Subject: [apps-discuss] Stephen Farrell's Yes on draft-ietf-appsawg-malformed-mail-10: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Thu, 21 Nov 2013 04:17:28 -0800

Stephen Farrell has entered the following ballot position for
draft-ietf-appsawg-malformed-mail-10: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-appsawg-malformed-mail/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for a useful document. I would have loved to have
seen text about S/MIME and PGP issues, but I guess that
might require another equally long document all by
itself. It might well be worth looking though to see if
there's a reference to which you could point that has
relevant guidance about those. 

Separately, it might also be worth pointing out that
some of the handling guidance you give if applied to
some S/MIME or PGP messages is likely to break
signatures or make decryption impossible.

But those are just suggestions to take or leave, this is
already useful enough as-is.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 21 Nov 2013 06:16:53 -0800

Hi Stephen,

> relevant guidance about those.

I don't think I've ever seen an ambiguity in an email message that included
S/MIME or PGP, so I don't have much to offer here.  My co-authors might, so
I'll let them chime in if so.  I'll do a quick look around to see what I
can find.

> signatures or make decryption impossible.
Sure, we can look at that angle as well.  Thanks for the suggestion.

-MSK

---

From: "John Levine" <[email-masked]>
Date: 21 Nov 2013 17:12:52 -0000

>I'll let them chime in if so.  I'll do a quick look around to see what I

I'm not a co-author, but other than messages signed with expired keys
it's hard to think of anything.  In general, if you don't have the
key, you can't verify the signature or decode the message, so there's
nothing to fix.

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 21 Nov 2013 17:52:43 +0000

> key, you can't verify the signature or decode the message, so there's

Well there were cases of folks messing up when they forwarded
signed mails and so on, but maybe those were all sorted in the
end. Paul H. might even have written something up back in his
IMC days. But again, I'm not asking that stuff like that be
added unless the authors want to do it.

S

> 
>  
> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
> 
>

---

From: Ned Freed <[email-masked]>
Date: Fri, 22 Nov 2013 07:41:43 -0800 (PST)

> >    I don't think I've ever seen an ambiguity in an email message that
> >    included S/MIME or PGP, so I don't have much to offer here.  My
> >    co-authors might, so I'll let them chime in if so.  I'll do a quick
> >    look around to see what I can find.

> Like Murray, I haven't observed any S/MIME or PGP mangling (which doesn't
> mean it doesn't happen, just that it hasn't been caught).

We mostly deal with S/MIME, and I can't recall a case where an S/MIME
message (either signed or encrypted) got mangled. Certificate problems sure,
but that's a different sort of thing.

Signed PGP messages get "mangled" all the time, but that's because a lot of PGP
still uses the text/plain approach rather than multipart/signed. I regard this
as a case of PGP acting stupidly and getting exactly what it deserves.

				Ned

---

From: Gregory Shapiro <[email-masked]>
Date: Thu, 21 Nov 2013 08:58:38 -0800