From: "Geo." 

"Rich"  wrote in message news:3e322002{at}w3.nls.net...
>   You would do the same by opening the web page by any other means.<

Yes but there is a major difference. For example a user who prefers
Netscape won't be affected simply because MS requires IE be installed for
certain management functions if IE can't be started up via these webbug
like features in media player (for lack of a better description).


>There are obviously choices in implementation and others may do differently
but OE and Outlook both perform this resolution for themselves using public
APIs provided in Windows for pluggable protocol support.  While IE (more
accurately MSHTML) provides the rendering engine for both of these, the
relevant component is owned by the applications and IE is just doing what
it was asked. <

Interesting point and I can understand that pov, but I believe it depends
on the access level being passed to the code that determines what is being
exploited. As an example if I startup media player with run as guest
instead of as my logged in user and it fires up IE as guest level, then I
view it as media player being exploited since if I clicked on a link IE
would have run as my user not as guest. I believe that to be a significant
difference because I could easily be running as guest and fire up media
player with a run as admin (media player being a bad example of something
you would run with a high access level of course).

Geo.

--- BBBS/NT v4.01 Flag-4