all the bugs and the U.S. government's friendly treatment of Microsoft's law-breaking. The U.S. government's CIA and FBI and NSA departments spy on the entire world, and unpatched vulnerabilities in Microsoft software help spies.
Windows XP, and all current Windows operating systems, have a file called the registry in which configuration information is written. If this one (large, often fragmented) file becomes corrupted, the only way of recovering may be to re-format the hard drive, re-install the operating system, and then re-install and re-configure all the applications. The registry file is a single, very vulnerable, point of failure. Microsoft apparently designed it this way to provide copy protection. Since most entries in the registry are poorly documented or not documented, the registry effectively prevents control by the user.
Note that Microsoft does not support making functional complete backups under Windows XP. Look at Microsoft's policy about this: Q314828 Microsoft Policy on Disk Duplication of Windows XP Installation. Only those who work with Microsoft software will understand the true meaning of Microsoft's policy. Since almost all programs use the registry operating system file, if you cannot make a functional copy of the operating system you cannot make a functional copy of all your application installations and configurations. There are other software companies that try to fix this, but they don't work well, and Microsoft can, of course, break their implementations, as they have often done with other kinds of competitors.
Because the configuration information for the motherboard and the configuration information for the are mixed together in the registry file, the registry tends to prevent you from moving a hard drive to a computer with a different motherboard. That's another implication of the above Microsoft policy. So, if you have a motherboard failure, and a good complete backup, you may not be able to recover unless you have a spare computer with the same motherboard.
Note that Windows XP Professional can support only ten simultaneous incoming network connections. If you want more than that, you must use Windows 2000 server, and pay much, much more. (There is no Windows XP server yet.) Many businesses have very light network traffic; they just move files from staff member to staff member; they really don't need a dedicated server computer. The staff computers could easily handle the load except for this artificial limitation.
Apparently because the Windows XP GUI comes from Windows 98, Windows XP has the same problem with desktop icons that Windows 98 has. The icons sometimes flicker. Sometimes they move themselves around, particularly after the user switches monitor resolutions. Also, sometimes the taskbar settings un-configure themselves, as they do in Windows 98.
Only technically knowledgeable people know how to avoid signing up for a Microsoft Passport account during initial use of Windows XP. The name Passport gives an indication of Microsoft's thinking. A passport is a document issued by a sovereign nation. Without it, the nation's citizens cannot travel, and, if they leave, won't be allowed back in their own country. In Microsoft's corporate thinking, the company seems to be moving in the direction of believing that they own the user's computer. Most people are both honest and intimidated. Apparently about 95% do whatever they are asked on the screen. They give their personal information to Microsoft. They don't realize that, if they feel forced to get a Passport account, they should enter almost completely fictitious information, since the real question is not "What is your name and address", but "Can we invade your privacy". The honest answer to this is "No, you cannot invade my privacy", and the only effective way to communicate that is to give completely fictitious information. Since it is the educated people who have computers, Microsoft is building a database of the personal lives of educated people. Microsoft knows when they connect and from what IP address (which tends to show the area), what kind of help they ask, and information about what they are doing with their computers, including what music they like. It is not known, and there is no way to know, how much Microsoft or other organizations make use of this information, or their plans for future use.
Not only has Windows XP definitely gone further in the direction of allowing the user less control over his or her own machine, but with Palladium, Microsoft apparently intends to finish the job: Microsoft will have ultimate control over the user's computer and therefore all his or her data. Even now, under Windows XP, a recent security patch requires that the user agree to a contract that gives Microsoft administrator privileges over the user's computer. The contract says that if a user wants to patch his or her system against a bug which would allow an attack over the Internet, he or she must give Microsoft legal control over the computer. See this article also: Microsoft's Digital Rights Management-- A Little Deeper. You may need to be a lawyer to take apart the crucial sentence. "These security related updates may disable your ability to copy and/or play Secure Content and [my emphasis] use other software on your computer" legally includes this meaning: "These updates may disable your ability to use other software on your computer." Note that the term "security related updates" is meaningless to the user because the updates have no relation to user security. So, the sentence effectively means that Microsoft can control the user's computer without notice and whenever it wants. That kind of sentence is known in psychology as "testing the limits". If there is no strong public complaint about this, expect to see more and stronger language like this.
