Latest IE Hole Lets Gopher Root You 567
rvaniwaa writes "Another hole in internet explorer has been discovered. This hole allows a hacker to root a user's computer whenever the user clicks on a gopher link. All versions of IE are affected and a Microsoft spokesman stated that the company is "moving forward on the investigation with all due speed""
My thoughts: (Score:2, Insightful)
See if this story follows pattern (I think it will).
Re:My thoughts: (Score:3, Informative)
if you make a link to a gopher site in an html page, the average MS surfer will not hesitate to click on it.
which is what the web was supposed to do, make it transparent.
Re:My thoughts: (Score:3, Informative)
al thats needed is for someone to disguise an "evil" link, and whammo - you've got r00t.
big big big remote exploit.
Re:My thoughts: (Score:5, Insightful)
You also missed step 2.9, where the hapless sysadmin spends 3 days trying to figure out Microsoft's patch dependency tree, which is not published. And even M$ admits that they use different, and incompatible, patch mechanisms for different product lines. So if I pull out the install disk to add an additional function to Visio, do I have to reinstall Office XP patches? Why or why not?
sPh
Too damn obvious (Score:5, Funny)
Re:Too damn obvious (Score:2, Funny)
Here's one [carlspackler.com]
Kinda funny actually (Score:2, Troll)
One about a company releasing a report indicating that Open Source software is inherently insecure.
Another about a new security hole in IE (Thank god I use Konqueror
Now we need the good PR people at Microsoft to release the source code to Internet Explorer and IIS so that they can prove their first point...
Whack-a-Mole (not quite a gopher joke, but... (Score:4, Funny)
FYI: Whack-a-Mole is an old arcade game where you hold a padded mallet facing a slightly inclined surface with a half-dozen or so holes. Periodically a little mole pops up from a hole, and you try to whack him before he goes back down on his own. A little bit like playing XBill, only in the Real World.
Re:Too damn obvious (Score:4, Funny)
Re:Too damn obvious (Score:4, Funny)
I didn't expect the next roothole announcement to appear so soon.
Re:Too damn obvious (Score:5, Insightful)
Why the h3ll is anyone motivated to find bugs in IE's gopher protocols?!? It must have been a real slow day at Oy Online Solutions [solutions.fi] for them to find this.
Re:Too damn obvious (Score:4, Insightful)
- The program's maintainers are less likely to check these portions of code for errors because users don't complain about them as much.
- The legacy protocols probably contain code from the pre-security awareness days. They're more likely to contain such "new" security concerns as Format String bugs and signed/unsigned conversions.
- Other people doing audits on the same software have probably been over all the basics many times using automated tools and buffer overflow spamming.
I know the above post was probably meant as a joke, but the guys above are probably more clever than you think.
Re:Too damn obvious (Score:2)
You've never watched Caddyshack [imdb.com], have you?
All three gopher links left.. (Score:2, Interesting)
sPh
Re:All three gopher links left.. (Score:5, Insightful)
Re:All three gopher links left.. (Score:5, Insightful)
Re:All three gopher links left.. (Score:3, Interesting)
As I pointed out yesterday [slashdot.org], there's more info [solutions.fi] about the bug and it's prevention available from Oy Solutions, who found the exploit.
Re:All three gopher links left.. (Score:4, Funny)
You mean you haven't found it yet? It's right here! [ut2003.com]
Re:All three gopher links left.. (Score:4, Interesting)
Re:All three gopher links left.. (Score:2)
Or better yet, auto-forwarding to them. Throw up a hit page for Google to find, and sit back and wait for the hits. Or spam with the address. It isn't like someone who would exploit this is scrupulous or anything.
Re:All three gopher links left.. (Score:3, Interesting)
<a href="gopher://hostile-link" on mouseover status.text="http://www.friendlysite.com" return true>click here!</a>
Now my javascript is rusty and I have not tried this ... but you get the idea.
Re:All three gopher links left.. (Score:2)
Of course if all you need to do to take over an IE users computer is run a gopher server and get some hapless schmoe to click on a gopher link you can bet there will be a sudden resurgence in this venerable protocol. I imagine mixing in a link in pornography spam would probably net you quite a few computers. Some of them would almost certainly have useful information.
Re:All three gopher links left.. (Score:3, Interesting)
http://www.scn.org/~bkarger/gopher-manif
Re:All three gopher links left.. (Score:2)
Re:All three gopher links left.. (Score:2)
2. Since gopher's used very rarely, if at all anymore, that's probably why MS hadn't bothered to keep the code up to date.
