[thelist] stm vs htm for includes on IIS

[Alex & Adrian]

Hi all,

We are on an IIS web server at work.
There has been some debate regarding sercurity issues with running 
server includes on IIS in .htm files.
Apparently there is a sercurity risk if you do - but it's not a problem 
if your using the .stm extension.

Any ideas why this might be so?
More impoprtantly - how much of a risk does it pose?

Can I tell my boss that MS (the source of this info) are full of it?
And that we can run .htm as server parsed files??

Thanks in advance - Adrian K