English Language & Usage: Multi-Layered Discourse Room

> Content-Type: application/octet-stream;
name="facebook oo.txt"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="facebook oo.txt"

tchrist

Perhaps some programs auto-execute anything that says it is an application.

Cerberus

Programs? Such as?

My browser may render the text.

tchrist

It’s content-type is decidely not text/plain if it says application/octet-stream.

Cerberus

I know.

tchrist

12:08 AM

I dunno, I always look at my mail undecoded.

So it doesn’t matter.

Cerberus

What do you mean?

tchrist

From:          bulk88 (via RT) <perlbug-followup@perl.org>
To:            bugs-bitbucket@rt.perl.org
Date:          Sun, 08 Dec 2013 13:36:20 PST
Delivery-Date: Sun, 08 Dec 2013 14:47:21
Subject:       [perl #120731] [PATCH] WinCE makefile will now hypothetically build git_version.h
In-Reply-To:   <BLU0-SMTP25117A0C66AC625D8564A97DFD00@phx.gbl>
Resent-to:     perl5-porters@perl.org

X-Spam-Status: No, score=-106.9 required=4.5 tests=BAYES_00,RCVD_IN_DNSWL_HI,
               USER_IN_WHITELIST autolearn=ham version=3.3.0

Notice I see all the literal MIME crap.

I just use "more" to look at mail with.

No fanciness.

Cerberus

I'm looking at the source of the message.

tchrist

Yes, and what is it looking like?

Is it actually ASCII?

There was no charset, so I presume it is, but it says octet-stream, so I wonder.

Cerberus

I'm not looking at the attachment, but at the source of the e-mail, as Outlook/Hotmail calls it.

tchrist

12:12 AM

I guess I’m not sure what that means.

I guess the literal headers, but not the literal body?

It probably has two pieces, or more.

 msg part  type/subtype              size description
185024       multipart/mixed           6279
     1     text/plain                3672
     2     text/plain                2154

Cerberus

I can paste it all, if you like.

tchrist

That one has two text/plain pieces.

Yours has a text/plain and an application/octet-stream.

I’d like to see the first few lines of the latter.

Cerberus

> RmFjZWJvb2sgTG90dGVyeSBUZWFtDQpSRUY6IG9ubGluZSBzcGxhc2ggcHJv
bW8uDQpDT05HUkFUVUxBVElPTlMhISENCg0KV2UgKEZhY2Vib29rIExvdHRl
cnkgVGVhbSkgcHJvdWRseSBhbm5vdW5jZSEgdGhhdCB5b3VyIEUtTUFJTCBB
Q0NPVU5UIGhhcyBiZWVuIHNlbGVjdGVkIGFzIG9uZSBvZiB0aGUgbHVja3kg

There are maybe 50 such lines.

tchrist

Interesting.

Ok, I need the full MIME description for that piece. For example:

------=_NextPart_001_1021_01CEF460.49914CE0
Content-Type: text/html;
        charset="windows-1251"
Content-Transfer-Encoding: quoted-printable

Is it base64-encoded?

Cerberus

> This is a multi-part message in MIME format.

------=_NextPart_000_00E3_01C2A9A6.2A0C2C02
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit

OPEN THIS ATTACHMENT FROM FACEBOOK FACILITATOR.

------=_NextPart_000_00E3_01C2A9A6.2A0C2C02
Content-Type: application/octet-stream;
name="facebook oo.txt"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="facebook oo.txt"

I strongly doubt Notepad has any known vulnerabilities.

Not that I use it, but still.

tchrist

12:17 AM

Ahah, it is.

Ok, so that is a base64-encoded binary stream.

I would save that MIME portion to a decoded file named something like "mystery-file.unknown", then inspect it with a binary dumper of some sort.

That way it won’t trigger any auto-execution.

The question is what it really is underneath. It may be x86 machine code, it might be simple text like a batch file.

