Microsoft Outlook - the reason for mail viruses and worms

Microsoft Outlook is probably the buggiest widely used mail client out there. It has so many blatant BUGS, not to mention the many serious security vulnerabilities and issues it's really, really a shame. Furthermore, it makes life really hard if you try to follow the Netiquette, the rules of behaviour regarding E-Mail and Usenet (discussion groups):

• It cannot quote correctly (miswraps and rips text apart, see http://www.afaik.de/usenet/faq/zitieren/,
• it is incapable of TURNING OFF HTML and rich text mail, which is a security hole and helps spammers track your e-mail,
• it executes scripts and attachments automatically (in some cases), which is an even bigger security hole,
• it cannot forward correctly by default,
• it inserts bogus, misleading mail headers,
• it crashes on big mail or article structures,
• it cannot display threads properly, which makes it hard to see what discussion (thread) a mail belongs to, which prompts many Outlook users to quote the whole original mail, and this is extremely bad style,
• and so on, and so on ...

There are many serious alternatives - e.g. Pegasus Mail, Opera's mail client, and of course Mozilla's Messenger or Netscape. There's even a mail client that looks and feels like Outlook (Screenshot), including the organizer and scheduling features (and Exchange connectivity), although it is only available on Linux.

Why do I get mails from people where the main text is hidden in an attachment?

Once in a while, I get asked this question. Invariably the person asking me is using Microsoft Outlook. That's one of the bugs in Outlook. I am digially signing my messages so that other people can verify they come from me and weren't altered on their way. This signature format was standardized long ago (see below), and the fix would be trivial for anybody having the source code (i.e. Microsoft only in this case) but Outlook still seems to have a problem with it.

Here it is

Outlook not only not conforms to RFC 2015, it actively discourages others to support that standard (see 'More Details'). My guess it that Microsoft doesn't want people to use an open standard, used and supported by other operating systems (Mac, Unix, ...), because they can't control it (it's open, after all). They want to force Outlook users to use their own email security features - which aren't widely used, nor very secure.

What is an RFC?

RFC (Request For Comment) are the documents that define how computers in the Internet communicate with each other. For example, there is a RFC document that describes how a Web Server is supposed to react to your browser when the browser wants to download a Web document.

The RFCs (there are many thousands of them) are recommendations, nobody is bound by them in any other way than if one doesn't follow them, he or she won't be able to talk to anybody on the Internet. To follow the above example, I could program a Web browser that did not follow the RFC that defines what commands a Web Server understands. But it would be unable to fetch Web Pages.

So what?

The RFCs define a form of language. Nobody can prevent me to define a word like 'fzbular' to mean 'table', forget the meaning of the word 'table' completely, and whenever someone says 'table', ask "What?". It would make life hard for me and people around me, though.

But that is exactly what Microsoft does with Outlook.

(And here come the conspiracy theorists. To stay in the analogy, Microsoft wants to kill the word 'table' in the long term, and charge everyone a copyright fee for the word 'fzbular' after it becomes common enough.)

More Details

RFC 2015 deals with MIME Security with Pretty Good Privacy (PGP), i.e. how to securely sign your emails so that other people can e.g. verify that the mail wasn't altered on the way, and really comes from you. Mails can also be encrypted so that nobody can read it other than the addressee.

If your mail client supports PGP, it would tell you this mail was verified with my public key, and it is original (or not). A mail client that does not support PGP should just display the message as usual, and the PGP signature as an 'unknown attachment'. There is nothing special about the message in itself. The format is exactly the same as it would be if I had appended a picture, or any other file.

Outlook, however refuses to display the message at all. Go figure.