Re:All three gopher links left.. (Score:5, Informative)
That really isn't the point. It would not take many minutes to put up a gopher server with a Win 32 rootkit as content, and then put an innocent but interesting looking link into a web page ('free live world cup scores' would do nicely just now) with an href pointing to that server, and, ideally, one of those annoying JavaScript scrollers in the browser status display to prevent the user from noticing they're about to click a gopher link, and, hey! That's a few more suckers rooted. It will probably go through most firewalls, too.
If you (or your organisation) still use Internet Explorer, I would treat this as serious. Change your default IE install to have gopher point to a safe machine of your own; block gopher at your firewall; and, ideally, switch to Opera 6, Netscape 6, or Mozilla as your organisation's default browser.
This isn't going to be the last security hole found in IE.
Re:All three gopher links left.. (Score:2)
Hmm. Now I'm going all nostalgic for Archie, Veronica and WAIS. Well, maybe not WAIS.
Re:All three gopher links left.. (Score:2)
Re:All three gopher links left.. (Score:3, Funny)
Just because nobody uses something legitimately, it doesn't mean that nobody will use it maliciously.
hostile Gopher site? (Score:4, Funny)
Re:hostile Gopher site? (Score:2)
gopher site [snowmonsters.com]
And how's that working for ya? (Score:4, Funny)
In January, Microsoft Chairman Bill Gates instructed employees to make software security a top priority.
Yeah, looks like everythings moving full steam ahead on that front.
Re:And how's that working for ya? (Score:4, Insightful)
...and yet (Score:2)
And yet, despite regular reports like this, posters on Slashdot keep asking why anybody who "cares about the web" would bother using a browser other than IE, and suggest that somebody who wants to use another browser (and, heavens, support cross-platfrom and cross-platfrom browsers) is a naive moralistic high-horse-rider who needs to wake up and get with the program.
With the program doesn't look like a very nice place to get to me....
-Rob
Re:...and yet (Score:2, Insightful)
The reason there are aren't reports of security holes in gopher code in other browers is that no-one has looked, not that the holes don't exist.
**Sigh...** (Score:2, Insightful)
No software is rock solid, even when it's written to be. There's always a european teenager with way too much time on their hands just waiting to turn you Titanium fortress into a window screen...
Re:**Sigh...** (Score:3, Insightful)
Perhaps so, but avoiding buffer overflows isn't rocket science. It's a simple matter of bounds checking. There's really no excuse.
New MS Hacker Slogan (Score:5, Funny)
ObCaddyshack: (Score:3, Funny)
well you can't expect... (Score:5, Funny)
Wow... (Score:2, Troll)
However dangerous this hole may be, there are a few reasons why it probably won't create an end of the world scenario, most imporatant of these that gopher is absolutly archaic. I personally havn't seen a gopher server since 1996 (at MIT).
Second, as always, Microsoft will have a patch out fairly quickly, which is more that can be said for mozilla half of the time...
*Ducks and covers due to flying penguins*
Re: (Score:2, Funny)
Re:Wow... (Score:5, Insightful)
<script>
document.location.replace("gopher://e
</script>
Second, as always, Microsoft will have a patch out fairly quickly, which is more that can be said for mozilla half of the time...
I'm amazed at how you split one security hole (XMLHTTPRequest) in two to make a "half the time"...
Incidentally, the patch for XMLHTTPRequest was in nightly builds within 48 hours of the bug report, and in the next milestone within about a week. In contrast, there are currently 17 unpatched holes in IE [jscript.dk]. What was that you were saying about "quickly"?
Gerv
The remedy (Score:5, Informative)
protocol like this:
Go to Tools -> Internet options -> Connections. Click on "LAN settings".
Check "Use a proxy server for your LAN". Click on "Advanced...".
Go to the Gopher text field
and enter "localhost", and "1" in the port field. This will stop Internet
Explorer from showing and processing any gopher pages.
this will protect you for now, at least until M$ pull their finger out
Or... (Score:2, Insightful)
Re:Or... (Score:3, Insightful)
I wish it was that simple. There are hordes of people out there who have jobs where if they install anything on their work computer they will get in trouble.
I am one of these people. I have no choice but to use MSIE and Outlook on NT at work.
I feel so dirty.
