Department of Defense Now Blocking HTML Email

oKAMi-InfoSec writes "The Department of Defense (DoD) has taken the step of blocking HTML-based email. They are also banning the use of Outlook Web Access email clients. The DoD is making this move because HTML messages can easily be infected with spyware and executable lines of code that enable hackers to access DoD networks, according to an article in Federal Computer Week by Bob Brewin . A spokesman for the Joint Task Force for Global Network Operations (JTF-GNO) claims that this is a response to an increased network threat condition. The network threat condition has risen from Information Condition 5 to Information Condition 4 (also called Infocon 4). InfoCon 5 is normal operating conditions and Infocon 4 comes as a result of 'continuing and sophisticated threats' against DoD Networks. The change to Infocon 4 came in mid-November, after the Naval War College suffered devastating attacks that required their entire system be taken offline, but the JTF-GNO spokesman claims there is no connection."

Comments

Good call

[MostAwesomeDude]

Reduced bandwidth, less entry vectors, less spam entering mailboxes. I guess the only losers are the people who send those annoying Flash giftcards through email.

Re:Good call

[banerjek]

I guess the only losers are the people who send those annoying Flash giftcards through email. Nahh.... There are plenty of losers everywhere. ;)

That aside, I wonder how many products the military already uses send HTML email. Not all email originates from ordinary mail clients.....

Re:Good call

[Anonymous Coward]

I for one certainly don't miss the annoying pink backgrounds and purple text. But, you forget that a lot of internet based applications send out emails. So you should really include the developers in the losers category here.

I don't know how many email templates I've gone though in the past week converting them to be plain text (where necessary). This mainly applies to processes that include sending tabular data to a person.

Re:Good call

[Marcion]

End of HTML email? That would be my Christmas present sorted!

P.S Merry Christmas to all you Slashdotters, Linux users, MS fan boys and Trolls.

Re:Good call

[xdc]

Yes, this was absolutely the right choice. I just wonder what took them so long!

I also wonder when other organizations will follow suit.

Re:Good call

[tehwebguy]

"So you should really include the developers in the losers category here."

which raises the question: why don't they just strip html out instead? it will probably require more work to make sure nothing gets through, but i think that it might be worth it.

Re:Good call

[shadowmas]

This is very true. I my self personally prefer plain text mail except when using outlook at the office where i use the default html or richtext.

however when developing i do sometimes use html because it makes reading tabular data and such much easier to read at a glance. true you could use plain text for these but with lots of information it makes it difficult to quickly extract the information you need.

Re:Good call

[leamanc]

I actually prefer my tabular data emails in plain text. Just include the good old disclaimer "This message is best viewed in a fixed-width font like Monaco or Courier."

I find it easier to copy-n-paste into Excel or a text editor when it's plain tabbed text, rather than an HTML table.

Just my $0.02, not adjusted for inflation.

Re:Good call

[1u3hr]

which raises the question: why don't they just strip html out instead?

They do. "A Navy user said that any HTML messages sent to his account are automatically converted to plain text." But if you've used tables or such the layout will probably be trashed, so better to reformat as plain text to begin with.

Using something like Lynx to filter HTML into plain text would give pretty good results, it does tables fairly well.

Re:Good call

[World_Leader]

which raises the question: why don't they just strip html out instead? it will probably require more work to make sure nothing gets through, but i think that it might be worth it.

Wouldn't any attempt to strip html and leave something intelligible open the possibility of infecting the "stripping" machine?

If they had confidence they could do that they could probably just convert the mail to an image (ok, losing active elements such as links and input fields) and send it as a simple encoded/mime image.

But it's really the same problem moved one step away, which admittedly could be better controlled. Maybe, e.g., lynx -dump but I can see where their analysts might ask exactly how they convince themselves that would remove every possible new threat posed by running it thru a stripper.

I bet they've also been told 1000x that what they were using to view email is now fixed and safe (hah!) This is, if anything, an understandable cry of pain and frustration.

Re:Good call

[mrmeval]

Anyone who lets emails in with links and attachments intact deserves what they get. It's trivially easy to strip that crap out.

Re:Good call

[hobo sapiens]

you like your Italics, no?

That'sa spicy meatball!

Re:Good call

[1u3hr]

you like your Italics, no?

Bad typing. There's actually a <?i> instead of </i> at the end of the first line. Preview is pretty slow, I usually just wing it.

Re:Good call

[anaesthetica]

No BLINK for OIL!!!!

Stop HTMLburton!!!

Re:Good call

[MoogMan]

Sure, sure it is reducing the entry vector somewhat. But they're still using Microsoft Exchange.

Re:Good call

[cluckshot]

If you are DOD and you want to get Commercial Off the Shelf (COTS) products to resolve your problems without hiring the massively expensive solutions of 1 off stuff built to design, you must be able to accept attachments such as .zip and html mail. Sorry but the commercial guys cannot even tell you what they are doing anymore without this stuff. DOD costs just got higher!

I worked one DOD site where we had to email files of code. The volume of the attachments was beyond the Email limits so we had to zip the files. The filters blocked .zip. So we renamed the files .aaa or something like that. Then the filters didn't catch the files. That way we could get the emails. We had to break our own security just to do our job. This stuff is a real problem.

The US DOD needs to can Microsoft. If they were to run Linux or Apple systems and then to sandbox all emails and web browser stuff under the OS a lot could be done and things would be much more secure. The basic problem is a Microsoft logical design construct. Microsoft thought that they should own your computer and you should rent it from them. Under these conditions they wanted "their" computers to be remotely controlled by various means. The means they designed into their constructs also leave sucking security holes which hackers and other malware designers just walk right through.

There is a real reason most DOD people stick like glue to Microsoft. For Network security people in the DOD they are as worried that some subordinate might actually control his machine as they are of having foreign control. (Foreign to their system) As such they must keep central control. This is the Microsoft construct at a second level. The DOD system I worked on had an entire base having one root password that didn't change folks because of this demand. Linux etc doesn't conform to this as naturally as MS systems. Another level of this sticking like glue to MS systems comes from the fact that most of the people who program (contractors etc) for the Government like to keep their jobs. MS systems do not support legacy software well. As such they are continually "re-inventing the wheel" so to speak and it makes for lots of jobs that last a lifetime. It holds the DOD hostage to continually hiring the same contractor because his software is proprietary and cannot be easily "reverse engineered" without risk of software copyright violations. In the end this synergy of profits and control leaves the US DOD bleeding money, never able to do its job as effectively and wedded to MS systems.

If the taxpayers get involved they will ban such OS like Microsoft because this is completely contrary to the interest of the taxpayers. It however; requires the US DOD to recognize that its only true security lies in the loyalty of its people. In doing so it will have to retract from foreign (non-USA) suppliers and contractors. It will have to seriously look into who it is hiring and it will have to weed out those it has on payroll who are being more selfish than loyal. Let me assure you that if this situation is dealt with properly it will be a top to bottom 10 on the Richter Scale earthquake in US Government operations. Imagine if you will actually not being able to have the management read every document in someones computer without them knowing. Imagine having someone who works for you who you actually have to be able to trust! Imagine real government security! (WOW!)

Re:Good call

[Anonymous Coward]

Ban HTML messages

HTML messages should be banned, they are evil! If you want better markup then txt then use rtf formats - that is abouth the one good thing that came from Ms. (if you dont count in the incompactible implementations that is) :S

Re:Good call

[shadowmas]

true enough and usually you don't even need to change the font since most clients show plain text with courier.

however there are status and summary messages sent by the system which is preferable to be read without going into excel or third party app. of course if you have a large amount of tabular data it's much better to generate a CSV formatted attachment which is more convenient. but for a relatively little amount of data which needs to be looked at quickly html tables are the best.

Re:Good call

[partenon]

If the taxpayers get involved they will ban such OS like Microsoft because this is completely contrary to the interest of the taxpayers. Agree. DoD should use the same OS as the taxpayers.

The problem isn't w/ Microsoft itself. Ok, they produce crappy programs, but the main problem is w/ *people* who use it. If people inside DoD can't get the basics of internet defense themselves, it's their fault. They aren't like my grandma who can't use Windows for 5 minutes w/out getting tons of spywares. They are supposed to know at least the basics of internet defense. Don't open executable files, prefer plain text instead of HTML mails, don't click 'OK' w/out reading the actual message, don't trust on every site on internet, ...

And just one more thing: instead of using ZIP files w/ "aaa" extension, why don't they build a simple web application to promote the file exchange, making it easier, safer and more auditable than emails (which aren't supposed to be used as file exchange media)?

Re:Good call

[partenon]

This mainly applies to processes that include sending tabular data to a person. Emails aren't supposed to display tabular data :-) Emails are for "internet messages". If you want someone to actually read tabular data, send a link to the tabular data file (a spreadsheet?).

Re:Good call

[haakondahl]

I agree, but you seem to have overlooked that with a non-MS OS, you can actually have better security while still employing people you may not trust. There is no reason that the workstation desktop user needs to have advanced permissions, particularly if the workstation exists as a glorified terminal. With humble user permissions on the workstation, the information worker can do whatever needs to be done locally, and still has access to tightly controlled and centrally located user areas (mailbox, storage) and share areas (shared storage, collaborative space).

This is all possible in theory under MS, but in practice, by the time you have security, you have too little ability. In UNIX/Linux shops, security can be had while preserving the ability to get things done.

I look forward to the day that the government internalizes its own security, instead of this hand-in-glove approach which leaves government beholden to MS. Yay, G-buntu!

Re:Good call

[PastaLover]

Best practice would be to have a plaintext version of any html mail you send out so you can send them both as parts to the same mail. Any reasonable graphical mail client will show you the html version and text clients will default to the plaintext version. This makes your mail more accessible (in terms of screenreaders and unix fossils), gives you a wider audience and scores you brownie points with the geek crowd. No reason not to do it I'd say.

Only bad developers lose out on this one.

As They Should

[deKernel]

This I guess will just show my age, but I am soooo OK with this. Email should be just text, period. I personally believe that people should spend more time using complete sentences which includes punctuation and correct capitalization.

I guess I should get back to chiseling my notes on stone slabs now.....

Re:As They Should

[Anonymous Coward]

I personally believe that people should spend more time using complete sentences which includes punctuation and correct capitalization.

I guess I should get back to chiseling my notes on stone slabs now.....

That's five dots. With ellipses, you either use three dots within a sentence, or a period (often followed by a space) and then three dots.

Re:As They Should

[theMerovingian]

Email should be just text, period.

In my day email was dashes and dots, and we liked it that way.

Re:As They Should

[MobileTatsu-NJG]

"Email should be just text, period."

Personally I'd miss the formatting features of HTML. Bold, Italic, etc. I'm a little surprised there hasn't been a middle ground estbalished at some point. You know... pretty text, no exploits. Well, I can dream. In the mean time, gotta give kudos to GMail. One of my favorite features is that it disables images until you turn them on. That's a feature Outlook 2000 could have used.

Re:As They Should

[pchan-]

But I just finished writing this inspirational xmas email in 32-point Comic Sans font with animated gifs of kittens and reindeer and attached 30-meg screensaver that I was going to sent to Everyone@dod.gov

Re:As They Should

[whoever57]

When I first started using email, it was only within the company's WAN. Most people had exactly the same model of printer, so I figured out how to embed printer control characters into emails to make parts appear bold or in italics when printed (most employees printed out their email to read it at that time)

Re:As They Should

[Anonymous Coward]

Personally I'd miss the formatting features of HTML. Bold, Italic, etc. I'm a little surprised there hasn't been a middle ground estbalished at some point. You know... pretty text, no exploits. Well, I can dream.

I think that you have /really/ hit the nail on the proverbial head there. To make plain text emails usable we need a STRONG and well defined _SYNTAX_ for visually communicating "text style". Until then, this email thing will _never_ catch on.

Re:As They Should

[dkf]

Personally I'd miss the formatting features of HTML. Bold, Italic, etc. I'm a little surprised there hasn't been a middle ground estbalished at some point.

You should be aware that there has been such a format for quite a while, using the MIME type of text/enriched. I used to receive quite a few emails that used it (no, I don't remember what the originating client was and I'm not interested in looking it up right now) but it never seemed to catch on more widely. (At a wild guess, that's because Outlook didn't generate it; yet another opportunity missed by those geniuses at Microsoft...)

Re:As They Should

[Anonymous Coward]

Dashes and dots? Luxury!

Re:As They Should

[mordors9]

You young whippersnappers and your crazy ideas. Whatever happened to a good postcard.

Re:As They Should

[xTantrum]

you know i use to read /. for the interesting perspectives of the fellow geeks on here, but i've given up. I now read it for the comedians. wish i had my mod points.

Re:As They Should

[__aaclcg7560]

Especially since each one cost eight bits to send. ;)

Re:As They Should

[Arker]

There was such a thing, but MS decided it wasn't exploitable enough and declined to use it. Look up text/enriched.