Cerberus

But how could it do anything on my computer?

tchrist

What the hell is facebook facilitator?

The answer may lie there.

Cerberus

Notepad(++) will try to open it, and it will display some garbled characters.

@tchrist I Googled that, but no luck.

tchrist

You really should choose what programs get run.

That’s why I suggested looking at it with a binary dumper.

Cerberus

But normal people have .txt files run by Notepad.

The file cannot choose how it wishes to be opened.

tchrist

12:22 AM

I’m not sure about that.

Yes, it can. That’s the Content-Type.

Cerberus

That's how Windows works...

tchrist

The name doesn’t matter.

Cerberus

.txt gets sent to Notepad.

tchrist

That’s stupid.

It isn’t the right MIME type for that.

Cerberus

If I rename a .exe file to .txt, which I have done often enough, and double-click it, I see characters in Notepad.

@tchrist Windows doesn't care.

tchrist

12:23 AM

That’s its own problem.

Cerberus

It gives the user control of what privileges are given to a file.

tchrist

No it doesn’t.

Cerberus

If you announce your file as type A by its extension, but it's really type B, then it still only gets to do the things you know Windows allows for A.

And, if the action it does is "open in Notepad", then perhaps Notepad could in theory interpret the content, but not Windows.

tchrist

mhn-charset-iso-10646-1: uniterm %s
mhshow-show-text/plain: less '%F'
mhshow-charset-cp1252: env LESSCHARSET=dos luit -g2 'CP 1252' %s
mhn-show-application/pdf: %pxpdf  %F
mhn-show-audio/x-mpeg: soundplayer '%F'
mhn-show-image/jpeg: %pxv '%F'

Cerberus

But all Notepad can do—or should be able to do if there isn't some freak vulnerability—is display text.

tchrist

12:26 AM

For me, all that matters for what program gets run is the MIME type. The filename is immaterial.

Robusto

@Reg: Did you ever see Come and See by Elem Klimov? Mark Cousins, in The Story of Film: An Odyssey, calls it "the best war film ever made.

Cerberus

@tchrist So you can't tell by looking at the file name.

tchrist

@Cerberus That would be a stupid way to do it. If I want to know what kind of a file something is, I run the "file" command on it, which tells me the answer.

Don’t conflate data with metadata.

Cerberus

I don't have to do that, I can just look at it.

tchrist

No you can’t.

Cerberus

12:28 AM

If someone gives it the wrong extension, this person is either crazy or a crook.

tchrist

The name of the file could be anything. That doesn’t tell you what is in it.

Cerberus

So I have no reason to want to open a .txt file as an executable.

@tchrist I know that, but it doesn't matter.

tchrist

chthon(tchrist)% file / /bsd /bin/cat /usr/libexec/makewhatis /etc/termcap /usr/share/zoneinfo/GMT
/:                       directory
/bsd:                    ELF 32-bit LSB executable, Intel 80386, version 1, statically linked, not stripped
/bin/cat:                ELF 32-bit LSB executable, Intel 80386, version 1, for OpenBSD, statically linked, stripped
/usr/libexec/makewhatis: perl script text executable
/etc/termcap:            symbolic link to `/usr/share/misc/termcap'
/usr/share/zoneinfo/GMT: timezone data

See how that works?

Cerberus

I know what you are saying, no need to explain it several times.

tchrist

It analyses the actual data, which is the only way to know what is in a file.

Cerberus

12:31 AM

Windows can do that too.

That's not the issue.

But Windows wants you to know what's going to happen if you double-click just by looking at the file, with your eyes.

tchrist

Well, I don’t double click files. I specify filenames.

As arguments to programs.

I say what program should get that filename as its argument.

Cerberus

Windows can do that too.

tchrist

The only automagic thing is with the MIME types.

Cerberus

But 99/100 times, you will want to open a certain kind of file in the default way.

tchrist

If you say so.

