IE 4 security hole?

[Phil Glatz <phil @ glatz . com>]

Does anyone have any more information on this?

The channel definition format (.CDF)
http://www.microsoft.com/standards/cdf-f.htm includes a
LOGTARGET feature that allows a web site provider to make
your browser deliver logs of your usage via an http post or
put. Even hits from cache are logged. This is all not so good
and getting worse. Not only is the information posted
material, you wouldn't want to give to a provider,
(considering) "http post/put" is normally spoofable anyway.