This Register article shows the direction Microsoft is going: MS Palladium protects IT vendors, not you. Absolute power corrupts absolutely, and Microsoft is well down that road. See this ZDNet article, also: MS: Why we can't trust your 'trustworthy' OS.
Microsoft's self-destructiveness does not mean that the user should be self-destructive. There is no need to apologize for using Microsoft software. The correct solution to abuse is persuading the abuser to stop being abusive. Once I posted to a Slashdot story a link to an article on a web site of mine. By far the majority of visitors from the Slashdot story used Microsoft operating systems. Rather than feel embarrassed because Microsoft is abusive, action needs to be taken to prevent the abuse. If you are against Microsoft abuse, you are not against Microsoft; you are more pro-Microsoft than Bill Gates.
These Microsoft policies mean that any government which wants to be independent of the United States government, and any government which represents itself as controlled by the people, cannot use Microsoft operating systems, or other Microsoft proprietary systems.
- posted by poopbot: crapflooding since 7/8/02
1U2OpwrQaE
People who rely on free email for anything important are dumbasses.
I'd rather pay for it, then when someone botched my service I would have a leg to stand on.
What do you say to yahoo in a case like? Nothing you can say... You got what you paid for.
What the original poster of this article failed to mention was that this affects HTML-encoded mail only. Plain vanilla ASCII e-mail is not affected.
--
http://www.aikiweb.com - AikiWeb Aikido Information
Numero Uno. Premier Poste! Bonjour!! I kiss you!!
Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.
Yes, this is real. I sent a short HTML message to my Yahoo account that included the words medieval, mocha, and expression. All three were changed just like the article. You can do this too, just make sure you send an HTML mail.
Eval is a commonly used javascript command (duh).
An interesting one. Mocha is the old name for what became Javascript.
Obvious
Breaks most javascript embedded in HTML email.
As above.
Breaks most vbscript embedded in HTML email.
Another old name for Javascript.
However, this seems the most retarded possible way of cutting out scripts in HTML emails.
Better, would be a regexp something like .*? and targetted removal of a few other tags.
What a medireviewly draconian policy . . .
When questioned about the filter, Yahoo claimed the filter was "double plus good".
Source Message:
<html>
<body>
m o c h a: mocha <mocha>
free e x p r e s s i o n: free expression <free expression>
m e d i e v a l : medieval <medieval>
</body>
</html>
Result:
m o c h a : espresso, free e x p r e s s i o n : free statement m e d i e v a l : medireview
So, crimescript is double-plus ungood?
DNA just wants to be free...
Oh, and since NTK is slashdotted already, you might want to read the original politech message to see what we're talking about.
314-15-9265
Appears to have been /.'ed, here's the relevant bit:
Nice to see, in the midst of all these scandals, Yahoo turning a healthy profit. But as other companies fiddle the figures, Yahoo's been busy instead with fiddling its own users' private correspondence. In a fantastically clumsy attempt to prevent cross-site scripting attacks, the free e-mail wing of the sprawling giant has long been replacing complete English words in the text of HTML mail sent to its users. Mention "mocha" in an HTML mail to a friend with a @yahoo.com account, and your choice in coffee will be silently switched to "espresso". Talk about "free expression", and your recipient will think you said "free statement". Here's the full list of swaperoos:
http://www.ntk.net/2002/07/12/yahoo.txt
- try not to mail it to your friends
This fiddling has been going on now for over a year year (the ever vigilant RISKS digest noted it back in March 2001). But because of Yahoo's underhand methods, very few people have spotted the turnabout - certainly far fewer than if Yahoo had done the sensible thing and, say, "**"'ed out the vowels in the word, or, God forbid, written a smarter parser. But the sneakier you are, the wider the damage spreads. The word "medieval" (since it contains the javascript command "eval") is converted in Yahoo mail to "medireview". Google now shows over 640 sites (and 1,150 separate instances) of the word "medireview" being used as a synonym for medieval. University papers, bibliographies and book reviews, Indian newspaper columnists, and endless enthusiast sites drop it unseen into texts. People have begun to ask where it originally came from, and does it have a subtler meaning beyond "medieval"? Is Yahoo ever going to fix its filters? Or is it time we pushed to get the first regexp-obfuscated word into the Oxford English Dictionary? http://catless.ncl.ac.uk/Risks/21.34.html - does anyone still at Yahoo even know how to turn it off?