Re:As They Should

[value_added]

I think that you have /really/ hit the nail on the proverbial head there. To make plain text emails usable we need a STRONG and well defined _SYNTAX_ for visually communicating "text style". Until then, this email thing will _never_ catch on.

LOL. If the OP wants bold and underlining in his emails, I'd suggest he starts with reading

T^HTh^Hhe^He M^HMu^Hut^Htt^Ht E^HE-^H-M^HMa^Hai^Hil^Hl^HCl^Hli^Hie^Hen^Hnt^Ht

Personally, I'd find that annoying, like every other attempt to be interesting, or creative or otherwise expressive. Look folks, many of us read hundreds of emails per day. Subscribing to few mailing lists and we're looking at thousands.

Do we really need or want anything other than standard messages? The content of an average message is just a few sentences. What people send out, on the other hand, is somewhere between unecessary and absurd. And all of it (at least in a corporate setting) gets stored and archived.

Re:As They Should

[Anonymous Coward]

A side note on your comment about formatting.

In the tech support field, we often take calls from our users that sent a nice pretty email but the recipient saw something not quite the same. All it takes is an email client that is not Outlook or even the recipient to have a different screen resolution and the formatting is different. The same thing happens with Word documents when the recepient has a printer with different margins then the sender has. Well that footnote was supposed to be on page 2, not page 3 or I sent them a 410 page document and they got a 411 page document. I want you in IT to fix it for me NOW!! I'd love to tell them use PD fucking F.

Another some what unrelated note about email is the concept of read receipt and the email recall function with Exchange/Outlook. IT takes a lot of heat because some lawyer tried to recall a document to a client but it was not recalled "correctly" or they did not get a read receipt so I have to troubleshoot the issue for them. Here's an idea, call the fucking guy and ask him if he got your email! We have NO control over those things once it leaves our walled environment. Maybe we do have a training issue, or a lack of training issue and we should explin to our users how the system works. I know that sounds great but no one is going to want to listen to IT give a speech about email operation, believe me, we tried.

Even further off topic but along the lines of formatting is the user that gets a MDB or some type of DBF file as an attachment and wants it "printed".

Re:As They Should

[a.d.trick]

I don't know how old you are, but I'm still a college student and I share your feelings as well. What annoys me the worst is that retarted mail client called Outlook that has a love afair with <FONT SIZE=8 COLOR=BLUE> [1]. Text is wonderful because it allows me to specify the color, font family, and size of the email so I can read the blasted thing.

Plain text isn't perfect either. Things like text formating is often done in awkward ways that can get screwed up fairly easily. (The 80 column line wrapping thing is the biggest offender.

Personally, I think that another system, maybe a strictly designed subset of XHTML or Restructured Text (for XML haters), needs to be designed. It should only contain semantic elements. No style or scripting capabilities at all.

[1] I'm not sure if that's the actual markup it uses. It's an educated guess based on Microsoft's other tools. It's been trimmed a bit for readablity. The real version whould have all sorts of MS Office specifice attributes with magical namespaces floating around (and HTML doesn't even have namespaces, go figure).

Re:As They Should

[SCHecklerX]

Personally I'd miss the formatting features of HTML. Bold, Italic, etc. I'm a little surprised there hasn't been a middle ground estbalished at some point. You know... pretty text, no exploits.

There is. Enriched text:

http://www.ietf.org/rfc/rfc1896.txt

Which is really just a subset of HTML for the most part.

Re:As They Should

[Lord Apathy]

I said the same damn thing 2 weeks ago and got label a troll. I guess the harsh language I used might have had something to do with it. an calling everyone who used html text a dumb ass possibly didn't help my case.

Re:As They Should

[AlHunt]

>I said the same damn thing 2 weeks ago and got label a troll. I guess the harsh language I used might have had something
> to do with it. an calling everyone who used html text a dumb ass possibly didn't help my case.

If you'd have thrown in something about how it was all Microsoft's fault, or how Linux doesn't have this sort of vulnerability, you'd have been +5; Insightful.

Re:As They Should

[t14m4t]

Actually, Righ Text format is still authorized. I can still send e-mail with bold, italics, colors, etc. I just can't use any embedded HTML.

For those who are interested, this is one of the (many) moves the DOD has taken over that past year or two in response to the continuing series of "F" grades DOD networks have received regarding their security. I'm the CIO at my command; I've had the "joy" of implemeting these changes - I took over the job right around the time the changes started.

Re:As They Should

[Megane]

I don't know how old you are, but I'm still a college student and I share your feelings as well. What annoys me the worst is that retarted mail client called Outlook that has a love afair with .

ARGH! I know exactly what you mean. I used to work at a mostly MS-dominated company, full of people using Outhouse and MSexchange, and most e-mails would have those defaults, which would appear at an annoyingly small size under the OS X mail program. I always had to just give up and hit the command keys to show them as plain text. Having a mail program specify the font size BY DEFAULT in HTML mail is completely and thoroughly brain damaged, doubly so when the default is so small.

And there's a small amount of blame to be directed at Apple as well, for not providing any way to either override or ignore such brain-damaged defaults.

Re:As They Should

[1u3hr]

. I'm a little surprised there hasn't been a middle ground estbalished at some point. You know... pretty text, no exploits.

There is (was) a "rich text" for email, looked like a subset of HTML. It was used by early versions of Eudora and other mail clients. I think we can blame Netscape for putting HTML into email, and this was cemented when Outlook came along and started doing it by default. All the other mail clients had to follow though they knew it was a Bad Idea.

Re:As They Should

[HaveNoMouth]

In my day email was dashes and dots, and we liked it that way.

Dashes? You had dashes? You had it easy. We only had dots. And we liked it!

Re:As They Should

[Gilmoure]

Whatever happened to a good postcard.

Exactly! (NSFW)

Re:As They Should

[uhoreg]

IIRC, Apple Mail (or maybe its predecessor) used to do text/enriched. And I'm sure that someone made emacs send text/enriched too.

Re:As They Should

[CyberNigma]

didadidit dadada didadidit

Re:As They Should

[dcapel]

In my day email was banging stones together on a tall hill.

Re:As They Should

[Anonymous Coward]

>I personally believe that people should spend
>more time using complete sentences which includes
>punctuation and correct capitalization.

Correct grammar would be a nice touch, too (e.g., 'includes'?)

Re:As They Should

[jonbryce]

I work as an accountant, and at work email includes lots of sage / quickbooks backup files, spreadsheets, scanned invoices in various formats and sets of accounts and tax returns, usually in pdf format.

It is very useful to be able to communicate this stuff electronically, so if email is to be plain text only, how do you propose I do this?

Re:As They Should

[1shooter]

Amen brother.

Re:As They Should

[freakxx]

gotta give kudos to GMail. One of my favorite features is that it disables images until you turn them on.

well, Kmail also does similar thing. But unfortunately, no Kmail for windows. I really miss Kmail a lot when use Windows.
Thunderbird is also good but it hasn't implemented maildir format yet and mbox is a big pain in ass :-(

Re:As They Should

[partenon]

And I'm sure that someone made emacs send text/enriched too. Of course! It's pretty easy: Ctrl+A+I+U+Q+(jump three times)+(say HOORAY!) and it's done!

Re:As They Should

[Jon Luckey]

It is very useful to be able to communicate this stuff electronically, so if email is to be plain text only, how do you propose I do this?

Losing HTML doesn't mean you lose the ability to have email attachments. MIME should still work in the absence of HTML.

But just for fun, you could return to the classics and UUENCODE it.

Its been a while, but circa 1997 Microsoft Exchange used to automatically change a UUENCODed section in an email into an attachment. (Or maybe it was Outlook that did it.) Anyway, it happened automagically. It was pretty useful for doing automatic archives via email from a linux system.

Re:As They Should

[zr-rifle]

EMAIL??! Boy, you had it easy!

In MY days, we had to walk 10 miles to the telegraph, in three foot snow, for our dashes and dots. Uphill. Both ways.

And we LIKED IT!

Re:As They Should

[GarrettZilla]

What? We're not all using PINE? I'm the only one?

Yes, I am a geezer. I thought Virtual Console was reached with alt-F[1234567]. I am over Lynx, though.

Who's up for some Zork?

Re:As They Should

[Anonymous Coward]

Yeah... in my day, you didn't have to email files, there were other ways to get them. Lke Sneakernet. or FTP without having to go through internet explorer.

Re:As They Should

[BenoitRen]

Mozilla-based mail clients (and ChatZilla) use stars to bold text and _ signs to underline text.

*bold*
_underline_

Re:As They Should

[StikyPad]

Simultaneously or sequentially?

Re:As They Should

[Anonymous Coward]

Wouldn't RTF satisfy this, or would this just cause other problems?

Re:As They Should

[hackstraw]

In my day email was dashes and dots, and we liked it that way.

Youngster -- we used to multicast via smoke signals.

Better yet, just pitch all the email......

[banerjek]

At least then people will know why their email never got through. So many people use HTML email without being aware of it and don't realize that's what makes formatting possible.

Although the focus is on Outlook, it seems like there's an outside chance there may be other clients and web interfaces (namely all of them) that are vulnerable to most of the same problems....

Re:Better yet, just pitch all the email......

[Sepodati]

It still makes it through, it's just converted to plain text according to the article.

---John Holmes...

Re:Better yet, just pitch all the email......

[Anonymous Coward]

No. Its Outlook. Microsoft borked the security (again, still, ongoing, and will again tomorrow). Every one else is just fine. Don't blame everyone for Microsofts screwups. They did badly and were named singly, because they screwed up singly (they are responsible for their own bad products). I am quite tired of people blaming 'the computer industry' for Microsofts screwups. Outlook is a Microsoft product, and it has problems. Quickly saying 'oh, everyone else' is junk. There are other companies that take security more seriously (sure, at the expense of profits), and there is other software out there whose sole purpose is quality and functionality (profits are not the main goal, quality software is). They aren't blaming other people for this, they are blaming Microsoft, as they should. Please don't try to dull the blame directed toward Microsoft, they have been let off the hook millions of times by millions of people over decades. ENOUGH I SAY!

Re:Better yet, just pitch all the email......

[jark]

The email is not *converted* to plain text at all. There is absolutely no true format converting taking place at all.

By way of a Windows GPO the ability to compose email in HTML format is completely disabled. The default format for Outlook has been set to "Rich Text" so that people are still able to use a small subset of formatting. Users are capable of composing in plain text, but most will stick with the default.

Additionally, the Outlook preview pane is set to "convert" all inbound email to plain text. However, that does not do any actual converting of the original email therefore any digital signature remains intact. All that the preview pane "conversion" does is modify how the email is displayed, and nothing more.

Lastly, OWA is authorized for use so long as it is protected by two-factor CAC-based authentication. It is not summarily denied.

Most of the steps outlined in the article are best practices that should be used all the time, but for one reason or another are not implemented by the DoD on a regular basis.

I like some HTML email

[kwilliam]

I find HTML email useful for sending friends pictures with annotations, and I find numbered and bulleted lists useful visual aids for organizing information.

That said, Javascript should obviously be banned, and I wouldn't care if CSS wasn't supported. (CSS can be used to hide things deceitfully.)

Basically, I'd like to see BBCode used for emails, lol!

Re:I like some HTML email

[commodoresloat]

Put the pictures on a web page and send your friends a link to the web page. I can't stand getting pictures via email. If you must show me a photo of your new kid, put it on a website and send me the link. I still won't look at it, but I'll respond telling you how cute he/she is and we will both feel better. As for bulleted lists,

* what
* the
* hell
* is
* wrong
* with
* asterisks?

Re:I like some HTML email

[LiquidCoooled]

I agree with this.
A basic text formatting subset of HTML to help get the message across without any of the risks of full DOM support.
Slashcode handles bold and italic and lists (I think) and a few others but anything else is culled.

I feel dirty whenever I have to switch from flat-text mails.
The way Outlook shares its email HTML properties with explorer gives me the shivers.

Re:I like some HTML email

[EvanED]

Nothing is terribly wrong with asterisks, but

-formatted lists look nicer. (Especially if you have multiple lines with a proportional font, because then it gets indented correctly.) Just like nothing's wrong with writing bold text with *blah* and similar things, but the html version is still better looking.

Re:I like some HTML email

[Anonymous Coward]

Put the pictures on a web page and send your friends a link to the web page.

Two words: "Web bug." HTML in email is just plain Evil. I'm hoping a couple of large corporations follow suit--maybe that'd finally spell the doom of the abortion that is HTML email.

Re:I like some HTML email

[commodoresloat]

I don't see the point of taking security risks and wasting bandwidth on email that "looks nicer." You want a nice looking email, format it as a webpage, and send your friend a link to the web page. Or print it out and stick it in the post box. My email program is instructed to display all email as text only and if it is full of crappy html that isn't filtered out, I hope it wasn't an important email because I deleted it. But I shouldn't have to bother; this junk should be filtered out at the server level and I'm glad the DoD at least recognizes that email security is more important than how nice it looks. I only wish my university would do the same :) Don't get me wrong, I love html, but it's not made for pretty-ing up email. It's made for hyper-text, which email should not be. Most email programs allow you to follow links that are part of an email message pretty easily, so what's wrong with sending the link to your browser?

