full-disclosure - Interesting side effect of the new IE patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <15533237421C6E4296CC33A2090B224A54CB2D@UTDEVS02.campus.ad.utdallas.edu>
From: pauls at utdallas.edu (Schmehl, Paul L)
Subject: Interesting side effect of the new IE patch

Since the IE browser no longer allows the @ sign in a uri, you can no
longer download files from some vendors' sites.  Still works in Netscape
7.1, however.  So far I've found three sites, but I haven't done an
extensive investigation.  These are just ones that I've stumbled across.
The most interesting one is NAI's download site for enterprise licensed
software packages.  (I suppose, if one was ambitious, one could google
for @?)

I wonder how many other vendors are "cheating" on the RFCs to facilitate
browser interaction?

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/