http://www.google.com/search?q=medireview
- NTK now entirely filled with google links
Of course, the next hack will be to produce e-mail that becomes a cross-site scripting attack (or criminal/tortious in some other way) after passing through Yahoo's filter. Who's going to bear the liability for that?
... that yahoo rereviewuates its practices. My messages from my yahoo.com account might look funny.
If I was given such a stupid brain-dead project as this I wouldn't point out stupid mistakes in the project specification, I would interpret the specification in the stupid way.
I wouldn't recommend looking for word boundries, or inside of certain tags only and so forth.
Then after the outcry it might get withdrawn.
I'm posting anonymous cos I don't want my project managers to know it's me!
Joe
So where are the copyright lawyers when we really need them?
What next? Switching beer with whiskey?
Don't these strings each have a non-zero probability of appearing in a uuencoded file?
The use of these words have also been catching on due to this behavior:
"retrireview" (retrieval): 333 matches at google.
"prreviewent" (prevalent): 41 matches at google.
I'm still confused as to how this has affected so many web sites out there. Are people simply seeing these words in e-mail and then use them on their own thinking it's proper? Or are many webmasters cut and pasting their content from HTML e-mails or something?
Tried it on my yahoo account - from my work account I sent, html formatted,
"last night we played in a medieval setting while drinking mocha and talking about free expression"
and it arrived
"last night we played in a medireview setting while drinking espresso and talking about free statement"
sigh
I design user interfaces for a free network management application,
Still, it would be enormously funny if one of the largest E-mail providers would actually do such a thing, as well as the consequences. "Medireview" indeed. Apparently, Yahoo! programmers don't even know about /\beval\b/. It's under "perldoc perlre".
http://www.pornolize.com/
:D
Makes better reading
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
I find it's often a error between the keyboard and the chair. I would surmise that someone has a Spell Checker set to 'Don't ask, Don't tell' Perhaps we are attributing a program glitch in the sender's client to Evil Intentions. Gee, like that's the first time its happened here.
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Why not just give the user the option to STRIP OUT ALL THE FUCKING HTML IN EVERY EMAIL? I for one HATE html email - hate it with a passion - hate the slow loading and the crashing browsers and the cookies/images loaded without my permission. Add that feature and this problem goes away.
sulli
RTFJ.
Google search also turns up unusual words like "reviewuate". Best of all, French "cheval" (horse) also shows up (in horse-related places) as "chreview", which makes absolutely no sense.
Doesn't it look like sloppy spellchecker to you?
The CACHED version is available here... just don't slashdot IT.
I really hope that none of the pgp/gpg emails my colleagues send me contain any of those strings. The ones with outlook and who send html by default...
Instead of being good at anyone thing, it's horrible at all things it does. Want tosearch? Go to Google. Want to see stock quotes? Hit Etrade. Want weather? Go to weather.com. Want nice categories? Hit dmoz.org.
Why anyone continues to care about Yahoo these days is simply beyond me.
Method of processing duck feet
Take for an example:
... which I think are very helpful >=D
H4x0r
Ewmew Fudd
Bork, bork, bork!
Igpay Atinlay
I am a Yahoo.com mail user and am concerned that some of the words in my e-mails are being arbitrarily replaced. This could distort the meaning of my e-mails or worse, make them unintelligible. Am I being paranoid or is this something I need to take precautions against?
Wanting To Be Heard Right, Reading, PA
Dear Wanting,
Malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich malkovich.
DearSlashdot
"Why should we leave America to go to America Junior?" - H. Simpson, on visiting Canada
Instead, I say they should improve it!
