aidanns

This happened at Melbourne Uni this year with a slight twist - the student support team emailed all-students@unimelb.edu.au (or some variation) letting them know about the support services the uni had on offer for students in distress.

Some poor soul (or a skilled troll) replied to the list with an email intended for the support team itself requesting help with coping with the stress of exams and uni life, starting a "please remove me from this list" conversation that went on for a day or two before they closed the list.

Honestly I've never felt so bad for someone in my whole life, although some of the replies were hilarious.

The file has been created in such a way that the web browser is ignoring the non-html parts of the document, while the image renderer is ignoring the parts that make up the html page.

The first part probably isn't too hard, since most web browsers go to great lengths to render non-standard html in a sensible way, I'm not too sure about the second part. I'm guessing the jpeg spec has some variable length space in some kind of file header that the html for the page can be put in to.

I read something similar a while back (I think it was called a Jafar attack) where a clever person worked out how to create a file that was both a valid .gif image and .jar java executable.

This sounds similar to what Optus are doing here in Australia with their TV Now service, although they are billing themselves as a "remote PVR" rather than "remote antenna". Optus won the initial case, but Telstra and the sport codes lobbied the government for a "review" in to the relevant laws, which is ongoing I believe.

http://www.theage.com.au/business/optus-wins-landmark-web-br...

Building a business on a "loophole" seems to be a highly risky affair. That said, I'm not really familiar with the US law making process so I don't know how long it would take to change it to make what they are doing illegal.