Re:I like some HTML email

[glitch23]

If you want to send pictures with annotations but not use HTML then do what I've seen ignorant people do a few years ago which was to put all pictures in a Word document because they thought that is how you stored pictures, then they would send the Word doc in an email. At that point my jaw would drop as I asked them why didn't they just send the picture itself.

Re:I like some HTML email

[Anonymous Coward]

I don't see the point of taking security risks and wasting bandwidth on email that "looks nicer." You want a nice looking email, format it as a webpage, and send your friend a link to the web page.

That's a ridiculous argument. Why is the web browser any more secure at handling HTML than the email client? How does using a web browser to d/l HTML use any less bandwidth than an email client preforming the same function?

Re:I like some HTML email

[Watson Ladd]

Uhhh, the links are in html. So that's not going to work.

Re:I like some HTML email

[commodoresloat]

Uhhh, no they're not. At least, they don't have to be, and the email program shouldn't allow them to be.

Re:I like some HTML email

[commodoresloat]

The browser is designed for HTML and is configurable by the user (or the user's admin) -- you can say no java, etc. More importantly, the user has to take positive action -- click a link -- and to recognize that he/she is now going on the web to see something rather than looking at an email document stored locally as a file. You can also see where the nastiness is coming from if you land on a hostile script posted to a web page. Finally, you have a choice whether or not to click the link (and I usually don't). As long as the link is in plaintext (which is what I am advocating), you can see the address before you click on it, and you can decide whether it's worth the risk to see a photo of someone's dog you've never heard of. Embedded IMG tags and javascripts can be pretty nasty. Sure, these can be nasty in web browsers too, but at least you can make a reasoned decision before you wind up downloading some random script.

Re:I like some HTML email

[LilGuy]

You hit the nail on the head with that argument. That was exactly what I was thinking. Seems to defeat the purpose of blocking html e-mail.

Most html exploits are going to just link you to some stupid site that will actually rip open the security hole and infect you with god-knows-what. The e-mails themselves most likely are not going to be the culprit, but the actual website they so cleverly link you to will.

Hell, half the time the links aren't even clever. Phishing attempts are the worst if you have half an idea of what is actually happening when you browse the web. It's not hard to recognize that going to 122.235.151.62 is not the same as going to ebay.com to fill in your username and password information. But apparently even the DoD has completely clueless users... just the same as any other institution/corporation I guess and blocking html will be the easiest and cheapest fix I would imagine.

Re:I like some HTML email

[Steve001]

I think the move to plain text e-mail is a good one for the DoD. Besides the reduction of risk of malicious code, there are at least two other advantages of people using plain text for their e-mails:

• People concentrate on what their message says, instead of deciding what the message should look like. Per Dave Barry (when he was discussing word processing - paraphrased): For every minute you spend actually writing, you will spend 10 minutes deciding how it should look.
• The receiver has the freedom how to decide how the message should look, since appearance is separated from content. I can view a received e-mail in a font that is easy for me to read.

I agree with others that if formatting is so important, the best thing to do is include a formatted attachment with an e-mail. One thing to consider is that HTML provides only limited control over appearance, and it can vary based on application. Something simple like not double spacing between paragraphs is difficult (without the use of style sheets).

As the above writer suggested, a limited subset of HTML for e-mail might be a good way to go. I think a better, and more secure way, might be to develop an XML format specifically for e-mail which only allows for formatting and no executable code.

One feature of the format should be that the only e-mails that will be accepted are those that contain only legitimate tags. If an e-mail contains a single invalid tag (regardless of the reason) it is rejected and a message is sent to the sender.

Re:I like some HTML email

[kwilliam]

I had that happen once, lol. What's worse, he sent it in Office 12 .docx format. I had to unzip the darn thing.

Stupid

[Nicopa]

That's stupid. The problem is not with HTML mail (which is generated by many people unknowingly). They could just standarize in a safe mail program, with some mandatory defaults. They could force the use of a modified version of Thunderbird forcing the (already existing) oprion of "Disable JavaScript" off. Another interesting Thunderbird feature is the ability to "sanitize HTML", that is, remove from the HTML view anything that isn't strictly formatting (paragraphs, bullet lists, etc.).

Re:Stupid

[Beryllium Sphere(tm)]

But even without Javascript there are still web bugs, image file parsing exploits, and remember what engine is probably parsing the HTML on a Windows client. A "safe" email client is one that disables most of the features of HTML, and unless it's guaranteed to catch everything dangerous then it's safer to prevent HTML in the first place.

Up-to-date patches would mitigate those, but do you think somebody might be saving some zero-days for the DoD?

Re:Stupid

[Stumbles]

No, it's not stupid.... doing nothing is stupid. The simple fact remains. No matter what client your using, be it proprietary or some open source variety all the nastiest that can be placed in HTML is simply a hassle to block. Sure you can run things like spamassassin, razor and any number of things but those are just extra things that have to be maintained, updated, etc. The simplest is to dump HTML altogether. I have never been a fan of HTML email because it's a colossal waste of bandwith.

Re:Stupid

[headkase]

What's stupid is that they were not aware of the obviously better solution you know of. That's where targeted information needs to be supplied. Google is everyone's friend but sometimes it's still not easy enough to find the answers to your specific situation. The challenge being connecting the right answers with unknown information in the search queries. Google's next biggest challenge is finding what you didn't know you needed!

Re:Stupid

[LiquidCoooled]

One question about Outlook that now would be a good time to ask:

Does it still Render the mail in a HTML window even when you switch to flat text, or is it another rendering control?

Kind of like the difference between a multiline Text box, and a RichText control.

Re:Stupid

[Metshrine]

Thunderbird is a better solution here? I dont think so. People bad mouth outlook/exchange all the time, especially on /., however, in the case of most large enterprises (DoD especially), t-bird simply doesnt fit the bill. Outlook/Exchange offer so many more features and functions that most larger businesses and corporations use that t-bird doesnt even begin to fit into the same realm.

Do you honestly think the DoD is going to move from a platform which supports every feature they currently utilize (I know, I am in the US Army) to one which doesnt have support for basic things like calendaring, public folders, centralized rules administration, and various other features that simply arent available in this "better solution"? Thunderbird is not ready for the enterprise, nor will it be anytime soon without support for exchange/domino connectivity.

I am all for using open source, but when it doesnt fit the bill, I am not afraid to say that it wont do the job. Thunderbird is good for home use, but for corporate use (especially in a large entity like the DoD), its just sub-standard and lacking in the necessary areas. The fact of the matter is that you cant even access an exchange server with T-Bird.

Re:Stupid

[drmerope]

No. Its the KISS principle. Code complexity itself endangers security.

Rendering engines aren't rewritten frequently. Typically the code you have available for reuse supports many features you don't want: embedding, javascript, images (don't forget the GDI exploit). It is true that you can provide knobs to disable these dangerous features in the rendering engine. *BUT* have you ever been involved in real software verification efforts? Too many knobs means too little coverage.

Writing good tests is hard.

I have to assume that the DoD peformed some sort of balancing test: do the benefits of html exceed the risks?

People in general should ask themselves: do the benefits of pretty emails make up for the risk of having my computer rooted or leading to disclosure of personal information.

It is true, we could have both if enough people were willing to _pay_ lots of money for their rendering engine. It doesn't seem that is the case.

Re:Stupid

[@madeus]

I quite agree. I am typically not in favour of reducing functionality for increased security when there are viable alternatives, but disabling HTML email seems like a smart move in this case. It's simple and unlikely to be really inconvenient and it's had numerous problems for ages, I'm more a bit surprised they are only doing this now (personally I would have started with it off in an environment like the DoD).

While its true that many users unwittingly generate HTML email, pretty much all clients that do generate plain text versions too (using MIME/multipart) - it's easy to configure a mail server just to strip the HTML parts (not sure about Exchange, but certainly with something like Exim). Of course if Microsoft took a better approach to handling potential issues like this (by handling HTML messages better by default), I don't think anyone would have even seen HTML formatted messages as a risk (though they'd still be inconvinent in some other scenarios).

Re:Stupid

[flyingfsck]

Standardizing the DOD mail program is not the issue. Their problem is with *incoming* email. They have no control over what mail client Hotlipz in Tombstone Arizona is using to send a cutesy Christmas card executable to her boyfriend in Iraq...

Re:Stupid

[Anonymous Coward]

I'm contracted to a number of DOD agencies IT departments and am fairly familiar with the JTF-GNO compliance requirements. You're under a misconception that the JTF-GNO is responsible for maintaining the various systems in DOD. They are not. They are responsible for maintaining the secure standards of those systems. This means creating requirements and not creating solutions to those requirements.
For instance you're required to have two factor authentication for a compliant JTF-GNO system. Whether you use a secure ID token, a biometric signature or a cat card it doesn't really matter so long as you fulfill the requirement. What makes it difficult is when there are undefined requirements such as "prevent all unsafe html code." This naturally has one ask "What's unsafe" and we become stuck in red tape trying to define it for every single location out there. As a tax payer and a technician I far prefer a well defined requirement that covers all the bases and doesn't curtail functionality. Preventing HTML in emails is a good one. It's well defined, easy to implement and doesn't sacrifice any functionality email is used for. If an agency wishes to use thunderbird for some reason it's up to them (so long as it meets all the requirements).
The long and short of it is that trying to impose technical solutions for tens of thousands of shops around the global is a bad way of going about business.

Re:Stupid

[dkf]

basic things like calendaring, public folders, centralized rules administration

I know what calendaring does (and note that there are free alternatives to Outlook under development) but what are "public folders" and "centralized rules administration"? Are public folders like an NNTP server, possibly with server-local or domain-local groups, which Thunderbird handles excellently? (Googling for "centralized rules administration" doesn't seem to lead to much enlightenment; too many other probably-unrelated schemes for centralizing the administration of rules in specific domains...) Without knowing exactly what features (at the technical level) are missing, it's hard to argue against what you say.

The fact of the matter is that you cant even access an exchange server with T-Bird.

That's one I know about, and it's because of the nasty mess that is Exchange, and especially its protocols for talking to Outlook. I could say more on what I think about this particular area, but it's the season of Goodwill To Men, so I think I prefer to stay mellow...

Re:Stupid

[Belial6]

I have never been a fan of HTML email either, but I think the 'waste of bandwidth' argument is long dead. Even a dial up modem has plenty of bandwidth to handle HTML email.

Re:Stupid

[Anonymous Coward]

Do you honestly think the DoD is going to move from a platform which supports every feature they currently utilize (I know, I am in the US Army)...

Ooohhh, dude !! You're in the army, so you have all the answers. How cool to be you.

...to one which doesnt have support for basic things like calendaring, public folders, centralized rules administration, and various other features that simply arent available in this "better solution"? Thunderbird is not ready for the enterprise, nor will it be anytime soon without support for exchange/domino connectivity.

It's really easy -- just disable the email function in Outlook, continue to use all the other uber-cool stuff, then substitute a competent email client.

The fact of the matter is that you cant even access an exchange server with T-Bird.

Too bad -- the problem is with exchange, not with any other clients. If I install electrical outlets in my business which have non-standard spacing for the prongs on standard plugs, I have no business bitching out the vendors of all the electrical equipment I need to run my business.

If you're in the army, you'll appreciate the old joke about the woman watching her son's boot camp graduation. She turns to the family next to her and says, "Look at my son down there -- you can tell which one he is -- he's the only one on the parade field who's in step."

Re:Stupid

[Anonymous Coward]

Standardizing the DOD mail program is not the issue. Their problem is with *incoming* email. They have no control over what mail client Hotlipz in Tombstone Arizona is using to send a cutesy Christmas card executable to her boyfriend in Iraq...

Yeah -- it's better by far that she be able to send cutesy pictures than that her BF is on a system that's been made more secure from exploits. WTF is he doing opening anything with executable code anyway?

It would be trivial for DoD to reject all non-compliant email with a message pointing the sender to a page explaining that they do not accept html mail and describing how to shut off the bullshit function in the more widely used clients.

As for the outfits that provide the cards, they can damned well include a prominent "text only" button or sink into the mud as more organizations start refusing html mail.

Re:Stupid

[Metshrine]

First, I didnt claim to have all the answers nor will I ever, however I do know that the army uses outlook to its potential and I know for a fact that thunderbird would not suite the needs of the army. Just because most of these tbird users dont like outlook and hate anything microsoft on principle of it being anti-OSS, doesnt mean that they are right in any aspect. Your comment about disabling email in outlook shows your total lack of knowledge about how a business is run. No business in their right mind would spend money on something, then disable its primary function to use a third party product which is best suited for a niche of users at best. I use thunderbird, however, I dont try to pretend its something its not (as is the case with most of the firefox/tbird fanatics). You claim that its microsoft's problem that t-bird doesnt interface with exchange. Can you explain then, why several other email clients CAN interface with it? Can you explain why the API's exist to allow other clients to interface with it and have been in use for several years?