They should also correct all of the mail sent by script kiddies, tHoz tHat tYp LiKe Thiz, to something more logical.
please excuse my apathy
Thing is, anymore, you can pay and still have no leg to stand on.
original message:
Have a mocha, or perhaps medieval is enough for you...
rec'd message:
Have a espresso, or perhaps medireview is enough for you...
::.. check out some Cell Phone Reviews
This strange neologism "midireview" has crept into many serious, even scholarly websites.
..." (book review).
"It was the great Barbara Tuchman who pointed out the capital difficulties of writing about the Middle Ages: that medireview chronology is very hard to pin down, that contradictory facts are perpetually turning up in the sources
"The medireview/Renaissance theme must be adhered to at all times to ensure the success of our event." (Renaissance fair rules
"Lectures on the Crusades and medireview society." (college course sylabus
It makes one long for the Dark Ages.
When they're replacing random (or not so random...) words with either 'smurf' or 'fnord,' THEN it's time to worry.
Vintage computer games and RPG books available. Email me if you're interested.
Come on Yahoo. When parsing a block of text how hard is it to strip white spaces and evaluate each token individually?
Replacing a key phrase even though it is part of another word seems like an amateur mistake don't ya think.
The way this should have been done is to coerce the HTML into w3c-valid HTML4, and then only pass whitelisted tags, attributes, and URL schemes.
... but they're the ones Yahoo!'s been making deals with lately) will see the potential here for interfering with dissident speech.
It might distort non-well-formed HTML, but if the HTML isn't well-formed to begin with all bets are off anyway.
I realize that would require quite a few more server resources to implement. Too bad. As it is this ill-thought-out scheme appears to stand a real chance of permanently distorting the English language.
One does wonder if the Chinese government (or any government, really
DNA just wants to be free...
This would not be as much of an issue if everyone used PGP signatures on email. It will tell you if the message has been modified in transit.
More info in the PGP faq
Also, for an excellent GPLed implementation of OpenPGP, use GnuPG.
Using your sig line to advertise for friends is lame.
... n0w 1 c4n u5e my 1337sp33k f0r a l3g171m473 pup0se. w007!! ... But seriously, that really seems a stupid thing for yahoo to do...
dum845535.
Removal of tags is wrong because it is an open problem. It is better to allow a trusted set of tags and a trusted grammar. Unfortunately, due to so much HTML abuse this is unlikely to be implemented fully.
Quick questions: Does the following tag close a long comment: ? What if such tags are nested? (Consider the server and the client.)
What happens if you mail yourself "evalivescript" ?
asdf
_Originally_ from comp.risks 21.27 in 2001
...
(google for it - I can't be bothered to translate all the lts and gts by hand, so the followig will be munged a bit, this is the explisit mention of medireview from comp.risks 21.34)
Date: Mon, 2 Apr 2001 22:00:13 -0400
From: Kirrily Skud Robert
Subject: More on Yahoo mail's anti-virus attachment translation Further to "Yahoo! Mail translates attachments" in RISKS-21.27, I saw
the following e-mail on a mailing list which discusses medieval cookery: From:
Subject: (OT) "Medireview" ???
Does anyone know why certain Web sites and mail servers change the word
"medieval" to "medireview" without any warning? Have I missed something?
So the 'original' story is only a few days less stale than the NTK one.
Early 2001, come one, get a grip. News should be _new_.
FatPhil
Also FatPhil on SoylentNews, id 863
It appears that emails that are of content type text/plain are not altered where at text/html are.
One of the favorites on the WWII Online bulletin board is the replacing of "cum" with "body fluid".
:)
Under some cirbody fluidstances, it's quite amusing.
It's a good thing. Perhaps this will push people away from yahoo mail.
I'll admit, when I first signed up, it was a pretty good system. Unfortunately many bad changes have been made... pop & smtp are fee-based. Javascript is now required (this really pisses me off!). You can still only send 3 attachments! Their interface is rather lacking... And you are limited to a small number of filters. Now that e-mails are getting screwed-up, it's the last straw for me, and hopefully for many others as well.
The next step... Does anyone know of a free service that provides secure IMAP? I'll sign-up right away.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
I'm not gonna complain about not getting the credit (I've had my share of stories). But jeeze, why is it news all of a sudden?
