Thoughtful, detailed coverage of the Mac, iPhone, and iPad, plus the best-selling Take Control ebooks.



Pick an apple! 
Type Faster by Competing in Races

A fun way to improve your typing speed and accuracy is to join an online typing competition at typrX. This typing competition keeps track of your typing speed, while allowing you to compete against other people, either around the world in public races or with friends in private races. To set up a private race with your friends, follow these simple steps.

  • Once you have a typrX account, click the Create Private Race button on the front page and you’ll be taken to the private race page.
  • From there, copy the track code URL and send it to the friends you want to join the race.
  • You can click the Delay Countdown button to add 10 seconds to the clock if you are waiting on your friend to join the race.

Visit typrX


Security Issue with Email Attachments

Send Article to a Friend

A recent CIAC security advisory identifies a potentially dangerous flaw involving email clients processing MIME attachments with unusually long file names (more than 200 characters). The problem, primarily affecting Windows versions of Microsoft Outlook, Outlook Express, and Netscape Messenger, could cause a buffer overflow that could crash the email client or potentially cause code to execute on the client's system, even if the user does not attempt to open the message or the attachment. Microsoft and Netscape have issued security advisories for their products, along with patches for the Windows versions of their software.

< resources/bugs/longfile.html>

Historically, the way to take advantage of a buffer overflow is to craft the precise binary data that will get past the target program's bounds checking, then somehow cause that data to be executed as if it were code. If an email program were susceptible to this problem and encountered a message designed to exploit it, the most likely result would be a crash. (There's nothing new about email programs crashing while processing badly formatted messages.) To execute malicious code, the extraneous data must be designed to target a particular email program running on a particular operating system, so a Mac running Eudora would be immune to a message designed to execute code on a Pentium-based system running Windows 98 and Outlook Express.

To date, there are no known instances of this code-execution vulnerability being exploited. The general alarm about this problem stems from the wide deployment of potentially vulnerable Windows-based clients from Microsoft and Netscape. In addition, even if the code-execution vulnerability turns out to be purely theoretical, the discovery of a reproducible way of crashing numerous copies of heavily used email programs is concerning. Even though patches to those programs are available now, it will take several months for a substantial portion of the user base to upgrade, and for commercial products to ship with corrected versions.

Users of Microsoft Outlook Express for the Mac version 4.0, and version 4.0.1 with build numbers less than 297 (choose About Outlook Express from the Apple menu to see the build number of your copy) can download a 2.2 MB update from Microsoft to correct any potential vulnerability. Qualcomm confirms that current versions of Eudora Pro and Light for Macintosh and Windows are not susceptible to this problem; according to Netscape, no Macintosh versions of Netscape mail software are compromised. Bare Bones Software's Mailsmith also does not suffer a security risk from this problem. We don't have any information about Emailer, but, again, the potential vulnerability is extremely low.

< oebuff_mac/en/oebuff_mac.htm>


Make friends and influence people by sponsoring TidBITS!
Put your company and products in front of tens of thousands of
savvy, committed Apple users who actually buy stuff.
More information: <>