And thus the previous comments [slashdot.org] about blocking gopher are important to many.
Re:Or... (Score:4, Funny)
What's worse? (Score:3)
Logic check: "Don't use the browser that most websites are designed for!"
Do you really think I'd be using IE right now if Opera was cutting it?
Re:What's worse? (Score:3, Insightful)
Ah, the ubiquitous inevitibility argument.
That argument is, of course, bullshit. Use of a modern HTML DTD such as 4.01 strict enforces consistent behavior on the client side. Javascript may still be a problem, but handicapped accessiblity guidelines will require that content be delivered without its use.
There was a time where I could not browse the web with anything but IE because of the MS incited erosion of HTML standards. But the resurgence of attention to those standards, combined with a significant and growing user population using non IE browsers, have forced most web sites to un-adapt from the defacto Microsoft standard.
As for Opera specifically, it is the only browser out there which consistently obeys pre- HTML 4.01 strict DTDs. I am a paying user of Opera, and use it on all my GUI systems.
Re:Not necessarily... (Score:2)
According to the oy online page [solutions.fi] "The part of code in IE which parses gopher replies contains an exploitable buffer overflow bug... . The server can be very minimal, ie. a program that can listen on a TCP port and write a block of data; a fully operational gopher server isn't necessary in order to carry out the attack. "
It looks like an accurate link to a gopher server is needed for this attack.
It looks like there needs to be a hostile site existing, unless you have another link.
Re:Not necessarily... (Score:2)
It looks like there needs to be a hostile site existing, unless you have another link."
It also looks like I should actually read what I write when I preview instead of just checking to make sure that the links work.
Whoops... (Score:2)
So it is a valid remedy.
The site's URL (It's all over this story, but for good measure...) - http://www.solutions.fi/index.cgi/news_2002_06_04
Yay I'M SAFE! (Score:2, Funny)
Re:Yay I'M SAFE! (Score:4, Funny)
Re:Yay I'M SAFE! (Score:5, Funny)
It forced me to learn to spell 'administrator.'
Kinda like how FTP forced me to learn to spell 'anonymous.'
Or somthing.
Stats, anyone? (Score:4, Interesting)
Re:Stats, anyone? (Score:5, Informative)
Yep this site specialises in just that
Here [jscript.dk]
also George Guninski does some research here
Here [guninski.com]
and Mr Malware
Here [malware.com]
Re:Stats, anyone? (Score:2, Interesting)
First, there's the question of what constitutes a security hole. some might say allowing rampant JavaScript popups is a security hole. Others might require that binary code actually be executed on the machine, or that the HD is modified.
Second, the number of security holes found, in the case of closed-source browsers, is the number of security holes that its company wants to bother telling you about. It's entirely possible that there are hundreds of security holes in IE that MS knows about and hasn't divulged. Maybe they were quietly fixed in previous IE patches. Maybe they're left unfixed so MS can look like it's making speedy repairs when someone finally finds the bug on their own and tells the press. Again, there's no way of knowing how many of the bugs are being reported.
Finally, the number of security holes found may correlate strongly with how insecure a browser is. But it could also be that said browser is just used more. Or its code is readable, so such bugs can be found. Or it is actively being developed by coders who care about security. Or no one uses the browser and it's insecure as hell but nobody cares.
Too many variables. Any study on the number of security holes known is only going to tell you one thing: the number of security holes *known*.
Gopher, gopher.... (Score:2, Funny)
Great! (Score:2, Funny)
Online Solutions' page (Score:3, Informative)
Mosaic Bug? (Score:2)
If this is, in fact, a NCSA Mosaic bug, it probably exists in Netscape thru version 4.x as well. I'd be pretty surprised if either company felt the need to alter the gopher code while they were busy fighting over http.
Re:Mosaic Bug? (Score:2)
Reminicent of the CHARGEN port problem (Score:2)
It's fun when MS figures out something new for the Internet...
Message from Osama to Mr..Gates (Score:2)
I love your stuff [theregister.co.uk]
Sadlly... (Score:2)
now seriously, this is getting anoying. since I started to rely on mozilla only (or since I ditched netscape 4.x for good) some 6 months ago I saw only ONE serious security flaw reported on it and it was corected in a week or so. but with IE we have at least 2 anoucements a month. this is getting so frequent I'm here asking
Slipping off the treadmill (Score:2)
And Microsoft is just getting around to hunting down security holes *now*? What does this say about more current protocols?