Re:Stupid

[a.d.trick]

Maybe in the utopian land of happiness and glee. But for those of who live in the real world, it doesn't work so well. The fact is that software is buggy, and the more features it has, but buggier it tends to get. Security isn't a black and white thing. Most of the real decisions us real people have to make is based on a number of factors that we aren't quite certain about. Something like HTML email provides a much larger surface of attack and potential places for programmers to screw up. The most mail client exploits are related to HTML email (including less trivial things like phishing).

I use Firefox for web browsing. All things considered, Firefox is fairly secure, but I would be rather foolish to think that the whole thing is bug free. On the other hand, it allows me to use some extentions that really improve my security in other ways (encryption of stuff). So for me, it works out fairly well, but there's always a chance that someone might exploit it (In reallity, social enginneering is probably much easier though).

Re:Stupid

[It'sYerMam]

Use XML/Subset of XHTML (a la jabber messages) - the parser throws an error or ignores anything that isn't in its list of commands.

Re:Stupid

[hey]

I just looked in my Thunderbird help - can't see any thing about "sanitize HTML".
Can you please point me to this option. Thanks.

Re:Stupid

[mackyrae]

There are ways in HTML email of inserting 1-pixel transparent gifs which have unique load addresses based on who opens the email so that the sender know which people they mail read it. That's how spammers know if you open the spam they send. It's a sort of tracking cookie image.

Re:Stupid

[kernelpanicked]

Wow. Everytime I read a comment like the stupid trash you just posted it makes me want to scream DO YOU KNOW WHAT THE FUCK EMAIL IS? Why do Windows users feel it necessary to cram 50 different applications' functions into one super crappy, insecure piece of bloatware and then rave on about how superior it is? Me, personally, I'm using mutt in an enterprise environment because I'm just crazy enough to believe you should read email with, you know, a fucking email client.

Re:Stupid

[Anonymous Coward]

"Public folders" are effectively inboxes that are shared across the organziation. They aren't a function of outlook, rather, they're a function of exchange. I imagine "centralized rules" is intended to mean Active Directory's ACLs and manged functionality of exchange (most any mail server provideds centralized rules though...). I manage both Microsoft and non-Microsoft enterpirse level systems. Unfortuenatly there aren't any real "enterprise" non propritieray systems that will offer the features that Micorosoft or Novel provides.

If there was an alternative to Exchange that used basic LDAP accounts I'd love it (if you know of one please mention it) though ultimatly it'd need to be:
1. Basic Admin Friendly
2. Multi-site management
3. Allow delegated authority (IE: you can grant certian users the ablity to modify specific ACLS and properties)
4. Supported by a vendor(This is actualy a big one. From a goverment standpoint, esp. in DOD. You want somone who is ultimatly responsible for the product in case is goes wrong. Opensource doesn't really have that kind of authority which makes things difficult to get it aproved for use =\)

There are a number of alternative's to outlook that allow for access to Exchange data, however all the ones I've used make use of Exchange web services as their protocol which by JTF-GNO requirments needs to be turned off.

Either way cheers!

Re:Stupid

[644bd346996]

I think the DoD deals with a lot of email. Being able to cut the size of email traffic in half will cause a major reduction of their server loads. The bottlenecks are not always at the client!

Re:Stupid

[Nicopa]

In the "View" menu, tell Thunderbird to show the message body as "Simple HTML" (or even plain text).

Re:Stupid

[jZnat]

It's definitely a waste of bandwidth on the server side of things. Imagine a server sending and receiving 1000 emails per second; now add up the overhead caused by all that useless HTML, and see how much bandwidth that accounts for: way too much.

Re:Stupid

[Kjella]

Wow. Everytime I read a comment like the stupid trash you just posted it makes me want to scream DO YOU KNOW WHAT THE FUCK EMAIL IS? Why do Windows users feel it necessary to cram 50 different applications' functions into one super crappy, insecure piece of bloatware and then rave on about how superior it is?

Yes, from the vi/emacs flamewars it seems geeks are above that sort of thing, right?

People don't work with applications, they work with data. Say you start out writing a bullet point list. Then you see that you need some additional columns with a few formulas. Then you want to run some statistical analysis on them. From that you want to create a graph, modify it a little then add some logos and backgrounds before you want to send all this in an editable format to a friend of yours.

Maybe that involves:
* Word processor
* Spreadsheet
* Analysis tool (ok, overkill)
* Vector graphics tool
* Raster graphics tool
* E-mail tool

...but I could easily see how you'd like a tool that'd morph into any of those as you like, which could let you do all sorts of things like changing the base data = recalculate, update graph, apply all transformations and ask if you want to send an updated version to your friend comp+ete with revision control. In an ideal world, huge monolithic apps that contain everything including the kitchen sink sound good. In practise all it normally does is cover its weak spots by being part of a suite, with little fancy cross-integration.

Re:Stupid

[Anonymous Coward]

DO YOU KNOW WHAT THE FUCK EMAIL IS?

"Trying to teach a pig to read wastes your time and annoys the pig."

The sort of person who thinks that a "rich environment" for email is a good idea will *never* understand why it is a fundamentally flawed idea.

Re:Stupid

[SpaceLifeForm]

Weird. I can access an exchange server via Mozilla mail.
So, if Thunderbird won't do it, it must be a bug.

blocking is stupid

[Anonymous Coward]

however stripping HTML would be a better option as emails are usually sent as text/plain and text/html combined
blocking is just too drastic , perhaps IM would be a better option

Let them outsource!

[bogaboga]

If the DoD cannot find a solution to this kind of email, they should outsource its management to countries like India and Russia. Isn't it true that a good amount of our defense contracts are outsourced?

Re:Let them outsource!

[ScentCone]

If the DoD cannot find a solution to this kind of email, they should outsource its management to countries like India and Russia. Isn't it true that a good amount of our defense contracts are outsourced?

Um, they just did enact a solution.

And, no. You don't really have Indian outsourcing operations involved in the day-to-day admin of communications to and from the Pentagon. No.

Re:Let them outsource!

[Anonymous Coward]

Of all the things not outsourced, our defense contracts are #1 on that list.

Don't you recall the issues with the harbor security company that was taken over by the UAE-based business, which was eventually blocked? That wasn't strictly outsourcing, as it was a full price job, but the idea is that we mainly only trust in-country people, or close allies to get the job done when it comes to these defense contracts.

Re:Let them outsource!

[will_die]

The UAE company was NOT taking over any part of secuity they were taking over the cranes,etc the securuity was always being run by a local company and the US federal and state officials.

Also compared to what was happening they were not outsourcing it, since it was already outsourced, it was run by company based in another country. That was the only funny thing about about the whole thing, the Democrates were there yelling how about some evil forgein country would run the operation when a forgein country was already doing it.

Re:Let them outsource!

[glitch23]

They are outsourced but to domestic contractors so the contracts are outsourced from the perspective of the dept, not the country. The gov't doesn't have its own set of consultants, engineers, designers, and architects. The DOJ outsources IT contracts to Lockheed Martin, Northrup-Grumman, SAIC, CSC, Raytheon, and a bunch of others. Both the DOJ and DOD require clearances to do most contract work and they won't trust foreigners to do the work unless that clearance is passed (sometimes not even then), but the amount of work it would take to do a background check on multiple Indian-based employees would probably be too much to make it worthwhile to have an Indian-based contractor perform work for the US gov't. Basic clearance can take upwards of 8 months or so to complete for one individual who hasn't live in too many areas. I doubt many, if any, foreign-based companies get contract work due to the fact that the gov't doesn't even like using products from foreigners unless the country of business is an ally or the company has resellers in allied-countries.

That's pretty obvious!

[erroneus]

That's as obvious as the department of homeland security closing the borders!

I applaud the effort, but why did they take so long to wise up even this much?

Next step

[Anonymous Coward]

Lynx.

Get rid of IE.

Still ways to get email from outside the network

[Sepodati]

Although vanilla access to OWA is being blocked, there are still ways to get to your email from outside of the network (mainly what OWA was used for, anyhow). You can VPN into the network, log on to OWA using your CAC (common access card, smart card, etc), use your Blackberry (assuming your rank is high enough to get one ;)).

So instead of just plain old OWA sitting out there waiting for anyone to type in a username and password, they've upped the security a little bit. Yes, it's making us jump through hoops a little (for myself, need to stand up an ASA5510 as a VPN concentrator to receive outside connections), but it's not impossible.

Besides... not being able to check your work email from home can only be a good thing, no?? I know, I know, it's for people on travel, leave, etc. too...

As for the "blocking" of HTML email, can't say that I've seen that at all. Maybe it's only for emails that originate from outside of the network since we use HTML email all the time from within Outlook (formatting is useful in this case).

---John Holmes...

Moronic Policy

[mwilliamson]

As long as stupid users dictate policy (and it always seems to be the most idiotic, uninformed, timetable pounding and ego-blinded of all users usually are in the upper echelons of an organization), security problems do to software choice will prevail. This is how microsnot products usually get pushed into an organization. Score one for the DoD getting rid of freaking html-mail and outhouse web access. One can only hope they s**tcan ms-exchange while they're at it.

Re:Moronic Policy

[mwilliamson]

s/do/due

Re:Moronic Policy

[Sod A Dog]

This move is good, but it's still just a drop in the bucket, and they'll never drop ms-exchange while they're on their current contracts. The DoD likes to sign contracts that it can't get out of, even when the service provider is doing a terrible job managing and/or maintaining the network.

NMCI, the Navy - Marine Corps network, is one of the worst intranets I've ever seen. Poor support, poor reliability, slow clients, crash-prone servers, poorly implemented and mandatory smart-card login, not nearly enough bandwidth to go around, etc., etc., etc. When the senior enlisted man in the Corps can't log in for a week because his account got borked, there's a problem. There are platoons that have hired independent contractors to come in and build small networks that actually work, and they only use the government computers when it's absolutely necessary. Every single user of NMCI hates it and wants it dropped like a bad habit.

But they won't replace it because they locked themselves into a ten year-long contract and the brass says that it would cost billions to fix the damned thing. That's a poor excuse - the DoD wastes billions of dollars every month. Seriously, if you work for the DoD, don't expect anything related to your computer to work properly.

"This is a bad idea? It's not going to work? It's going to cost way too much? It's going to piss off everybody who has no choise but to use it? Perfect."

Re:Moronic Policy

[Anonymous Coward]

s/do/due

f/uck/you.

Goddamned worthless, non-contributing pedant.

Back to EMail as communication not art.

[aauu]

Way too much email formatting is pointless and does not enhance communication. Links work fine in plain text and images/complexly formatted data can be attached. This is a giant leap forward. Does anyone have MUTT client for windows?

Re:Back to EMail as communication not art.

[maelstrom]

Putty

Re:Back to EMail as communication not art.

[aauu]

Putty only works if the email server is *nix. I want a MUTT client for Exchange. Besides putty sucks compared to the real ssh client.

Re:Back to EMail as communication not art.

[Arker]

http://www.geocities.com/win32mutt/win32.html

Still, it's a better solution just to telnet to a real computer.

Re:Back to EMail as communication not art.

[rlwhite]

Links in email? It's against DOD security policy to click links in email. Copy and paste it.

Yeah, they're not losing anything by banning HTML email.

Good!

[porkThreeWays]

Good! HTML email is very annoying. Most of the time it doesn't display as intended anyway. Many clients will only support a safer reduced set of html thus only parts of the page will display properly. This makes the page even harder to decipher. HTML email is really only useful for spammers and advertisers usually anyway. If something needs to be that heavily formatted, attach it as a word processor document. If you can't get a basic idea across in plain-text, then the problem probably isn't because you are missing your bold tag.

Re:Good!

[Xugumad]

No, not a word processor document, please attach it as as PDF!

Re:Good!

[Simon Garlick]

Off the top of my head, here's a use to which I've put HTML email in the past week and I found it useful. It was something like:

"Alice, Bob and I have read your earlier queries and here are our replies. The black text below is the specific part of your email that we wish to comment on; the blue text is Bob's comments; the red text is my comments."

good

[jigjigga]

good, no reason to have flashy html junk- especially in an environment that needs security!

Temporary?

[Bluesman]

This appears to be a temporary measure based on the current threat level.

If the Infocon levels work anything like the other readiness levels in the DoD, then a shift to Infocon 4 requires a change (temporary) in policy. So it seems that a shift back to level 5 would mean HTML e-mail is no longer blocked.

It's like after 9-11, when all DoD installations had much stricter physical access rules and extra guards at the gates.

Which is a shame, because saying goodbye to html email entirely would be fine by me.

Re:Temporary?

[Locutus]

good point but another option is to put an email cleanser inline to remove all problematic formating. Also, because they will probably not give up Microsoft software for this, they have to realize that a major change is needed for longterm protection.