Maybe because the article's on New Scientist? I've seen so many stories from them, I no longer submit any from that site, on the assumption that somebody else already has. But I begin to wonder if the Slashdot editors even bother to read submissions unless they're on sites they like? OK, New Scientist, New York Times, various others that keep appearing on Slashdot -- they're very good sites. But they don't deserve any preference.
Nice to see, in the midst of all these scandals, Yahoo turning a healthy profit. But as other companies fiddle the figures, Yahoo's been busy instead with fiddling its own users' private correspondence. In a fantastically clumsy attempt to prevent cross-site scripting attacks, the free e-mail wing of the sprawling giant has long been replacing complete English words in the text of HTML mail sent to its users. Mention "mocha" in an HTML mail to a friend with a @yahoo.com account, and your choice in coffee will be silently switched to "espresso". Talk about "free expression", and your recipient will think you said "free statement". Here's the full list of swaperoos: http://www.ntk.net/2002/07/12/yahoo.txt - try not to mail it to your friends
This fiddling has been going on now for over a year year (the ever vigilant RISKS digest noted it back in March 2001). But because of Yahoo's underhand methods, very few people have spotted the turnabout - certainly far fewer than if Yahoo had done the sensible thing and, say, "**"'ed out the vowels in the word, or, God forbid, written a smarter parser. But the sneakier you are, the wider the damage spreads. The word "medieval" (since it contains the javascript command "eval") is converted in Yahoo mail to "medireview". Google now shows over 640 sites (and 1,150 separate instances) of the word "medireview" being used as a synonym for medieval. University papers, bibliographies and book reviews, Indian newspaper columnists, and endless enthusiast sites drop it unseen into texts. People have begun to ask where it originally came from, and does it have a subtler meaning beyond "medieval"? Is Yahoo ever going to fix its filters? Or is it time we pushed to get the first regexp-obfuscated word into the Oxford English Dictionary? http://catless.ncl.ac.uk/Risks/21.34.html - does anyone still at Yahoo even know how to turn it off? http://www.google.com/search?q=medireview - NTK now entirely filled with google links
Whoever out there who is working on the next, newest client-side scripting language please add a command with the name 'yaho' or 'ahoo' or something like that. That'll learn 'em!
It's not so much a copyright issue but forgery, which is a much more serious offence.
If it's a FREE service, then why, oh, why do we need HTML mail anyway? Plain text is perfectly adequate!
Frankly, the only HTML mail I ever get is spam anyway. They should just not render html period.
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
You'd think the folks at Dominican would be smart enough to catch something like that... or maybe medireview is a real word?
Under capitalism man exploits man. Under communism it's the other way around.
Do a search on these too:
reviewuation (evaluation)
dreviewuation (devaluation)
dreviewue (devalue)
I was trying to trick someone by emailing them a particularly nasty javascript snippet that would write the word mocha in the message body without it actually being there, but DANG! They got me. All it ended up doing was writing "espresso".
Y2K Compliant since the late 1890s
"eval mocha expression javascript jscript vbscript livescript evaluate retrieval link script object embed body iframe layer applet meta form"
This is what arrived in my inbox.
"review espresso statement java-scriptj-script vb-script live-script evaluate retrireview link script object embed body iframe layer applet meta form "
I paid the $30 to get POP3 access for a year, so it isn't just the free(beer) accounts.
It's curious that only some of the words were changed, but not all the ones listed in the article.
Imagine my surprise, when one day, I was reading a post that kept talking about how fun it would be for the poster to meet "all of his new clbuttmates on the first day of clbutt".
At first, I figured that this guy was just being an idiot or I missed some sort of recent joke on South Park. Nope, my filter was taking the ass outta clASS and making it clBUTT.
Mordor...a magical, mythical land where women are more rare than dragons--but where every man would rather find a dragon
I sent an HTML email to my yahoo account and the words were changed as described. However, when I forwarded the changed email back to my work address, the changes disappeared and I had the original email back, "eval" and all.