I predict that by 2005, they'll start looking for holes in SOAP )
CaddyShack (Score:2)
Spackler: "Check me if I'm wrong Sandy, but if I kill all the golfers, they'll lock me up and throw away the key."
Sandy: "The GOPHERS, man! Kill all the GOPHERS!"
New Product: Microsoft Door (Score:2, Funny)
When was the last time... (Score:2)
...anybody clicked on a gopher link?
If there isn't a patch yet, or if MSFT says you gotta have IE6 or something, easiest thing to do is just block gopher. What is the gopher port anyway?
Re:When was the last time... (Score:2)
One fun thing is that our directory services only have a gopher interface and don't have an http interface. This means I publish my email address, postal address and telephone number using gopher. This is great because the spambots don't do crawl gopher, so I get zero spam, but most people using a web browser can still view my contact information.
Official Bugtraq Post (Score:5, Informative)
OVERVIEW
========
Gopher is a protocol developed at the University of Minnesota in the
early 1990's. Gopher servers offer hierarchically organized directories
and files. These form a "gopherspace" which can be thought of as the
predecessor of the World Wide Web. Gopher was mostly abandoned soon after
HTTP and the World Wide Web started gaining popularity.
Microsoft Internet Explorer has a built-in gopher client. Gopher pages can
be accessed via URLs starting with "gopher://". The part of code in IE
which parses gopher replies contains an exploitable buffer overflow
bug. A malicious server may be used to run arbitrary code on an IE user's
system.
DETAILS
=======
When the overflow is triggered, a fixed sized buffer in stack gets
overwritten with data from the gopher server. This data can contain most
octets from 0 to 255 (also nulls) which makes it particularly easy to
inject a working shellcode in it. This is a traditional, trivially
exploitable buffer overflow. A test exploit has been successfully used to
run arbitrary code without user intervention with various IE versions and
systems including IE 5.5 and 6.0.
The attack can be launched via a web page or an HTML mail message which
redirect the user to a malicious gopher server when the victim views them.
The server can be very minimal, ie. a program that can listen on a TCP
port and write a block of data; a fully operational gopher server isn't
necessary in order to carry out the attack.
The exploiter could do anything that a regular user could do on the
system: retrieve, install, or remove files, upload and run programs, etc.
Full technical details aren't disclosed at this time to prevent
exploitation.
WORKAROUND
==========
Internet Explorer users can protect themselves from the flaw by disabling
the gopher protocol. Barely any gopher servers exist on the Internet
today, so this is unlikely to cause problems. If needed, a gopher client
or some other web browser can be used to access the gopherspace.
An easy way to disable processing and displaying gopher pages is to define
a non-functional gopher proxy in Internet Options. Select Tools ->
Internet options -> Connections. Click on "LAN settings". Check "Use a
proxy server for your LAN". Click on "Advanced...". Here you can define
proxy servers to be used with different protocols. Go to the Gopher text
field and enter "localhost", and "1" in the port text field. This will
stop Internet Explorer from fetching any gopher documents.
After installing the patch from Microsoft you can remove these gopher
proxy settings (or restore them to values they had before).
For more information and a vulnerability test see
http://www.solutions.fi
VENDOR STATUS
=============
Microsoft was contacted on May 20th. At the moment of writing this
advisory, Microsoft has started designing and coding a fix, but hasn't
given any approximation of when it would be released. The patch will be
available at
http://www.microsoft.com/technet/security/current
when it is completed.
Workaround (Score:2)
A nice browser feature would be a regular expression based prefilter of web pages. If a file called prefilter.rules exists, the browser would run the raw html of each pages it downloaded through the filter. This would allow admins to make the browser safe again (with some lost functionality) until the browser was patched.
In this case you might want to use a rule something like:
s/(gofer\:[^'" \n\r\t]*)/about:blocked.html?$1/
I should see if this is a requested feature for mozilla yet. With browsers knowing about regexp for javascript this probably wouldn't be too hard to implement. Plus once it was implemented, you could use it for blocking ads and other annoyances.
All IE Versions? (Score:2)
Microsoft is so good at screwing up its own OS, thank God they seem to do a good job with Mac apps (though 90% of our security problems are due to M$).This will be moot for Mac Users anyway with Chimera [mozdev.org] looking better every day (nightly build).
