getluky.net

I constantly live in fear that somewhere in my email handling code lies a header / MIME injection vulnerability. I’ve been caught by them in the past, and each time I get snagged, it’s extremely unpleasant to deal with. Although there are published source solutions, I just never feel completely comfortable with them.

I switched my contact forms today so that no form input makes it into any mail that gets sent to me. It’ll ping me with a notification, and i’ll go check it.

It feels like a pretty bad solution, but i’ve noticed recently that more and more web applications are adopting this style. In public applications, one of the advantages is that one can send out notifications very quickly, but also have a short grace period to check and catch abusive spamming. Additionally, you don’t need to worry as much about email exploits that attempt to co-opt your web applications to run as open mail relays. It’s obviously not going to allow your users to deal with your software as an extension of the email inbox.

The pure psychological penalty of receiving an email notification from a trusted web application that contains spam may be somewhat worse than receiving a notification, then going to a website where the content is spam (where you have “report abuse” links, typically) and where the content may no longer exist (if post-moderation occurred).

I believe that this may be a necessary evil in any future web projects that I write. Either that, or all participants may need to pay a fee to enter.

This entry was posted on Wednesday, April 2nd, 2008 at 8:12 pm and is filed under Tech. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.