Who knows, maybe they will 86 MS LookOut.

LoB

Re:Temporary?

[DoctorStarks]

This appears to be a temporary measure based on the current threat level.

Well, that makes sense, except for the fact that the threats against which they are defending are not likely to diminish in any way.

I think they are in for the long haul. If anything, the problem will only get worse and security will be tightened further.

Blocking? Looked to me they were just converting.

[MysticOne]

I work as a contractor to the Navy, and we received e-mails a few weeks back saying that HTML e-mail would no longer be allowed. However, they weren't blocking it, merely converting anything that was HTML to plain-text or RTF. I've not tested by sending an HTML e-mail to my .mil address (gonna try that in a few minutes), but I don't think they're actually blocking it.

The grinch that stole HTML

[Anonymous Coward]

• B,b,b,b,but I likes it and I likes sending my newsletter in red comic-sans

After arguing this with people whos knowledge of email extends to clicking the correct buttons in their GUI client, I've given up. The more convincing arguments were always the ones about those who have trouble using email. They weren't a convincing argument for HTML email, they were just a convincing argument that some folks shouldn't be using computers.

Re:Blocking? Looked to me they were just convertin

[Anonymous Coward]

Yes that is all they are doing. In fact, if the formatting comes across screwed up, there is an option to restore html view. Not sure just what rules are applied and how the emails are being affected. I do know I sent a table copied another M$ product and sent it to my supervisor, which he replied back to me. The table was completed screwed up in plaintext mode. However, I did have the option of viewing the 'original format' or something close to it that put the table back the way it was.

I've been doing this for work for ages

[Kris_J]

I determined a couple of years ago that in order for the small IT department of one (me), to be able to keep up with potential Outlook security problems, I had to filter HTML down to Plain Text. When you've got a program that can be used to infect a computer just be previewing a message, you have to do _something_. Now that we've install Exchange (bleh), internal messages are no longer filtered, but thankfully the old filters for stuff going in (and out) of the company remain in use.

There's no excuse for it

[thewils]

If you know how to use HTML, you should know how to be able to write an email without using any HTML.

If you don't know how to use HTML, you shouldn't use it, period.

I know this is redundant, but...

[Runefox]

HTML wouldn't be such an exploitable thing with e-mail if Microsoft's mail software weren't so full of holes. If Outlook/Exchange is really that important to some organizations, why not offer support for [b]internal[/b] mail to be sent in Microsoft Word format?

Re:I know this is redundant, but...

[Dachannien]

why not offer support for [b]internal[/b] mail

Given the topic of the OP, there's definitely some sort of irony here.

Re:I know this is redundant, but...

[LurkerXXX]

There have been exploits before in mozilla/thunderbird, eudora, etc.

HTML doesn't belong in emails.

Re:I know this is redundant, but...

[SuperJew]

Sounds great in theory, but as an Army Netadmin, I can tell you that users forward junk. Anything that's already in the network would still circulate if we left internal comms HTML.

Just sayin.

Re:I know this is redundant, but...

[1u3hr]

why not offer support for [b]internal[/b] mail to be sent in Microsoft Word format?

For one thing, there are plenty of exploits for MS Word. So for going to a hugely bloated obfuscated binary format you'd gain no security. Like most peopel I get lots of messages sent as DOC attachments already. I usually view them, copy the text, paste into the original message as text (my client, Eudora, lets me do that) and delete the attachment, usually converting a 100k file into 1k text.

And Word files don't have a standard way to handle quoting and replying. So you get everyone making up their own "system", like "Original lines in blue, Jack's response in green, boss's remarks in Arial italic..."

Be... all that you can be... in ASCII

[MillionthMonkey]

All I can say is, the war in Iraq must be going really badly if the DoD is this desperate for additional recruits.

Doesn't that break digital signing?

[khasim]

If the content of the message is changed, isn't the digital signature invalidated?

Or is the DoD just skipping the concept of digitally signing email?

Re:Doesn't that break digital signing?

[WED Fan]

If the content of the message is changed, isn't the digital signature invalidated? Or is the DoD just skipping the concept of digitally signing email?

The content doesn't change, just the rendering.

Re:Doesn't that break digital signing?

[emurphy42]

How many people do you really think there are who (1) write HTML messages and (2) even know what digital signing is, much less use it?

Re:Doesn't that break digital signing?

[Anonymous Coward]

Well, by direction all DOD folks are supposed to digitally sign emails if they are providing direction or critical information to others. In addition, they are supposed to encrypt emails if they contain sensitive info. Problem is that encrypting has the bad side-effect of rendering the email unreadable via OWA, which represents the only email access for quite a number of DOD users. Given that the direction to start signing emails was part of the INFOCON directive, it's not hard to jump to the conclusion that there is an ongoing problem of spoofed emails. The problem of non-repudiation of email has always existed of course, but seems to be getting special attention lately. Ironically the ability to centrally manage email certificate via AD and handle all the certificate publishing, etc required for encryption are the reasons why Exchange/Outlook were chosen as the DOD standard in the first place. They initially standardized on Netscape, but Netscape didn't really support their requirements and the Netscape developers had no interest in making the product fit their needs.

Re:Doesn't that break digital signing?

[misanthrope101]

No one "writes HTML messages" in that they don't hand-code the HTML. But they routinely hit bold or italic, paste in tables, change font size and color, and so on. If HTML is so bad, how did this whole WWW thing take off? It isn't as if Amazon.com points to a plain-text list of books available, and an email address where you can send orders. HTML is useful. Allowing a subset of HTML function to allow for text formatting (tables particularly for me) would be useful. As much as I valued VT terminals (when we had them at work, "the system" went down less often) I do sort of like these newfangled conveniences.

Re:Doesn't that break digital signing?

[Cerebus]

"Problem is that encrypting has the bad side-effect of rendering the email unreadable via OWA"

Only OWA on Exchange 5.5, Exchange 2000, or the (future) Exchange 2007. Exchange 2003 uses a pre-installed ActiveX control to handle S/MIME at the client.

Re:Doesn't that break digital signing?

[Genocaust]

Or is the DoD just skipping the concept of digitally signing email? Actually the majority of the DoD signs and encrypts emails with the cerfiticates on our smart cards. And yes, there was push from the top to disable HTML email and have Outlook default to RTF, but it's still quite possible to change it to HTML. In my own experience, I still recieve HTML emails fine, too. Nothing on them is altered.

Re:Doesn't that break digital signing?

[marsonist]

The military issued Common Access Cards to all service members and DoD employees, that not only act as ID cards, but are smart cards which carry signing/encryption certificates. Slowly but surely the DoD is requiring these cards to simply log on to computers. Certain places have implimented a manditory signing policy requiring your private pin to send any mails. So to answer your question, many personel may not understand what exactly what signed e-mails are, but the powers at be aren't going to let that stop them from 100% implimentation.

Re:Doesn't that break digital signing?

[Anonymous Coward]

Working for the DoD I don't do Windows.

But I understand that all that is done
is to set a flag in outlook to display
the Text version and not the HTML version
of messages.

Messages with out a text version
may display like lynx would have.

And the problem with this is?

[imasu]

I block html email myself simply because it is annoying and 90+% is spam anyway. Why is this a problem?

Re:And the problem with this is?

[fluffy99]

Because 10% is not spam?

Re:And the problem with this is?

[imasu]

Frankly, who cares? This is the DoD we're talking about; you want to use email to communicate with them, you play by their rules. Also, this is email we are discussing, not some kind of atomic database transaction. If it's important, you had better ensure the recipient got it via a reply or some other means.

Re:And the problem with this is?

[dodobh]

But it is annoying and unwanted. Just not spam.

What no stationary on my e-mails

[Anonymous Coward]

and what about those cute little Microsoft Office pictures? How will I ever be able to get my point across using just words?

Not Banning OWA

[Anonymous Coward]

Just not without CAC. If you have CAC, you can use it.

Re:Not Banning OWA

[TrisexualPuppy]

lick them

Re:Still ways to get email from outside the networ

[Anonymous Coward]

Well if you are DOD and you are not blocking/converting html emails then you are in violation of standing DOD directives. And no you are not allowed to simply stand up a VPN without going through the proper approvals either. So what command are you in, so we can shut down your NIPRNET connections. After all you appear to be part of the problem that they are trying to correct (ie incompetent system admins who put priority on easy of use instead of security).

data + code = screwed

[Duncan3]

Yay! How profound that what we've always known finally made it into the heads of the military. If you mix code into your data, you're screwed eventually. No way around it.

That said, it's the JavaScript, not the HTML - formatting is data not code.

Now if only they would figure out the same about Word/Excel.

Re:data + code = screwed

[Anonymous Coward]

Hehe, actually, at the same time this was implemented the Navy did block all incoming MS Office formats as well. The IT dept. is constantly attempting to trade off our usability for added security. But where does this completely reactionary behavior stop? It's honestly at the point now where email is worse than useless as an engineer. We recieve dozens of useless "All Hands" emails IN ALL CAPITAL LETTERS, because apparently these Navy captains haven't heard that morse code is dead. If I want to actually get an attachment someone sent to me, I need to send them a message telling them why it was stripped, then have them rename the extension to something that the firewall hasn't already blocked. It's less hassle if I communicated by smoke signals. Then again, I would have to take an annual smoke safety online training class.

The HTML determines the rendering.

[khasim]

If the HTML is stripped from the body of the message, that means that the content of the message has changed from the context of the digital signature.

Therefore, the digital signature will no longer reflect the "data" portion of the message and will be invalid.

Re:The HTML determines the rendering.

[Beryllium Sphere(tm)]

Yep. S/MIME signs the whole package including the MIME headers. " Demime is designed to break signatures". Not sure, but it looks like PGP/MIME has the same problem.

You could still sign plain text and send that. Or send an attachment with a detached or builtin signature. Microsoft Word documents could have a signature and timestamp through the USPS Electronic Postmark system.

Re:The HTML determines the rendering.

[WED Fan]

O.K., one more time, and this is a message from the inside: Just the rendering is changed. When I get an HTML email on my .mil account, I see raw mark-up. It just does not render as html. It's the same as if you open a web page and view the source. It's signed, and unchanged. It is un-rendered.

If I get more specific, the DHS will visit you and use their little flashy things and make you forget. And, yes, we have those little...shit, what was I saying?

Re:The HTML determines the rendering.

[Anonymous Coward]

Outgoing messages are converted from HTML/Rich Text to Plain Text in Outlook before the message is singed/encrypted and sent.

Re:The HTML determines the rendering.

[Cerebus]

An Outlook group policy is also supposed to be pushed to disable sending of HTML formatted messages. If your admins have been paying attention to the NOTAMs, that is.

Re:The HTML determines the rendering.

[jonbryce]

The incoming server can check the signature before stripping the html, and mark the message as having a valid signature if appropriate.

Re:The HTML determines the rendering.

[WED Fan]

NMCI.

EDS is still trying to hire people that can spell NMCI, let alone run a network.

Re:The HTML determines the rendering.

[Cerebus]

I'm not allowed to speak ill of my swabbie and jarhead brethren. Or the contractors they hire, either. :)

Too late...

[myowntrueself]

the only losers are the people who send those annoying Flash giftcards through email

Don't worry, they were already losers!

Re:Still ways to get email from outside the networ

[phobos512]

I still receive all the HTML email I did previously - it's just converted to text formatting. A great deal of it is virtually illegible as some of the places I would receive email from had elaborate background files to their emails - now I just get a jumble of URLs at the start of those emails and have to search for the actual content.

The other problem is that (at least at my agency) we are still forced to create emails in Outlook RTF even though official policy was to switch Outlook to creating text-formatted emails (the option is locked thanks to our user settings). So our emails never get to where they are going looking the way they did when we sent them as they lose all formatting.

why doesn't Microsoft indemnify such flaws

[Locutus]

well, you already know the answer. Too bad nobody at the DoD is willing to step up and ask why their *nix systems are not having these problems.

LoB

Re:why doesn't Microsoft indemnify such flaws

[Homme de la Renaissa]

Do you seriously believe *nix systems have no security problems? Anyone who belies they're invincible is probably the easiest target around. Look at some reality. According to secunia.org:
- Windows Server 2003: 112 advisories in the last 48 months (2.3/month)
- Windows XP Professional: 149 advisories in the last 48 months (3.1/month)
- Solaris 10: 84 advisories in the last 27 months (3.1/month)
- RedHat Enterprise Linux WS 4: 244 advisories in the last 23 months (10.6/month)
- OpenVMS 8: 1 advisory in the last 14 months (less than 0.1/month)
- OpenVMS 7: 9 advisories in the last 41 months (0.2/month)

*nix systems look like the loser here, don't they?

Also note that the Core Impact penetration testing tool has more Linux exploits than Windows exploits.

And then there were the Honeynet Project's results. They found that the average time to get compromised for Linux was about 90 days. None of the Linux boxes lasted even a year without getting compromised. Hardly anything to brag about.

Slashdot strikes again......sigh.

