Are MS-Excel attachments safe?

[PGStats]

Posters often attach Excel worksheets to their questions. But many forum members (including myself) will not download such files because of the security risk that they represent. Are Excel file attachments available on the forum safe to download?

If YES, it should be explained somewhere.

If NO, then why accept them?

[Tom]

You do not need to download Excel files to look at them. The forum will allow you to preview the information in the Excel files without downloading them. Click on the name instead of download icon.

Now if we can get them to make the forum editor smart enough to know that .sas files are just text files and allow them to be previewed also.

[PGStats]

Most often, just looking at the data is not enough. I would need to download for testing.

[ballardw]

---

@Tom wrote:

You do not need to download Excel files to look at them. The forum will allow you to preview the information in the Excel files without downloading them. Click on the name instead of download icon.

Now if we can get them to make the forum editor smart enough to know that .sas files are just text files and allow them to be previewed also.

---

Actually this may not be correct depending on what a variety of intersections of forum settings and user nanny ware may do.

I cannot preview any file on this site. PDF, TXT,  CSV, XLSX, DOCX, it doesn't matter. I have to download to see them. The preview window opens followed by a can't display message.

[Reeza]

---

@ballardw wrote:

---

@Tom wrote:

You do not need to download Excel files to look at them. The forum will allow you to preview the information in the Excel files without downloading them. Click on the name instead of download icon.

Now if we can get them to make the forum editor smart enough to know that .sas files are just text files and allow them to be previewed also.

---

Actually this may not be correct depending on what a variety of intersections of forum settings and user nanny ware may do.

I cannot preview any file on this site. PDF, TXT,  CSV, XLSX, DOCX, it doesn't matter. I have to download to see them. The preview window opens followed by a can't display message.

---

That's interesting. It works for me, even on a phone! I wonder if its a browser setting blocking pop ups or something. I believe (though not certain) they're using Box to store files and that the Box previewer is being used. 

[Kurt_Bremser]

---

@Reeza wrote:

---

@ballardw wrote:

---

@Tom wrote:

You do not need to download Excel files to look at them. The forum will allow you to preview the information in the Excel files without downloading them. Click on the name instead of download icon.

Now if we can get them to make the forum editor smart enough to know that .sas files are just text files and allow them to be previewed also.

---

Actually this may not be correct depending on what a variety of intersections of forum settings and user nanny ware may do.

I cannot preview any file on this site. PDF, TXT,  CSV, XLSX, DOCX, it doesn't matter. I have to download to see them. The preview window opens followed by a can't display message.

---

That's interesting. It works for me, even on a phone! I wonder if its a browser setting blocking pop ups or something. I believe (though not certain) they're using Box to store files and that the Box previewer is being used. 

---

Box is some kind of cloud storage, and such services are blocked where I work.

[ChrisHemedinger]

Some answers:

How does the preview work? As others have pointed out, the "lightbox" preview relies on a web service from Box.  It's a good way to preview the data, but if you intend to import and test a data file, it's not enough.  The preview works with all standard "office productivity" formats: DOC, XLS, PDF, PPT, TXT, CSV and others.  Yes, I wish it worked for SAS programs too.  Sites that block Box.com services via their firewall won't be able to use the preview.  I think there is a case to be made for "whitelisting" Box.com for an organization that has to get info from the Internet -- our community is just one of many sites that use this service.  Box.com is an enterprise-level file share/collaboration service that is widely used by organizations in all industries.  Fun fact: I had to petition for this with our own IT when we had an overzealous firewall system here at SAS -- but it was an easy case to make.

Are these attachments safe? As citizens of the Internet, we know that there are no guarantees.  These attachments are not scanned for malware/viruses within the community platform.  However, of the mentioned types, only the MS Office docs (XLS, DOC, PPT) might contain macro/scripting code that could be malicious.  Microsoft Office and Windows will, by default, disable the running of this code within a downloaded attachment.  I'm sure you've all seen that warning/notice at the top of a document when you open it -- you have to click a button to allow macros/code to be re-enabled.  Personally, I don't worry about malware from downloaded Excel files, especially when I've encountered them on legit sites/forums.  My system (thanks to SAS IT and Microsoft) has enough protections in place, and downloading these files is within our IT policy.  However, I can't offer you any assurances -- you need to weigh the risks/benefits for yourself.  My opinion is that the risk is low.

Chris

[Reeza]

I think ZIP files can be pretty dangerous as well.

My mom had a zipped file sent over that did compromise their network and they transferred a few 100K out of their company bank accounts before it was detected by the bank (medium size business). They aren't allowed to use any attachments anymore and were able to recover almost all though it took a few months.