Gopher Info Links (Score:2)
About gopher:
Gopher is an infoserver which can deliver text, graphics, audio, and
multimedia to clients. Keeping documents "link clean", making linking a
function of the server info-tree and not in the doc, layout is kept to
its most frugal minimum, and is standard across all docs. No graphic
design means its the ideal navigable interface, a hypertext Eden. It
gives simplified usage for sight-impaired users, same contents for
wired/wiredless, and requires no capital investments in layout and
"design". Gopher is real -- and it was fully functional in 1992, even
without advertisements!
Taken from the gopher manifesto [scn.org]
Google's Gopher stuff [google.com]
Yahoo's Gopher stuff [yahoo.com]
For those that want to go gopher hunting. Here's a link [umn.edu] to a gopher server at the University of MN. I don't think they will install BackOrifice or something, but user beware!
I wonder how secure a gopher server is?
Active gopher sites. (Score:5, Interesting)
However, a quicky search turns up several still-active gophers, for example:
gopher://gopher.umsl.edu/ [umsl.edu]
gopher://gopher.cac.psu.edu/ [psu.edu]
(These actually return data -- some others I found the server up but no data returned).
As to why gopher died out, Tim Berners-Lee offers the following:
(from his book, Weaving the Web)
Re:Active gopher sites. (Score:2)
Tim is certainly right that this was a factor, however the MN policy change came after HTTP had passed gopher in terms of usage (as measured on the NSF backbone).
The Web was winning largely because Gopher had a very puritanical outlook. They wanted to hold the net back in the era of VT100 terminals, fixed width fonts and the only formatting being normal, bold and inverse font.
Another problem was that they really had their heads up their asses when it came to URLs. Their idea of muiltimedia content was that a file could be a text file or a picture. The idea of pictures in the text was anathema.
Now there have been claims made by the Netscape FUD dept. that there was also opposition to images in the Web community. Actually nothing could be further from the truth. There were a lot of complaints about the botched design of the IMG tag. To be fair to Marc he did give the world 8 hours to comment on his proposal, two of which were actually business hours in Europe (none of which were business hours in the US however).
By the time the university tried to cash in gopher was already on a downturn. The university action was simply the coup de grace. If it had come when gopher was more popular someone would have forked the source tree or developed an open version.
Today a lot of the 'gopher' servers are actually Web servers that have the ability to serve multiple protocols.
9 out of 10 Terrorists agree! Microsoft's secure! (Score:4, Funny)
'Think Tank' Issues Microsoft-Funded Troll [slashdot.org]
According to this ZDNet article, a Washington think tank known as the Alexis de Tocqueville Institution is soon to release a study stating that Open Source Software allows terrorists an easy time hacking into our systems. It's little suprise that this group takes money from Microsoft." The Register's story is good too. All the whoring reports in the world won't make open source any less secure.
Everybody knows terrorists love to target Mozilla users by sending them links which causes there system to email Star Office attachments to everybody with payloads that will delete all your OGGs and PNGs by exploiting security holes in Sendmail.
Technical details straight from the source (Score:2)
Well, sort of, anyway. They don't go into much detail because of fear of people exploiting it, but it's some kind of buffer overflow (big surprise there) triggered by a malicious Gopher server.
BugTraq (Score:2, Informative)
Since When (Score:3, Funny)
Since when did M$ start offering downloads of Mozilla?
This was in the works for some time (Score:2, Funny)
You see... (Score:2)
mosiac money (Score:2, Funny)
Marc Andreessen wrote Mosaic while at the University of Illinois. After he went on to found Netscape, Microsoft came to an agreement with the University of Illinois to license the Mosaic source code to use it as the core of the Internet Explorer browser. The fact that they still license it is referenced in IE's "About Box". Now the UofI's intellectual property policy is that the creators of the property get ~40% of the licensing money. So, the odds are pretty good that Marc gets annual checks of Microsoft money to pay for his old source code, which was used to destroy his beloved company. Makes me feel bad for him.
Still, it is kind of funny that Microsoft ends up paying some miniscule part of my University salary because they've never been able to write a web browser from scratch.
This is an outlook exploit waiting to happen (Score:2)
Why do we need anything but text in email? I could even live with a subset of html that would display graphics, but full html???
scary....
New MS Slogan! (Score:3, Funny)
What the hell is this about? (Score:5, Insightful)
And just why should we trust anything this guy says? Their official spokesman won't even stand by what he's saying. And what is he saying, anyway?
