6 ms·

Not to be smart -- but how else would invites work?

by s_dev 2y ago

autoexec 2y ago
I'd want to whitelist specific people before they could send me a calendar invite. Every other invite request should never reach my device. If I don't even know you, why would I want your invites anyway?
- bongodongobob 2y ago
  Because you work with people outside of your company, support, vendors, sales people etc. Boss: Why aren't you in the meeting with our vendor to upgrade our X system? You: Oh I whitelist all my invites. You see, I am thinking about security and don't want to receive invites from someone I don't know. Boss: Clear your desk, security will walk you out.
  - fbrchps 2y ago
    Or the much more sensible, and MSFT way of handling it (in outlook) ExternalUser: Hello here is a calendar invite I would like you to attend, please confirm or deny User: Thank you, now I can verify the request and choose to add this to my calendar or not
  - autoexec 2y ago
    > Because you work with people outside of your company, support, vendors, sales people etc. If I work with them, I would have them whitelisted. If I've never even heard of them they have no business sending my devices calendar invites. Boss: Why aren't you working on that project I gave you? You: Some stranger in Indonesia invited me to a sales meeting instead. Boss: If I need you to go to a sales meeting with someone from Indonesia I'll tell you to! Clear your desk!
    - bongodongobob 2y ago
      Idk, other members of the third party company get pulled in all the time and might schedule something. I can't imagine using a calendar whitelist or why you'd even want to.
      - autoexec 2y ago
        Well, to eliminate a source of spam, reduce exposure to phishing, and prevent vulnerabilities like the one talked about in the article by reducing attack surface. If someone is going to make some demand for my time, the very least they can do is give me notice outside of my icloud calendar. An email, an IM, a phone call, etc are all very easy and they allow me to make sure it's real before it has any chance to interfere with my schedule. "Hey Boss, this guy says he's our new IT guy and he wants to talk about my network settings" or "Hey $vendor, I just got a call from $rando saying he's our new contact, can you verify that for me before I tell him everything I know about your propriety applications?" It helps that I like to keep my work devices and my personal devices entirely separate. If someone in the office wants to pull me into a work meeting through outlook, they'll already have to have an account set up on the company's exchange server. Anyone outside of the company I should already have a relationship with or at least a heads up.
  - paperplatter 2y ago
    The way I understand it now, they attach an invite to an email that you don't even read, but it shows up on your calendar. Is it too much effort to open the attachment yourself? Normally you think twice about opening an attachment from someone you don't know.
vasco 2y ago
How often do you get a calendar invite from a person who you never interacted through email before and don't have in contacts vs the opposite, and actually take the meeting?
- pbhjpbhj 2y ago
  I, in UK, book things on Eventbrite, they email you with a calendar invite. Same with other booking systems for events IIRC. You can probably add people to an invitation? Maybe if you can exploit such a system then people would have them in their whitelist in any case? A little adjacent to your question but relevant enough I think.
- yardstick 2y ago
  HR / Recruiter setting up interviews? The person doing the inviting might be different from previous calls/emails. Customer meetings I get invited to often come from someone I’ve never dealt with before, but include others who I work with who were responsible for bringing me into it.
  - saghm 2y ago
    I think there's a pretty big gap between "people at my company are allowed to add things to my calendar" and "random stranger anywhere in the world can add things to my calendar".
    - yardstick 2y ago
      Neither of the above examples would come from people in my company.
      - saghm 2y ago
        "others who I work with who were responsible for bringing me into it" sounded to me like people at your company, who I assumed would be able to add you to the meetings. I guess I might have been mistaken
diebeforei485 2y ago
There are possible safeguards -- only allowing invites if you are on each other's contact lists, for example, or the same domain, or something else. Apple had a big problem with Calendar spam that they have not really fixed.

Not to be smart -- but how else would invites work?

by s_dev 2y ago

Not to be smart -- but how else would invites work?

I'd want to whitelist specific people before they could send me a calendar invite. Every other invite request should never reach my device. If I don't even know you, why would I want your invites anyway?

bongodongobob 2y ago
Because you work with people outside of your company, support, vendors, sales people etc. Boss: Why aren't you in the meeting with our vendor to upgrade our X system? You: Oh I whitelist all my invites. You see, I am thinking about security and don't want to receive invites from someone I don't know. Boss: Clear your desk, security will walk you out.
- fbrchps 2y ago
  Or the much more sensible, and MSFT way of handling it (in outlook) ExternalUser: Hello here is a calendar invite I would like you to attend, please confirm or deny User: Thank you, now I can verify the request and choose to add this to my calendar or not
- autoexec 2y ago
  > Because you work with people outside of your company, support, vendors, sales people etc. If I work with them, I would have them whitelisted. If I've never even heard of them they have no business sending my devices calendar invites. Boss: Why aren't you working on that project I gave you? You: Some stranger in Indonesia invited me to a sales meeting instead. Boss: If I need you to go to a sales meeting with someone from Indonesia I'll tell you to! Clear your desk!
  - bongodongobob 2y ago
    Idk, other members of the third party company get pulled in all the time and might schedule something. I can't imagine using a calendar whitelist or why you'd even want to.
    - autoexec 2y ago
      Well, to eliminate a source of spam, reduce exposure to phishing, and prevent vulnerabilities like the one talked about in the article by reducing attack surface. If someone is going to make some demand for my time, the very least they can do is give me notice outside of my icloud calendar. An email, an IM, a phone call, etc are all very easy and they allow me to make sure it's real before it has any chance to interfere with my schedule. "Hey Boss, this guy says he's our new IT guy and he wants to talk about my network settings" or "Hey $vendor, I just got a call from $rando saying he's our new contact, can you verify that for me before I tell him everything I know about your propriety applications?" It helps that I like to keep my work devices and my personal devices entirely separate. If someone in the office wants to pull me into a work meeting through outlook, they'll already have to have an account set up on the company's exchange server. Anyone outside of the company I should already have a relationship with or at least a heads up.
- paperplatter 2y ago
  The way I understand it now, they attach an invite to an email that you don't even read, but it shows up on your calendar. Is it too much effort to open the attachment yourself? Normally you think twice about opening an attachment from someone you don't know.

vasco 2y ago

How often do you get a calendar invite from a person who you never interacted through email before and don't have in contacts vs the opposite, and actually take the meeting?

pbhjpbhj 2y ago
I, in UK, book things on Eventbrite, they email you with a calendar invite. Same with other booking systems for events IIRC. You can probably add people to an invitation? Maybe if you can exploit such a system then people would have them in their whitelist in any case? A little adjacent to your question but relevant enough I think.
yardstick 2y ago
HR / Recruiter setting up interviews? The person doing the inviting might be different from previous calls/emails. Customer meetings I get invited to often come from someone I’ve never dealt with before, but include others who I work with who were responsible for bringing me into it.
- saghm 2y ago
  I think there's a pretty big gap between "people at my company are allowed to add things to my calendar" and "random stranger anywhere in the world can add things to my calendar".
  - yardstick 2y ago
    Neither of the above examples would come from people in my company.
    - saghm 2y ago
      "others who I work with who were responsible for bringing me into it" sounded to me like people at your company, who I assumed would be able to add you to the meetings. I guess I might have been mistaken

diebeforei485 2y ago

There are possible safeguards -- only allowing invites if you are on each other's contact lists, for example, or the same domain, or something else. Apple had a big problem with Calendar spam that they have not really fixed.