> No. It is possible to write out a MIME message which > cannot be interpreted ambiguously by software that > correctly obeys the relevant RFCs. You have simply changed the subject; this is quite different from your previous statement that it is possible to create a single canonical version by selecting a field from multiple choices. > If any possible MIME message can be ambiguous, as you imply, > then the only safe action is to discard every single MIME > message, period. *May* be ambiguous, not *must* be ambiguous. The safe action is to detect and discard the ambiguous ones. > The reformatting *must* eliminate the attack vector, because > it *must* force correctly-written software to interpret the > message the same way as the security agent. It does no such thing. The security product has no control over the client at all, so cannot force it to do anything. This model can only work if the client interprets the mailbody in the same way as the security agent, and more importantly does *not* interpret anything else. In the real world, this simply isn't the case. Regards, Martin O'Neal
