Subject: [apps-discuss] Comments on draft-melnikov-email-user-agent-00

From: Bjoern Hoehrmann <[email-masked]>
Date: Mon, 21 Oct 2013 23:52:55 +0200

Hi,

  Re http://tools.ietf.org/html/draft-melnikov-email-user-agent-00 I am
a bit surprised that `User-Agent` had not already been registered for
mail, given that it's registered for HTTP and Netnews, but okay...

In the abstract, "registers User-Agent and X-Mailer header fields" might
be better as "the header fields User-Agent and X-Mailer".

In the introduction, "User-Agent and X-Mailer are common Email header
fields for identifying any software (and its components) that generates
email messages." I think the emphasis should be on a given message, like
"the software that generated a message".

In the second sentence, s/, for tracking/and for tracking/ probably.

Also, s/NetNews/Netnews/ as far as the last Netnews RFCs are concerned.

Inconsistent capitalisation of "email" in the first paragraph...

More importantly, it is not clear whether and if how the syntax of the
User-Agent header field is different for mail compared to HTTP and Net-
news. If it's the same as one or the other, the definition should be
through normative reference. If not, that needs to be discussed in the
document. (I see that there is a note about this at the end of the
section, but it is not clear whether it is meant to be exhaustive, and
there is no word about User-Agent in Netnews).

The "MAY" should probably be something else, the normative permission to
use more than one product token is already in the ABNF and requirements
should not be spelled out more than once (use e.g. "can" instead, or if
you really want to use RFC 2119 keywords for this, add that it MUST con-
tain one -- and MAY contain more).

The definition of the X-Mailer header is missing.

There should be some note as to the purpose of Appendix A.

FWIW, I do realise this is a last minute -00 version, and thank you for
getting these registered. You would not happen to know, and that is why
I read the document mostly, why many "recent" mail clients refuse to i-
dentify through these headers? I am thinking horrendously broken web
mail products in particular. There ought to be a SHOULD somewhere to use
them, that would make repairing the mess they leave behind easier...

(https://github.com/hoehrmann/email-analysis/ and various postings to
W3C's www-archive mailing list are my latest efforts in the area...)

regards,
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 30 Oct 2013 11:41:48 +0000

> Hi,
Hi,
Sorry for the delayed response.
> mail, given that it's registered for HTTP and Netnews, but okay...
I was as well...
> Also, s/NetNews/Netnews/ as far as the last Netnews RFCs are concerned.
Ok, I will apply these in the next revision.
> Inconsistent capitalisation of "email" in the first paragraph...
I typically let RFC Editor decide this. I don't particularly care.
> there is no word about User-Agent in Netnews).
It is effectively the same as in Netnews, except that the SP after ":" 
is not required, as historically that was not done in email.
I could have pointed to the Netnews RFC, but I decided against it. I 
think people are more likely to find this in a standalone RFC. But I am 
happy to change my mind, if people have strong feelings about this.

The HTTP format is a bit more restrictive.
> tain one -- and MAY contain more).
This is just emphasizing that multiple are allowed. I don't think it is 
wrong. But I can change.
> The definition of the X-Mailer header is missing.
Good point. It is supposed to have the same syntax as the User-Agent 
header field.
> There should be some note as to the purpose of Appendix A.
I did an informal survey of some messages in my INBOX. I was trying to 
decide whether to use X-Mailer or User-Agent (none of the email messages 
I've seen have both, but some don't contain either one.) in an email 
client that I am writing. I was a bit surprised how widespread X-Mailer is.
> dentify through these headers?
I don't know. I think including one of X-Mailer/User-Agent is rather a 
no brainer.

Some Microsoft products (possibly older ones) don't include these. But 
luckily they are easy to identify by presence of some other Microsoft 
specific header fields.
> I am thinking horrendously broken web
Indeed. Although I don't think mandating this in my document is going to 
help much.
> W3C's www-archive mailing list are my latest efforts in the area...)
Best Regards,
Alexey

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 31 Oct 2013 18:59:22 +0100

> Good point. It is supposed to have the same syntax as the User-Agent

User-Agent and X-Mailer seem to have different syntax.  The former
often report multiple products, while the latter look rather
unformatted, and quite frequently contain raw http URLs and other data
which don't obey that ABNF, <!-- even SGML comments -->.

> decide whether to use X-Mailer or User-Agent (none of the email
> messages I've seen have both, but some don't contain either one.) in
> an email client that I am writing. I was a bit surprised how
> widespread X-Mailer is.

It seems that a proper "Implementation Status" section requires too
much boilerplate to be appealing.  Anyway, you may want to add Alpine,
Eudora, Gnus, KMail, Microsoft-Entourage, and Microsoft-MacOutlook,
which have User-Agent, while Evolution, Eudora for Mac, and Eudora
light have X-Mailer.  ExpressionEngine and CodeIgniter have both
fields; so does SquirrelMail/1.4.3a, but more recent versions have
only User-Agent. [*]

For Security Considerations, I think spear phishing should be a
concern when too much information is being disclosed about users'
system versions and languages.

Keep up the good work
Ale

-- 
[*] collected from my mailbox: http://www.tana.it/mailers.txt