2

Yesterday evening, an individual(at a french meetup haha) asked me what ethereum was and kept asking me if there was something similar to MIME types on Ethereum. I did not know what MIME types were and so asked and he said 'It's part of a specification that standardizes the nature and format of a document).

The reason for this question was, if someone were to say, scan through the blockchain running any code that looks familiar(say, starts with html) but was malicious, there would be no way of knowing.

Is there any reason to be concerned about this? Is there a way this can/is already circumvented?(I'm thinking an EIP)

He also mentioned NATSPEC's efforts in trying to do something similar for browsers

1
  • 2
    You can embed a message in a transaction but the space is quite limited, and the interpretation depends on the target and not for general consumption. Right now I do not think embedding a document is a priority for Ethereum developers.
    – Ismael
    Commented Aug 12, 2018 at 23:10

1 Answer 1

1

Is there any reason to be concerned about this? Is there a way this can/is already circumvented?(I'm thinking an EIP)

No reason to be more concerned than with any other content available online or offline.

MIME types have never been, and will never be, a security feature. It's only a hint on how to handle the content (like file extensions). They do not prevent malicious content. It's even the opposite: for example, some people can trick you by uploading an image with GIF MIME when actually delivering some malicious PHP code that will exploit a weakness in your program (many examples available on the web).

There's no EIP or anything related to this as this is not up to Ethereum protocol to be careful about client exploits. Checking that a content is not malicious is up to the tool that opens it (and antivirus or malware protection software). This is true for Ethereum, but also for anything in computer world.

Never trust MIME or file extension.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.