[LibertineR]

Folks, the DOD is NOT blocking HTML mail, just converting it to plain text and disabling scripts, something ANY Exchange admin should already be doing in addition to Sender ID.

Instead of facts, we get just another bash Microsoft thread. Figures.

Re:Slashdot strikes again......sigh.

[Anonymous Coward]

> in addition to Sender ID.

WTF are you checking against? My SPF records were published long before Microsoft announced their intent to misinterpret them using technically unsound PRA nonsense. So please don't check Sender ID - check SPF.

Re:Slashdot strikes again......sigh.

[Tempest429]

Instead of facts, we get just another bash Microsoft thread. Figures. Welcome to Slashdot

Re:Slashdot strikes again......sigh.

[houghi]

And those admins also should disable HTML posting by defailt. Unfortunatly where I work, I can not even disable the HTML posting. :-(

The reason it will become another "bash Microsoft thread" is because they have caused it. They are also the reason that when you get a CC later in a converastion, you need to re-read the thread 6 times due to all the top, botoom and inline quoting with everybody using something different.

Even if everybody uses Outlook and topposts, it is almost unreadble after a while and that is only due to the fact that some programmer did not know ho to place the cursor at the end, remove the signature and put a '>' in all that one replies to.

Re:Slashdot strikes again......sigh.

[hercubus]

no HTML content, but one can still attach the usual not so secure Microsoft Office docs. Microsoft _is_ the problem here, but as has been a habit of late, the DoD is going after the wrong target

they also block yahoo and google mail - two very safe services

so it's not about security, it's about control and the stoopid people in control

NMCI goes even further

[truckaxle]

Any here that are forced to use the NMCI (Navy/Marine Corps Intranet) network know that reading any email at all can be a challenge.

A NMCI laptop takes over 10 minutes to boot and load the dozens of background processes and roving preferences. Once booted the machine is near useless performance wise.

Most, including middle management, refer to NMCI as No More Computing In-house.

In order to get idea just how bad things are, upper management conducted "customer satisfaction surveys". Even though the NMCI program office controlled the content, distribution, and analysis of the survey the results indicated overwhelming dissatisfaction. The NMCI program office has declined to release the raw data from the survey, instead issuing a release about the results. Rear Admiral J. B. Godwin III said releasing the results would challenge the "integrity of our data." Hmmm....

Most Navy labs that are under the burden of the NMCI contract maintain two networks, the legacy and the NMCI - the one to get work done on an the other to read email. This leads to double the costs and double the vulnerability exposure, and halves the resources to concentrate on security and usability.

Worst I hear that the Navy just extended the contract to 2010. Your tax dollars at work.

Re:NMCI goes even further

[Anonymous Coward]

The legacy networks are supposedly strictly for R&D work, and they're largely getting phased out. They imposed server count caps and keep lowering them. Even if all the servers there can be justified under the policy, oh well, something's gotta go.

Every software application on a Navy network is supposed to be entered into a database. Somebody in DC imposes a cap on the number of apps allowed, then goes through the database disallowing specific ones to reach the cap. Heck if they know anything about the apps they're banning.

Navy IT right now is the epitome of bureaucracy run amok.

Re:NMCI goes even further

[Bios_Hakr]

NMCI is an admin's dream. CAC authentication means no more password issues. Locked-down desktops means no more shareware crap. Remote desktop and remote program installs means reduced admin visits.

Of course, paying $5000 for a shitty computer sucks ass. Plus what, $500 per user? On top of that, you have to pay retail for every app you want.

I have a CD-Burner in my NMCI machine. If I want NERO installed, I have to pay $300 for a cd-burner (because my build does not show a burner even though any idiot can look at the face-plate and see it's a CD/RW) and $100 for Nero.

NMCI is making out like bandits on this thing.

If you want to see the next step, look at the USAF's SDC program. They are using WinXP with some sort of Trusted Computing module. Unless an executable is digitally signed by the USAF, it will not run. Plus, the firewalls are on by default and highly locked. In a lot of cases, people going to SDC could no longer do their jobs. Even programs that were developed by USAF programmers in-house would no longer function.

On SDC, you can't even change your desktop background, color scheme, file view settings (I like a detailed list vice stupid thumbnails), or sound scheme. Most USB thumb drives fail to work, but you can still burn a CD.

On a clean SDC install, my computer shows 350MB of memory in-use on a machine that only has 512MB installed.

Re:NMCI goes even further

[Anonymous Coward]

I have heard it refered to as "No More Connection to the Internet".
The whole GIG should just be outsourced to EDS!

Re:NMCI goes even further

[Foolhardy]

If you want to see the next step, look at the USAF's SDC program. They are using WinXP with some sort of Trusted Computing module. Unless an executable is digitally signed by the USAF, it will not run.

IDK how SDC is implemented, but XP has a built-in capability to only run signed programs via Software Restriction Policies. An admin can set the default rule for binaries to disabled, and only allow specific ones identified by path, hash or certificate to be loaded.

Most of the other restrictions you mentioned can also be accomplished with the built-in group policies.

Re:NMCI goes even further

[zaytar]

Most, including middle management, refer to NMCI as No More Computing In-house. Locally, we say "Needs More Congressional Investigation" or "No More Communication or Interoperability".

Remeber SoBig or was it Slammer?

[WheelDweller]

This little beastie got into an offline nuclear reactor and blanked their control of it for four hours. The same bug shut down monitoring on a CSX rail line, causing just as much concern.

How many years ago was all this? Sounds like the paperwork just got filed.

Good move.

Haha! I Love It!

[Anonymous Coward]

Haha! I love it! Only about ten years before everyone else banned it and a mere fifty years before all the morons of this world (including David 'don't tell me I can't send HTML mail' Pogue) decide they're not going to give it up anyway.

And just a reminder that AutoDesk John Walker YEARS ago called HTML mail 'the hallmark of the clueless'.

Hooray.

Microsoft RTF (was text/enriched)

[MillionthMonkey]

I remember getting an RTF-formatted email from my ISP back in 1995, when you would actually see RTF in the wild.

I chose RTF as the format for my reply. I thought that was reasonable. (I forget what mail client I was using- maybe Eudora.)

They wrote me back, again in RTF.
"WTF is this? We can't open it."

No, not WTF.
Microsoft RTF.

Re:Still ways to get email from outside the networ

[Anonymous Coward]

Yes, I have to go through the proper approvals for VPN. It's still a valid option for getting back into the network from outside for the right people with the right approvals. That's all I was saying. Or OWA with CAC or Blackberries.

Unless my DOIM is lying to me... they wouldn't do that, would they? ;)

---John Holmes...

INFOCON Crap

[Anonymous Coward]

USAF uses INFOCON and FPCON (Force Protection) Alpha, Bravo, Charlie, and Delta (Alpha lowest & Delta highest). The article sounds like it was written in the THREATCON days when they went "backwards" in order...

http://www.e-publishing.af.mil/mastercatalog/produ ct.asp?cat=sub&code=VA

Enemies!

[DoofusOfDeath]

It sounds like DoD IT people hate users' freedom! Sounds like we've found an Al Quida sleeper cell right in the DoD!!!

Damn - there goes my (to be patented) security

[Tribbles]

I encode all my emails using WingDings font, so absolutely no-one can read them :) I can't do that in plain text!

Re:Damn - there goes my (to be patented) security

[Anonymous Coward]

Just use rot-26 encoding. It works well in ASCII, and is almost as secure.

Gates is on his way to Washington

[Anonymous Coward]

How Dare they mention the fact that Outlook Web services can be exploited. Now Where did I put that suitcase full of Campaign contributions ?

Hardly newsworthy or new...

[YomikoReadman]

I hate to say it, but this isn't anything new. The USAF has been moving in this direction for quite a while, with a service wide mandate that came down back in June. I don't recall the exact date, and since I'm not at work, I don't have access to the email which contained the policy. Additionally, There's also been a DoD wide move towards a 'Standard Desktop Configuration'.

All in all, DoD is moving towards more secure networks, and making things a lot harder for the user to screw up on their own, as well as making it harder for people on the outside to get in and do much the same. Will it be effective? I'm not sure, although I personally think that it's not going to happen as long as they're set on remaining largely windows based. Moving to Vista isn't going to happen anytime soon, so any improvements there aren't going to be available for the near future.

Good! As an IT guy it pisses me off!

[Aphrika]

It's not security, it's not size.. it's the bleedin' fact that every sodding day some bellend asks me how they insert >picture/video/stupidlink< into their email. I'm fed up with it! I'd rather feed their bones to pigs!

Merry Christmas by the way.

Incidentally, if those bloody angle brackets are the wrong way round - blame the sodding HTML! Merry Christmas again... and yes, I've been out getting lathered, deal with it! :o)

Re:Good! As an IT guy it pisses me off!

[Anonymous Coward]

I'm fed up with the size. Fuckheads can't even compress a jpg before sending their shitty photos over a text transport. Then as postmaster I have to explain why we reject messages over 5MB. Apparently we're in the wrong because other MTAs are (mis-)configured to swallow their pointless fucking emails.

Merry fucking yule you cunts!

Re:Your Sig

[Millenniumman]

In the free world the media isn't government run; the government is media run. If that's truly your opinion, it's quite fearful. The media should report the news, not control the citizens or the government, regardless of whether it has third party influence.

one more point

[commodoresloat]

And that is that the web browser is designed specifically to deal with html. New html security holes are dealt with by web browser patches on a regular basis (for the good browsers anyway). Email clients read html as an extra; their main function is to send and receive email -- hopefully they will be updated regularly too when new security threats arise, but it's more likely to be an afterthought. That's another reason why I'm a proponent of having clients do what they are supposed to do and then pass the other protocols on to other clients rather than trying to do everything within a client that was primarily designed for one protocol. Why have a web browser read email and an email program handling HTML?

Call for a new Vote Topic:

[xski]

What do you think of the DoD's banning HTML email and going back to plaintext?

1. OMG! How am I supposed to share my baby pictures?
2. They're overreacting to a problem with readily available and easily implemented solutions.
3. Told you so! Told you so! Told you, told you. told you so!
4. Send in Cow-Rambo-y Neal!

software stupidity

[oohshiny]

It shouldn't be rocket science to display a piece of formatted text while disallowing network connections or scripts.

The fact that none of the major E-mail clients can be trusted to do this is a testament to the sad state of software engineering.

Re:software stupidity

[1u3hr]

The fact that none of the major E-mail clients can be trusted to do this is a testament to the sad state of software engineering.

I think it's more that to get the same look as intended by the sender using an MS client, you have to use the IE renderer built in to Windows. Otherwise people complained it looked wrong. And this was no doubt a lot easier than writing your own renderer and keeping it up to date.

Personally I stick with an ancient version of Eudora, which does have its own renderer. Sometimes it does look like crap when I get HTML mail, but I can usually work it out, and in the worst case, save to HTML and use a browser. One useful feature is the ability to edit incoming mail. I can select it all, convert to plain text, maybe delete any boilerplate disclaimers. Cuts the storage down by 80%. I know that businesses couldn't do this, but this is my personal stuff and I'm not going to be presenting it in court.

Unenforceable

[Anonymous Coward]

Too bad this policy is unenforceable. I work for one of the DoD branches and I got this message a few weeks back. I asked a friend who worked at the Dept of Info Management how they expected to enforce people from sending out HTML emails because everyone I knew sent HTML emails. His reponse was that it couldn't be enforced so there's nothing they could really do.

In most contexts, this is overkilll, but DoD...

[WoTG]

A lot of folks are going to say that this is overkill. A safe email client, patches, scanners, etc. should be "good enough". Well, if I was American (as opposed to Canadian), I'd say that this move by the DoD is a good one. Who cares if the risk is "small"? There is a higher risk with HTML email than plain text, and only marginal benefit. We are talking about an organization that needs to operate at very high levels of security.

NMCI: One of the great defeats in Naval history

[HangingChad]

A NMCI laptop takes over 10 minutes to boot and load the dozens of background processes and roving preferences. Once booted the machine is near useless performance wise.

That is so true. The Navy needed technical standards, not NMCI. The organization is too big and diverse for a one-size-fits-all solution. Application development has all but stopped outside of San Diego and EDS is running...or should say ruining...most of that. Layers of process and bureaucracy between the users and a usable product. What used to take months and cost thousands, now takes years and costs millions.

One example project...a working system built by just three developers in less than a year, part of the way through deployment when EDS moved in to take it over. Now there are 30 people on the project and they're scoping requirements...of a completed product in the middle of roll out. It's taken them almost two weeks to set up a test server.

When you take the billions invested, then add the man-hours wasted with people waiting on the help desk line the cost would be staggering. And I've never called when they weren't experiencing higher than normal call volume. When you have to play that message all the time, that means the normal call volume exceeds your capacity.

I will say this, though, after the 20-30 minute normal wait to get to a help desk operator, I've been very satisfied with them. That's the one part of the program that does work but doesn't justify the cost. I consider NMCI one of the great defeats in Naval history and casualties are 250 million US taxpayers.