WARNING:::::::
It turns out theres a new e-mail virus going about named "Capitalists.bl0w". The key words that can trigger this attack include "U.S. government", "Cheney", "Bush", "Enron", and "9-11 conspiracy". Until this virus can be reverse engineered and a remedy found, all ISPs will hence be filtering these words from e-mail orriginating from their servers. While the wee tiny handfull of companies that control the nations bandwidth acted of their own volition, they would have likely faced numerous suits in court in the case that the virus put undue strain on the nation's communications infastructure in the event of another terrorist attack.
Medireview ? :(
Two-sheds - that's an interesting nickname. So...do you - in fact - own two sheds?
Last post!
How about just striping all HTML tags from email?
This is a listserv message on things medieval that noticed this behavior from some of its Yahoo-using submitters for almost 2 years now. It's sorta comical that not enough people talk about eval, mocha, and expression through Yahoo mail to have made this an issue before now.
Mordor...a magical, mythical land where women are more rare than dragons--but where every man would rather find a dragon
I'll explain the "mocha" thing. Yes, the parent post is right: it's an old name for JavaScript.
It's been discovered recently that in Netscape it's also an undocumented alias for the "javascript:" URL protocol, that is the pseudo-protocol that evaluates script text
This created a new kind of problems with web forums and the like. This kind of web apps, for example, filters out "javascript:" URLs for images embedded in posts, because they could be used to perform Cross-Site Scripting attacks (e.g. steal the user's cookies). "mocha:" is a new possible backdoor to inject code in these scenarios
I paid the $30 to get POP3 access [from Yahoo, I presume] for a year, so it isn't just the free(beer) accounts.
I paid $35 to get my-domain-name.tld hosted by Yahoo! This included: five addresses @mydomain.tld, Yahoo! advertising on every outgoing mail, and Geocities web space with ads and whatever absurd bandwidth limit a free Geocities site has. Then Yahoo! told me I'd have to pay $30 to continue having POP3 access.
So I transferred my domain to hostica.com, and for $25 bucks got: another year of registration, as many email addresses as I want (albeit forwarded to one POP3 account), 5MB of space, and 10GB/month of bandwidth, with the option to add services from an a la carte pricing menu. And did I mention? No ads!
(I have no financial interest in hostica, I get no referral fee, no consideration of any sort for this post. This ain't no ad, and it's not even that I don't think you could do as well somewhere else. It's more than you can do a lot better than Yahoo, for not much money. It's just a matter of doing the math -- $65/annum for less, or $25/annum for much more -- and preferring better service.)
Opinions on the Twiddler2 hand-held keyboard?
"Medireview" has even made it into someone's resume (PDF); that must seriously reduce his chances of getting hired. Other references seem to have gotten into scholarly works. This is just the latest in a long string of stories about automatic (or semi-automatic) computer correction having serious consequences.
When I was at college, one student ran his doctoral thesis through the spellchecker one last time before submitting it to the binders, and thence to the Board of Graduate Studies. Unfortunately, he inadvertantly selected the "silently accept all suggestions" option, and failed to check the results. The manuscript he submitted was almost incomprehensible. After that, the University added a one-page warning to the spellchecker output (yes, it was in the days of mainframes).
Unfortunately, it appears that the well-known story about "in the black" becoming "in the African American" is only partly true; it was a deliberate practical joke in the newsroom.
Draconian refers to events in ancient Greece.
Friends don't help friends install M$ junk.
Your post sucks!
So does 'reevaluate' become 'rereviewuate'? What a good word!
I have a couple of Yahoo email accounts, and I constantly find bugs, oddities, and problems.
I went on their pay program for one of them (lowest level), hoping that doing such would give them reason to lighten up on the bugs, but it made no difference. They F their paying customers also.
Yahoo email is just plain fugged to living heck. Avoid it if possible.
telnet mailserver.example.com 110
+OK InterMail POP3 server ready.
user exampleuser
+OK please send PASS command
pass examplepass
+OK exampleuser is welcome here
list
+OK 1 messages
1 719
.
retr 1
+OK 719 octets
I send you this message in order to have your advice.
.
dele 1
+OK
quit
+OK exampleuser InterMail POP3 server signing off.
Tim
Omnia vestra castrorum habetur nobis.