So again, as far as Microsoft is concerned, it's the fault of the people who publicized it. It's prudent to assume these guys are not the only ones who know about the problem. Which means my information is already at risk.
So if there are people out there who can compromise my system, why shouldn't I be able to find out about it and take preventive measures? Why should I have to wait until Microsoft -- who haven't even admitted to the vulnerability yet, two weeks after being told about it -- get around to fixing it?
Re:What the hell is this about? (Score:3, Funny)
His identity is being protected through obscurity. If he open-sourced his name, his job/email account/etc would be open to attack.
So again, as far as Microsoft is concerned, it's the fault of the people who publicized it. It's prudent to assume these guys are not the only ones who know about the problem. Which means my information is already at risk.
Your information has been at risk ever since installing your operating system. You agreed to the EULA upon installing it, and that paper holds you responsible for data sharing, you agreed to not hold Microsoft responsible for data loss, intrusion, etc. Also what concerns me is that you claim that other people know about the problem. That is unlikely, as the EULA also forbids reverse-engineering the code to find exploits.
Additionally, you have the DMCA to protect you, which means that if anyone tries to circumvent the data safeguards on your system, they will be prosecuted.
I think you are being overly paranoid.
-fc
Get Your Easy Fix Right Here!!!! (Score:5, Funny)
gopher://gopher.URr00t3d.ru [theonion.com]
Buffer overflow, buffer overflow, buffer overflow (Score:3, Insightful)
Indeed, about the time Windows 2000 was released with 65536 known bugs (or whatever the exact number was), didn't Jim Allchin say that they had such a tool and were using it?
Should buffer overflows be as outdated as Gopher itself?
Re:Buffer overflow, buffer overflow, buffer overfl (Score:4, Funny)
Even tho gopher is dead, this is a problem (Score:5, Insightful)
A smart worm could:
1. Infect an IIS server via some unfixed hole, or backdoor left by another worm.
2. Open up a dummy gopher port which responds to all requests with the exploit.
3. Replace links on the web site the IIS server serves with links to the gopher server exploit.
4. The worm installs itself on all client machines that click the gopher links and begins scanning for vunerable servers.
5. Goto 1.
None of this has anything to do with the number gopher servers left on the Internet.
-josh
Special Offers (Score:4, Funny)
For all of you slamming MS (Score:3, Insightful)
Yeah, they made some PR stunts concerning security, but until stuff like this starts affecting their bottom line, they won't care.
There are just too many morons out there buying their stuff, so the situation won't change anytime soon.
And don't give me that crap about being forced into using it. Noone is going to hold a gun against your head and say: use explorer or die.
If your employer makes you use stuff you hate, then you're just a lame pushover and you deserve what you get.
Microsoft Has Already Released A Patch!! (Score:3, Funny)
This *could* be intentional... (Score:4, Interesting)
Considering that the browser components are supposedly scattered through many DLLs, any patches from M$ could easily include updates for Digital Rights Management lockdown, spyware to tell tales, etc, as well as the 'next big hole' that someone will 'discover' whenever MS feels the need to send out more tracking/spying/crippling patches.
Heck, they don't even need to include such stuff, just track who downloads the latest patch and correlate with previous data to build a picture of what's out there.
For example, say ten million distinct folks download the latest patch for Win98. If M$ *know* they've only sold eight million copies of Win98, they know there are 2 million BSA targets out there...
Duh... (Score:2)
It's bogus trap Gopher sites (Or likely merely URLs) that are.
I'm guessing that the attack doesn't even involve contacting a Gopher server, it is likely to be a buffer overflow attack in the URL. (I'm guessing that it's a relative of previous URL BO attacks that both NS and MSIE were vulnerable to.)
It's just as newsworthy as bogus HTTP URLs rooting your system were. Because these gopher links look just like HTTP links unless you look at your browser's URL display. Most of us, including myself, don't bother looking unless we have reason to be suspicious. (Like any link in a
Not a URL buffer overflow, but nearly as dangerous (Score:2)
Just as dangerous, unless you block all Gopher sites using your firewall preferences. As I said before - It's not the legit links (Of which almost none still exist) that are the problem, it's the hostile servers whose links are displayed identically to HTTP links.
Same as any other URL... (Score:2)
That's why this problem is so dangerous, and not "irrelevant and non-newsworthy" as some others claim.
Re:And we all know (Score:2)
Archie was for FTP. The Gopher equivalent was Veronica.