Good to hear...

[SanityInAnarchy]

...The trouble is, they should've done this ten years ago. At least the HTML mail... It's a bit scary that the DoD is taking so long to get reasonably secure. Department of Defense, people!

Re:Good to hear...

[YomikoReadman]

While what you're saying is certainly a valid argument, ten years ago it wasn't a DoD priority. 10 years ago, any base that had any reasonable amount of connectivity was home to a NOC. Now, things are vastly different. Even bases which don't house them, never have, still have high speed connectivity.

Yes, it's the Department of Defense. However, Cyberspace and that realm in general has never been seen as a serious threat. It's only in the last 2-3 years that any branch of service has seen it as a viable battlefield. Even now, I'm not sure that the Armed Services as a whole are taking it seriously. However, I will say that if nothing else, the USAF is steering in a direction to take it on as part of their mission; The recent reissue of the USAF mission statement shows this: 'To provide sovereign options to fly and fight in Air, Space and Cyberspace'. Is it overly dramatic? To an extent, I'd say so. I'd also say that it's a step that needs to be taken.

I didn't say much about myself in my prior post; I'll do so now. I'm junior enlisted getting towards the end of my first term. I plan on staying in for quite some time. I feel that as a mission statement to tell the majority of Airmen what 'we', the Air Force, does, it's a bit off. However, it does say what we intend to do moving forward as a service. The Air Force intends to be the 'go to' option for any military action that the US needs to take in any of those realms. To be at the forefront of warfare based in Air, as is our traditional role. To be at the forefront in space, as we as a race begin looking beyond the atmosphere once again. Finally, to dominate in Cyberspace; denying haven to modern terrorists who seek to further the growth of their ideals on the internet.

I'll close with this; ultimately, this is all strictly my personal opinion. I say this as an individual, and despite my association/employment by the USAF and DoD, I support these and all other efforts in that capacity as well.

Cheers.

Why Treat Only Unknown Senders as Hostile?

[darkonc]

From: Donald Rumsfield
To: General Whosit
Subject: My final Orders

This email contains a computer trogan.

You are so pwned!!!

Sincerely
Osama Bin Ladin.
____

Yeah... Typos are on purpose

Not that big of a deal

[Anonymous Coward]

HTML emails are still allowed internally which most email is internal anyway. It's not about the web access it's the fact you need an ID card to log on making outlook web access useless.

Converting Gateway

[morcego]

Why don't they simply add some format conversion feature on the border e-mail gateway ? That way, HTML messages gets converted plain text before delivery.
Then again, maybe they use Exchange, and can't implement something of this sort. I know it is, if not trivial, relatively easy to implement on many F/OSS MTAs (namely exim).

Re:Still ways to get email from outside the networ

[aliscool]

Dude here is correct. I work at the Staff war college that the article mentions. We set up a seperate CAC enabled OWA footprint and when one got turned off we flipped the DNS switch to the other. Install some middleware and use your CAC card. Much more secure and really no big deal to do.
HTML email is no loss. Folks can still send word docs or use rich text. We improved out security posture significantly.
People can still VPN is as well, again using their CAC card.
I myself have cut back on checking email from home as I usually leave my CAC downstairs and am simply too lazy to go down there and get it to check email.

Why not just "sanitize" the HTML?

[Anonymous Coward]

Why are they blocking the html totally?

Why can't they just have a white-list of allowed tags that are known to be harmless? (<p>, <b>, <i>, etc.) and then strip out all the others?

Not blocking, just converting

[alodien]

I am a DoD employee and saw them take this step a few weeks ago (without any notice, of course).

They don't block HTML mail specifically, but every email is "converted to plain text" by outlook. A very, very big hassle, especially when the boss likes to highlight and bold text in his emails. He can still do this because Outlook doesn't force you to compose in plain text. However, when it gets to the employees it can be confusing due to the conversion process (especially to the "old" folks who can't figure out how to convert it back to HTML).

They actually have disabled many of the options in Outlook so there is no way to allow Outlook to always show emails as HTML. A major pain, in my opinion. I always have a need to format tables of infomation and embed them in my emails. Oh well, time to change my ways - life goes on.

amen

[piepkraak]

If god wanted us to write e-mails in html, He would have said

My middle ground - both

[NotQuiteReal]

As an old boss once used to say, when presented with options - "Do Both!"

I read all my e-mail as "plain text". After all, HTML is plain-text too.

95% of the time that is all you need. Yeah, I can see they marked it italics or bold, but they are the same words.

If, after looking at the "raw" text, and I really think the formatting will convey some additional info, I might look at it as "html". Looking at the raw text gives you a pretty good idea if there is anything sinister about it.

In my experience, most HTML mail that "needs" HTML is junk mail, office jokes and the like.

Real business correspondence works on typed pages and plain text. No HTML needed to get your message across. Oh, but please do use a spell checker.

not entirely

[misanthrope101]

My workplace recently did something similiar. I was never crazy about flashy colors and zillion font options. But I do miss the ability to send tables as part of the email. My job frequently involves info that is best represented in a table, and the ability to copy/paste a table into an email was very helpful. Even allowing for the limitations of plain text,

Outlook did me the favor the other day of removing the "extra" line breaks, screwing up the already limited formatting I was stuck with. People will get around this by attaching a Word or Excel document. So the bandwidth costs are only temporary, till they figure out how to get back the formatting capability they had. The search function will be severely limited, unless Outlook will search through attachments.

I think forcing plain text is a bit severe. I understand the vulnerabilities of HTML, but allowing a reduced subset of HTML function to provide for text formatting would be a better (as in more useful for the end user) option. If the IT folks are the only ones whose convenience is being considered, I guess plain text is fine, and for that matter we should still be using diskless VT terminals. I don't often use the "threw out the baby with the bathwater" cliche, but I think it fits here. Allowing tables and italics isn't going to kill us.

Re:not entirely

[bendodge]

Sanitizing the HTML somebody pasted from a random word processor isn't as easy as it looks. Ever studied the code outputted by some programs? It's a mess.

Cleaning messy code required complicated scripts, and complicated parser scripts are terrible vulnerable to odd code that goes in as special goop and comes out as working code. It's one of the most basic attacks. Think, people.

Re:not entirely

[AaronLawrence]

Perhaps more to the point, does Outlook HAVE any HTML sanitiser? Mozilla does of course - perhaps they should just have switched to thunderbird? :)

Re:not entirely

[jonbryce]

Outlook 2003 does. If I remember correctly, it removes external images (such as , vbscript, javascript, flash, java and activex.

However, there are still buffer overflow vulnerabilities from time to time, and plain text email is much safer in this respect.

Re:Still ways to get email from outside the networ

[Anonymous Coward]

There is a reason why the Army networks are the most hacked of all the DOD networks. It starts with local command DOIMs (equivalent of local CIO for those wondering what that meant) not bothering to even read, much less implement JTF-GNO directives. Whether you are implementing a secure architecture is not the point. It's the fact that it's not consistent across commands. When a new zero-day exploit comes up, way too much time is wasted trying to figure out who or what is affected. A consistent standardized architecture is a well understood set of risks and tradeoffs. Often times, vulnerabilities go unaddressed because no-one higher up realizes that joe-admin at command xyz stood up their own non-standardized VPN that is now a giant hole in their network.

tables are HARDER, no?

[misanthrope101]

I concede your point, mostly. But my bosses want tables. I need the ability to copy/paste tables and queries from Access into an email, and limiting my emails to plain-text means I have to copy/paste the text, then manually format the table into pretty columns. And the first time a boss forwards my email to someone else, the formatting is screwed up again. I don't need the full spectrum of HTML capability, but tables are useful. Give me the tabular environment from Latex, or something. People will just adapt by sending attachments, and the entire plain text of the email will be "see attached." Does Outlook's search/find function work on attachments?

Re:tables are HARDER, no?

[Anonymous Coward]

Your bosses are idiots. Things where formatting matters, as in tables, should be put in attachments. Leave the body of the mail for plain text, where you can say "the tables are in the attached file". Sorry, but embedding COM objects in the body of a mail message is just stupid, for a whole bunch of reasons.

Re:tables are HARDER, no?

[Anonymous Coward]

The solution there isn't HTML email; rather, the solution is to find/create an email client which can take data pasted from MS Access (or any other program) and create from it a plain text table. Shouldn't be too hard to do, just need to insert a few tabs/line breaks in the right places.

duh

[tovella]

most of the computers i have at home are set up to NOT accept html email. they've been set up that way for years. the DOD should have done this years ago. the also should have dumped MS Outlook years ago. these are the people (the DOD) who are supposed to keep us safe?

There is no infected html ...

[twitter]

... there are only broken email clients. It's the crappy OS that is infected not the protocol.

I like the way Kmail does it. It displays the silly html as text, with a button that asks you if you want it rendered. A quick scan shows you who it's from and if the thing is legitimate. Clients that are all or nothing and riding on an OS that's full of holes are the cause of the problem.

Re:There is no infected html ...

[Anonymous Coward]

Wow, you can't even take Christmas day off from being a prick, can you?

Re:There is no infected html ...

[Anonymous Coward]

twitter, please read this carefully. Following this advice will make Slashdot a better place for everyone, including yourself.

• As a representative of the Linux community, participate in mailing list and newsgroup discussions in a professional manner. Refrain from name-calling and use of vulgar language. Consider yourself a member of a virtual corporation with Mr. Torvalds as your Chief Executive Officer. Your words will either enhance or degrade the image the reader has of the Linux community.
• Avoid hyperbole and unsubstantiated claims at all costs. It's unprofessional and will result in unproductive discussions.
• A thoughtful, well-reasoned response to a posting will not only provide insight for your readers, but will also increase their respect for your knowledge and abilities.
• Always remember that if you insult or are disrespectful to someone, their negative experience may be shared with many others. If you do offend someone, please try to make amends.
• Focus on what Linux has to offer. There is no need to bash the competition. Linux is a good, solid product that stands on its own.
• Respect the use of other operating systems. While Linux is a wonderful platform, it does not meet everyone's needs.
• Refer to another product by its proper name. There's nothing to be gained by attempting to ridicule a company or its products by using "creative spelling". If we expect respect for Linux, we must respect other products.
• Give credit where credit is due. Linux is just the kernel. Without the efforts of people involved with the GNU project , MIT, Berkeley and others too numerous to mention, the Linux kernel would not be very useful to most people.
• Don't insist that Linux is the only answer for a particular application. Just as the Linux community cherishes the freedom that Linux provides them, Linux only solutions would deprive others of their freedom.
• There will be cases where Linux is not the answer. Be the first to recognize this and offer another solution.

From http://www.ibiblio.org/pub/linux/docs/HOWTO/Advoca cy

A little late are we?

[Anonymous Coward]

The Air Force has been banning all webmail sites, save for GI Mail, since 2002.

Re:Still ways to get email from outside the networ

[Cerebus]

"Install some middleware and use your CAC card"

CAC. *CAC!* Say it with me: "CAC." Does "Common Access Card card" make sense to you?

Sorry. Pet peeve o' mine. But I live this field.

read the fine article

[JoeBuck]

This is exactly what they are implementing (converting HTML mail to plain text).

Re:read the fine article

[morcego]

What ? You mean the slashdot post was misleading ? Or should I even say, wrong, by stating it was being "blocked" ?

Unthinkable.

Re:Still ways to get email from outside the networ

[Anonymous Coward]

So I guess you're a huge supporter of the single-DOIM concept and all of these regional centers that hold and control all of our data for us? So the entire force can just be a thin-client off of these, basically?

This will work great when I tell the CG he can't get to his mail and even as his G6 I can't fix anything... "Let me make a few calls Sir and submit a trouble ticket. I'll get back to you." Or even better when we're deployed and half of our systems depend upon a regional hub that we have no control over? "Sorry you can't see that predator feed Mr. Brigade Commander. Let me submit a trouble ticket."

I'm not saying it's a totally bad idea, but I don't think it works for everyone. We'll see over the next year, I guess. :)

Merry Christmas.

Why not define a simple HTML that's permitted.

[Maxo-Texas]

You know... something like 12 tags and that's it.

bold, italic, underline, list.

More like when html started.

Formatting can help you to understand content.

Re:Still ways to get email from outside the networ

[Anonymous Coward]

For the general purpose, internet-facing networks I do support a centrally organized and managed system. NMCI is great on paper and a sound concept, but it's downfall seems to be crappy contracting letting EDS get away with supplying the bare minimum service levels. For the stuff you're talking about, central control is not as important because it's not facing the constant barrage of external and internal attack vectors. For example, you don't have to worry about trojaned email installing malicious software that quietly ships all your sensitive data out via innoccuous looking http connections. But you do have to worry that every single wireless or vpn setup is done properly.

Re:Still ways to get email from outside the networ

[Anonymous Coward]

Wireless is on my list from my boss, too. IP radios, SECNET-11s and 54s, secure deployable cell phone networks...

Then you've got G4 running all over with their CAISI systems...