When viewing an HTML mail in Yahoo, it does the translation before it displays the mail for you. However, if you 'export' or download the message, it still looks fine. Thus, it looks as if the messages are not being changed when sent or received, they are only modified when being displayed through Yahoo's HTML webmail. Granted, based on the google searches, it is still causing lots of problems for users.
Instead of this "medireview" stupidity, and the even worse monstrosity "reviewuate", why couldn't they have simply changed a letter to a digit? Then they'd get medieva1.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
I just now got it to work - you have to first check the "Allow HTML tags" box at the bottom of Yahoo's composer screen, and then make sure you use some tags in the message. In my test, a FONT tag was enough to do it - my "test message" was
It worked, and I got nice pretty blue text reading "This is a medireview free statement espresso email".It only seems to catch them if they occur at the end of a word - for example, I piped "grep eval /usr/share/dict/words" into an HTML email, and got this when it sent:
From http://www.multum.com/SubscribeRx.htm
"MediReview: is our comprehensive, patient-specific drug summary that includes dosing recommendations, drug interaction and allergy alerts, side effects, and pregnancy and lactation warnings. Providers and patients can use MediReview to tailor a patient's medications to their specific medical history--and proactively reduce ADEs."
This is so amusing!
my favourite so far, .. it just looks plain stupid.. 300 odd hits on google
prreviewent
This poor academic dude tryed to cite his paper "Vagabonds and Little Women: The Medieval Netherlandish Dramatic Fragment De Truwanten," Modern Philology, 65 (1968), 301-306" in his curriculum vitae (i.e. academic resume) and it shows up instead as "Medireview Netherlandish..."! There are a couple other instances of the word in the same CV--so much for the slick (heh) PDF presentation. Poor shmoe. Somebody ought to email him. I can't bring myself to.
Wouldn't it be better to attempt to parse the resulting HTML. If the parse tree then contains a node that makes the function call to eval (turns into a dodgy link or whatever) then it can reject the message (and inform the ISP of hacking activity). The chances of legitimate text parsing into legitimate HTML are close to zero I'd say.
The report has more information about when this happens, and Yahoo's explanation. The substitutions only occur when previewing an attachment, but do not alter the attachment itself. Plain text e-mails are not affected at all - which should explain the unreliable reproducibility which some readers have been reporting.
This is just a test run. For a few bucks, they could replace "coke" with "pepsi", or "Heineken" with "Coors", or "Windows" with... oh, Windows is not replaceable !?
But some of us prefer the more traditional spelling...
[from the Latin, medius middle + aevum age]
deus does not exist but if he does
This is really old news. I first noticed this last year when my wife complained about it. (She used medieval in a sentence, and someone asked her what "mediereview" meant. Mediereview?) I mentioned it here once and people didn't even believe me.
Steps to reproduce:
1. Open a Yahoo mail account if you don't have one, and log on to it.
1a. Uncheck the checkboxes on the privacy policy page.
2. Click on "Compose", to compose a message.
3. Look for a link on the "compose" screen that says "Add Color and Graphics", and click on it.
4. Your screen should now have a link (in the same place) that says "Switch to Plain Version". You will also see a pretend MS-Word-type toolbar for bold, italic, background color, etc.
5. Type a one-line email to yourself (meaning send it to your same Yahoo account). Type in something with "medieval" and "expression", e.g.
Her expression was medieval
6. Go back to your inbox, and click on "Check Mail".
7. Read the email. The above sentence becomes
Her statement was medireview
8. Optionally, forward it from there to a real email account. The message will have no body, and it will come with an attachment. Open the attachment, and you will see it back in its original form:
Her expression was medieval
What if your name is Chevalier? Check out the 4th link from the Google search for Chreviewier. It looks like somebody's geneological search is going to be that much harder.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Just don't ask them to re-evaluate their policy! They'll never understand what re-reviewulate means and will simply ignore your request.
They that can give up essential liberty to obtain a little temporary safety deserve neither safety nor liberty.
Ben
Cheval is changed to Chreview all over ze place... Zey von't be 'appy.
Lameness filter encountered. Post aborted!