Cerberus

12:34 AM

And 99/100 times, in Windows, users will open a file by double-clicking it.

tchrist

I more often like to just look at something rather than change it.

Cerberus

When I want to look at text or a picture, I double-click it.

tchrist

You use the word "open" in a way inconsistent with my worldview.

Cerberus

"Open" means "execute the default action on this file".

tchrist

"Open" prepares a file for input or output. It never executes anything.

See?

Cerberus

12:35 AM

shrugs

I'm just using Windows terminology.

So anyway, I don't see how a .txt file can infect a normal Windows computer.

tchrist

You might as well be speaking Dutch.

Cerberus

Indeed, I might.

tchrist

OPEN(2)                   OpenBSD Programmer's Manual                  OPEN(2)

NAME
     open - open or create a file for reading or writing

SYNOPSIS
     #include <fcntl.h>

     int
     open(const char *path, int flags, mode_t mode);

DESCRIPTION
     The file name specified by path is opened for reading and/or writing as
     specified by the argument flags and the file descriptor returned to the
     calling process.  The flags argument may indicate the file is to be cre-
     ated if it does not exist (by specifying the O_CREAT flag), in which case

Cerberus

I don't see how any of this is relevant to the question whether or not this file can be used to infect a Windows computer.

@ColinFine I do wish people would stop piling on the 18th century grammarians, who were for the most part acutely aware of the differences between English and Latin. In fact, it has been pretty clearly demonstrated that It's me is a 19th century innovation; down to at least 1800 the stock form in all registers was 'tis I. — StoneyB 7 mins ago

tchrist

That’s my open. Your ⁵⁄₃ kilometrage may vary.

Perhaps you might ask someone who is the intended victim.

@Cerberus Is that true?

Cerberus

12:39 AM

I'm willing to believe Stoney.

He's usually reasonable.

Anonymous

Hmm. My memory is that it was about 50/50

Anonymous

My memory is sometimes wrong.

Cerberus

Hi!

Anonymous

arnoldzwicky.org/2012/03/25/our-fastidious-authors

Anonymous

Hello!

Anonymous

12:41 AM

> MWDEU has a substantial article on it’s me (pp. 566-8) that traces the controversy back to the 18th century, with Joseph Priestley favoring the accusative on the grounds of custom and a corps of grammarians, headed by Bishop Lowth, on the side of the nominative. Both options are well attested in reputable writers, from that time till now.

tchrist

> . . . and in 1556 J. Withals published ‘A shorte dictionarie for yonge beginners’ in English and Latin, in which the words were arranged not alphabetically, but under subject-headings, e.g. ‘the names of Byrdes, Byrdes of the Water, Byrdes about the house, as cockes, hennes, etc., of Bees, Flies, and others,’ etc.

A bilingual birder’s fieldguide!

@snailboat I’d certainly trust Arnold on the scholarship bits.

So he’s saying that there was a controversy in the 1700s about what was customary compared with what the grammarians thought logical.

How is that different from today?

Cerberus

> Both options are well attested in reputable writers

That doesn't mean it is I was not customary, nor does it mean that it was less common than it is me.

We should be proud of people who still defend that tradition, who have kept it alive and continued the battle since at least the 18th century.

tchrist

Actually, it does mean that.

> It is I tends to be used in more formal or more stuffy situations; it’s me predominates in real and fictional speech and in a more relaxed writing style.

Distilled: It’s me predominates in speech of all forms and in non-stuffy writing.

But I agree that in the cited example repeating the name would have been better.

You will be hard-pressed to catch Arnold advocating stuffiness for stuffiness’ sake: down that road lies pied piping and other abominations and violations of the English language.

Cerberus

@tchrist It says nothing about speech.

Only about speech as rendered in writing.

Most writing is not rendered speech.

tchrist

So you feel we should have one language for writing and another for speaking?

Cerberus

12:55 AM

...

Virus Total thinks there is no virus in that .txt file.

tchrist

@Cerberus "S"?