You must not sleep well at night. ;)

Merry Christmas

What's wrong with asterisks?

[Anonymous Coward]

What's wrong with asterisks? Nothing. But you should realize that HTML is _not_ formatting instructions. HTML describes structure. HTML does not "add bullets". List mark-up is used to inform the user agent that what we have here is an (unordered) list. It's up to the UA to interpret that and show that structure in an appropriate way. For example, a UA that is designed to be listened to by a blind user (not render on a display that is seen by a sighted user) will necessarily be unable to indicate a list with small round black marks.

Email communication tends to be informal and doesn't in most cases require to be formatted - or structured. However, if the contention is that it is actually *not possible* in the 21st century to approach the standard of typography of 18th-century books (choosing an appropriate font-family and font size and making use of headings, italics, and smallcaps) then the situation is more absurd that it is generally recognized to be and deserves more comment that it usually gets. If we can't go _beyond_ that and mark up a email, so that it will be more easily understood by persons using non-graphical user agents, then it doesn't say much for the industry.

What's wrong with a simple whitelist?

[thunderbug]

Simply allowing text helps server loading, but if the cycles are available, allowing selected, whitelisted HTML tags helps readability. The tags that make the whitelist should be benign formatting tags not unlike those allowed by /. (see "Allowed HTML" on the /. comment entry page.) ...to which I'd add 'pre', 'font' (only Courier, Helveticia, and Times), and those necessary to support tables of data. It wouldn't hurt to have such a list standardized so it is clear what will and will not be accepted.

From the 'inside'...

[Anonymous Coward]

I'm a network administrator/network security & vulnerability tech on an lhd and it's my job (and mine alone) to ensure the ship complies with the new infocon level. Looking at all the responses most of you have no idea how government networks work, it's not as easy as just sanatizing HTML or using modified versions of programs. My ship, for example, is a program of records ship. A very sexy/rich lady jumped through a million hoops so she could get access to the windows source code (nt4/2000) and modify it for the DoD. She changed a bit of this, and a bit of that and wrapped it up into a nice neat package with many strict rules we as information system technicians must abide by.

We'd love to just say "well, this program simply doesn't cut it for me. Let me load up the new version of "Bells-N-Whistles 2007", it works so much better." Unfortunately, there is a list of software we are allowed to use (detailed, down to the program version) and if the new Bells-N-Whistles 2007 ver 2.3 isn't on the list, we can't install it. Of course, we could always fill out the paperwork and propose the software for use, but i'd have more fun shoving wooden matches under my fingernails and lighting them on fire. After the paperwork, the proposed program must first be tested in a controlled environment that resembles our network and certified that it wont cause any negative effects on our network. In semi-short: we have deadlines to meet for each portion of the infocon switch. And if the answer is forcing the use of untested software DoD wide, then we open all the doors and windows to the very thing we are trying to stop by switching infocon levels in the first place.

As far as reduced bandwidth, we are never really strapped for bandwidth to begin with (smaller decks maybe, but not the big boys). The amount of bandwith we save is little to none, either way it goes unnoticed. And if by 'less spam entering mailboxes' you mean 'absolutely no change in the amount of spam entering mailboxes whatsoever' then you would be correct, sir!

And just because most 'normal' people don't use digital signatures doesn't mean that the military doesn't use them. There are parts to our communications that require digital signatures so they are actually used quite often, and the change hasn't effected the digital signatures at all.

The loss of OWA doesn't effect us at all since it's only authorized in select places anyway. And VPN is pretty much the same, you wont see it most places. These people saying there's always ways to get your work email from home sound like end users, not network admins. Of course there are always ways to get around everything, but it's probably against DoD policy. If your not working with us, your working against us, as is usually the case with admins vs. the end users.

Use MS Word instead!

[hadaso]

HTML is not really needed if formatting is needed. People can just write the message in MS Word and attach the file if HTML is unavailable! Really good choice indeed!

I use FastMail.FM webmail to read my email. I always view HTML. The HTML produced is a subset of the full HTML and most tags are "defanged" (including images and forms but lots of other stuff too). That's the correct way to read email. Banning HTML completely instead of allowing a secure subset in a secure environment means people would opt for formats that are much worse than HTML.

Re:Use MS Word instead!

[partenon]

Email messages don't need to be formatted. If they need to be formatted, then it's more important than a simple message. And that's the exact reason PDF is out there :-)

So why do they still *send it* ??

[Anonymous Coward]

http://www.defenselink.mil/news/dodnews.html

Less is More?

[Wingsy]

And so it goes, the world of Windows slowly but steadily moves forward in removing yet another piece of internet functionality, all in the name of security. Shame, isn't it, that because of Microsoft's swiss cheese products we can't seem to enjoy all the good things about the web that were promised?

It's not really a concern for most DoD?

[IonOtter]

It's not really a concern as far as the DoD is concerned.

If something needs a digital signature, then the person sending it is going to know how to configure their Outlook client to send in plaintext anyway. Our Outlook clients don't come "preconfigured" for signing, so the user has to know:

1. What a certificate is.
2. Configure ActivCard Gold on their machine to register the cert.
3. Navigate Outlook and find the security prefs.
4. Which cert to actually use with Outlook (there are 3 on each CAC card.)
5. To use THEIR cert, there are often more than just yours on any given machine.

From a DoD point of view, email coming in from "The Wild" from family and friends doesn't need a signature anyway, so it's not going to matter if a signature gets borked when the HTML is stripped. And if it's coming from a vendor who actually needs to use a signature, they'll be able to meet all five criteria mentioned above, and won't even use HTML.

OR...the NOC will simply add their domain to the whitelist and let it through.

Also, if the email is coming from a .mil domain, then it will arrive with HTML intact. If the generals/admirals didn't have the ability to automatically indent and inject their [Username] when replying, they'd collapse in a fit of frothing and twitching.

The DoD really hasn't ramped up the whole digital signature thing quite yet. They talk a big deal, but when it comes down to the Nuts&Bolts implementation, the only ones using it are the geeks, not the grunts.

As usual.

Re:Your Sig

[Millenniumman]

In the free world the media isn't government run; the government is media run.

If that's truly your opinion, it's quite fearful. The media should report the news, not control the citizens or the government, regardless of whether it has third party influence.

Fixed tags:

Thanks.

[Cassini2]

Thank you for the tip. Merry Christmas!

Re:Your Sig

[partenon]

Media is supposed to be free. They can express their opinions if they want. They aren't supposed to only report news, because most people just can't understand more than one aspect of the news.

Re:Still ways to get email from outside the networ

[bsa3]

Indeed. Intel does the right thing here -- if I'm interpreting their NISPOM-equivalent manual correctly, not only will they not outsource IT, they don't even allow non-Intel employees to have root. The E-ring people definitely need to do something about the contractors who hire employees based solely on clearance and blood pressure, and the poorly-written contracts that allow them to get away with it.

HTML email yes, Outlook Webmail no

[Anonymous Coward]

You can still use Outlook Webmail with CAC (ID card) logon... as of Friday last week. It has been threatened several times over the past few months but it has yet to be taken away for the forseeable future.

Re:Still ways to get email from outside the networ

[aliscool]

I know, It'll take some getting used to.

About bloody time

[argent]

I believe I speak for every mail system admin when I say "About bloody time".

It's only 10 years too late. It was about 10 years ago that the email viruses piggybacking on "active" content in HTML mail in Outlook and Outlook Express really started taking off.

Good

[Dopefish128]

I once peeked inside my Thunderbird's training.dat file. All the spammiest tokens were HTML tags. Good riddance.

Email needs to convey information

[hadaso]

Email messages need to convey information.
If I need to tell a student that
    2
  x
e   is not integrable in elementary tame then you say I have to create a pdf document for this one sentence? Most people I know attach a word document to do it because they don't know any other way. Or I can write $e^{x^2}$ like mathematicians do and tell my students that hardly cope with their math that they need to learn TeX before they can learn math. Or I can write e^x^2 and make it ambiguous. Or I can do what I do and write e^x² and send it in a message with Content-type set to text/html and the student will be able to see it in any mime compliant email reader that is set to render a minimal harmless subset of html (sadly Slashdot doesn't think <sup> is a safe tag for me to use in formating a post making me use "code" formating to make sure this is rendered with fixed width font. In Email I don't even  get the option to set fixed width font unless I use HTML or attach a file created in a word processor).

In real life most of the email I write is in Hebrew and there is no real plain text format that guaranties the recipient sees the same sentence I wrote. HTML provides the tools needed to control the way text is displayed without needing to create printable documents for every short note. When I compose English email I use plain text unless I need to convey information that needs html like math formulas or links.

Re:Email needs to convey information

[partenon]

You have a good point. And I almost agree w/ you :-) But then I got a question that only you can answer me... How do you write 1^(1/2) (or 1 sqrt 2) in HTML, w/out using TeX or other "complicated notation"? And if your students wants to send you math formulas for some reason, they need to use the right formula for the right problem (or the right tool for the right job). If they don't want to learn TeX, just show'em Word w/ Equation object.

Don't get me wrong, I got your point and it seems valid, but the *uses* of HTML in email messages aren't that wide/useful.

1^{1/2} in HTML

[hadaso]

1^{1/2} in HTML:

one way is: 11/2 and this is the way I would usually do it (with an html composer that has superscript/subscript buttons like all three different alternative composers in FastMail.FM's webmail interface).

Another way: 2

And another: 1½ (this is doable in fckeditor or in xinha using the "Insert special characters" button, see http://www.fckeditor.net/demo and http://xinha.gogo.co.nz/xinha-nightly/examples/ful l_example.html which actually has a cool equation editor :)

(I got the html entities from http://www.bigbaer.com/sidebars/entities/)

My student normally don't do these things. But then I can do the guesswork on what they mean, but I don't expect them to do the ame to understand what I say. Anyway most of my students use forums were they have an eqation editor that creates mathml (if they run winxp and can have admin privileges).

Outlook Can Already Natively Block HTML Email!

[Anonymous Coward]

There's a fairly fool proof solution to all this that no one has mentioned on here.

It's really simple to block html email in outlook with a little bit of code since the functionality is built-in to outlook. Essentially, outlook/exchange already store a plain text copy of html email in some of the built-in Extended MAPI properties such as (see related PR_ properties). If you look at the bytes in any outlook/exchange message, you'll see that extended mapi always stores this information and thus it can be accessed not only via extended mapi, but custom c++, CDONTS, OOM, and more.

Having done some email/outlook related work for DoD in the past, I can tell you that they mostly use exchange anyway, so you just have to set a flag using extended mapi on the exchange server and outlook won't ever load up the html body. You can take it a step further by wiping out the html related garbage outlook stores in the compressed rtf stream to be sure. If someone has html email set, it won't matter because the message will just come up as plain text, so there is no need for any of this custom client or saved settings people keep talking about.

It seems most of the replies are from people that know nothing about how outlook/exchange read, store, and work with email. Btw, not every outlook client is the same, for example if you use word it's an entirely different ballgame, plus when you factor in outlook to outlook communication in RTF....

Actually, it's not really blocked

[poohsan]

I still receive html e-mail from outside sources. The default view (and preview pane) have been changed to plain text - you right click on the banner telling you that and convert it back to html - poof, an html message again. I can't compose html though, only rich text, and if the recipient id a DoD person they'll have to go through the same rigmarole to see my original formatting.

They aren't blocking attachments

[Walles]

you must be able to accept attachments such as .zip and html mail

From TFA: "the current threat level does not bar the use of attachments"

Now what was the problem again?

Regarding your claim that HTML mail is mandatory, I have a very hard time seeing that anybody would say: "The DoD don't accept HTML e-mail so we don't want them as customers".

Re:They aren't blocking attachments

[zerkon]

It isn't that the DoD is blocking HTML email, it is that outlook is automatically displaying all incoming mail as plain text (see http://support.microsoft.com/kb/307594) a good step in the right direction? sure, but since everyone just clicks the gray "display as html" bar at the top anyway, somewhat pointless. as far as attachments, I have yet to see any file be blocked for any reason (although I havn't tried emailing any executables)

Math in email using ASCIIMathML

[hadaso]

Just today I found this cool tool that converts easy to type ascii notation for formulas ("simplied TeX") to mathml using javascript. And there are also visual tools to help.
There is a special page to make it easier to use in email: http://math.chapman.edu/email/

Nice to hear but won't add a lot of security

[real gumby]

I prefer text mail but hardly anyone sends it any more. And outside the hacker community it seems you don't get much html mail...you get worse: a short note (e.g. "please see attached meeting summary") with a ONE PARAGRAPH WORD FILE ATTACHED!

mega-moronism. As a result the DoD will just get more word virus files and less html mail.

Pathetic....and in this case I don't mean DoD.

Article not quite accurate

[guisar]

It is not so much HTML mail which has been blocked as access to all web-based email "clients" such as gmail, yahoo and of course the Outlook web client. HTML formatted MIME mail still is enabled- I just tested it.