Reason: Don't use so many caps. It's like YELLING..
That's the point .
Does anyone know of any documented cases of servers being exploited through specially formatted emails? (besides buffer overflows)
Copyright Violation:"theft, piracy"::Anti-Trust Violation:"thermonuclear price terrorism"<-Overly dramatic language.
I'm going to laugh when Starbucks sues the shit out of Yahoo when they order 100,000 units of mocha and get shipped 100,000 units of espresso.
Fucking idiotic.
Hey Taco! Looks like you're using the "infinite monkeys and typewriters" scheme to generate Ask Slashdots again...
Go to barnesandnoble.com. Do a book keyword search for "medireview". I got 20,031 titles matching. The first so many that I perused didn't even contain the word "medireview". Hmmm...
For example <xcript> will be treated as <script> allowing html emails that have been mangled or disabled by overzealous e-mail filters to be rendered correctly.
Another patch is planned, using its well known auto-correct functionality, to replace occurrences of medireview with medieval etc. whenever they appear in a rendered web-page.
It is well known that one of the major benefits of IE is that it is tolerant of missing end tags. For example it will correctly render a table even if the author has omitted </TR> tags from each row. This enables IE to render web-pages that other browsers would simply give up on, making it the most compatible browser in the world.
Did you have to use such a disgusting picture for your example?
() http://arc.pasp.de/
Check this : http://www.ku.edu/~medieval/melcher/20001101/msg00 166.html
and the related threads; funny how that professor states that he found it strange that his students wrote "medieval" in papers.
On google you even find it in a Curriculum Vitae.
My company distributes evaluation copies of our software through resellers, who then send a 30-day evaluation key to the user by e-mail. Some customers were reporting that the keys didn't work, but when we asked the customer to forward the e-mail they had received back to us, it looked fine.
It was only when we started asking customers to send the key file from their PC that we discovered that the string "eval" in the license key name was being changed to "review"! At first we blamed the reseller, but eventually figured out it was Yahoo. I didn't know until reading this article what had been done to us and why.
The whole mess prompted me to design a new key mechanism that had the advantages of being easier to enter (no worrying about line wraps) and not subject to the whims of Yahoo.
to screw up the English language. Just look at the number of people that think loose means lose. They don't even know the word lose exists.
*Rasberries*
Damn,
Just when you think you saw the last thing someone had too much free time came up with, another shining example shows up!
Near as I can tell, this is a blatant violation of Yahoo's Terms of Service(http://docs.yahoo.com/info/terms/) , wherein:
"You acknowledge that Yahoo does not pre-screen Content, but that Yahoo and its designees shall have the right (but not the obligation) in their sole discretion to refuse or move any Content that is available via the Service. "
Anyone up for a civil suit?
cripes, it even screwed up somebody's PDF resume
You think thats bad? Go back to the main page and check out the guy's email address, it says the address is: louis.hamilton@villanova.edu
but check where the mailto link points,
yup, thats right: medievals@fordham.edu
Yahoo has been doing this for a really long time. (Over a year, I believe.) I find it hard to believe that no one else has noticed it before. My mom did and she (1) doesn't use Yahoo mail and (2) wouldn't know Javascript from Assembly.
I just cut-and-pasted this story and sent it to my Yahoo account. No words were changed. You know why? Because I use text for email. Can someone explain why on earth you would use HTML for email anyway? I have never understood that.
My beliefs do not require that you agree with them.
From http://www.newspeakdictionary.com/xorionm.html
"Obtuse Anger is that which is greater than Right Anger" - Lewis Carroll
Since they only do this when displaying a html message in a web broswer seems like they could substitute "eval" with "evl" at display time.
That reminds me about a story I heard about the Mail Transport Agent for an obsolete mainframe operating system that couldn't cope with mail messages containing a certain word followed by a space at the start of the line. Fortunately that sort of thing would never happen nowadays.
Now the challenge is to think of other words containing "eval", and then do a Google search to see if Yahoo has mangled them. I found a story in which a person drank a cup of Greviewia coffee, for example.
Training monkeys for world domination since 1439
I'm surprised that they'd do this. It's so dumb.