Subject: Re: msg-id

From: John Stanley <[email-masked]>
Date: Mon, 6 Dec 2004 17:15:14 -0800 (PST)

"Charles Lindsey" <chl@xxxxxxxxxxxxxxxx>:

>It has been discussed peridically in this WG, and the opinion expressed
>has always been that one failure per thousand years (whatever - I haven't
>calculated the exact probability for the Agent scheme) could be regarded
>as satisfying that MUST for all practical purposes. 

It is a mistake to view the odds of "once per thousand years" as meaning
"won't happen for 1000 years". A "once per thousand years" system is just 
as likely to duplicate a message id tomorrow as it is 999 years from now. 
And then once it has duplicated the id tomorrow, it is just as likely to 
do so the day after that.

Casinos get rich off of people who play roulette using that kind of system.

> But the id-right is NOT case-sensitive, 

I see nothing in RFC2822 that says it is not case-sensitive. Even if you 
assume that the id-right is obs-domain, there is nothing in RFC2822 that 
says that obs-domain is not case-sensitive. I don't believe that 
case-insensitivity is mentioned until one gets to the DNS standards. In
a message id, it is a string, and certainly one would understand that 'A'
is not the same as 'a', when working at that level.

>I don't think it matters particularly. What happens in practice is that
>news agents just take everything from the first '<' to the next '>' or SP
>and do a simple comparison of the resulting string. I doubt any agent,
>except an injecting agent, every looks inside to see what is there, and I
>expect many injecting agents do little more than check there is a single
>'@' somewhere in it.

I don't think so. When I was running a mail to news gateway, one of the 
first steps I was forced to take was to convert the mail message id into 
something legal for news, since a large number of them seemed to contain
spaces. The injecting agent didn't accept that at all. It did not just 
compare everything from the first '<' to the next '>' or SP or just look 
for an '@' somewhere.

---

From: Seth Breidbart <[email-masked]>
Date: Mon, 6 Dec 2004 20:33:15 -0500 (EST)

> do so the day after that.

True; but so what?  The _spec_ says "MUST be unique".  If a particular
implementation only guarantees uniqueness with a probability greater
than the one that my computer won't melt in between my typing the
message and hitting "send", then that implementation is going to cause
me to lose fewer articles than Murphy already does.  I consider that
level of lossage acceptable.  If you don't, feel free not to use that
implementation.

Seth

---

From: Thorfinn <[email-masked]>
Date: Tue, 7 Dec 2004 12:39:56 +1100

On Mon 06 Dec 2004 at 05:15:14PM -0800, in <[email-masked]>,
> Casinos get rich off of people who play roulette using that kind of system.

It's a lot less of a worry than the people who don't use any kind of
scheme at all for the LHS.  A *lot* of newsreaders stick in the "FQDN"
of the "host" they're on on the RHS... and all too often that's
"foo.localnet".

It's all well and good when the hostname *is* a real FQDN, but an awful
lot of people are behind IP masqueraded firewalls these days, even
"home" users, who often have broadband "routers" that do IPmasq.

Ook,

 Thorf

-- 
<a href="http://tertius.net.au/~thorfinn/">[email-masked]</a>
"New zero-employee strategy.  It's the latest way of saving on costs."
    -- sharkey*zoic.org

---

From: "Charles Lindsey" <[email-masked]>
Date: Tue, 7 Dec 2004 17:13:02 GMT

>I see nothing in RFC2822 that says it is not case-sensitive.

Then I think we are in agreement. But I am aware of people who do not
share that view.

>compare everything from the first '<' to the next '>' or SP or just look 

Indeed, injecting agents may well have to check for these funny cases (but
then that is what I said). But relaying and serving agents have no time to
perform such checks, and so will proceed on the assumption that any broken
cases will have been weeded out beforehand.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5

---

From: Russ Allbery <[email-masked]>
Date: Tue, 07 Dec 2004 13:03:04 -0800

Charles Lindsey <[email-masked]> writes:
> John Stanley <[email-masked]> writes:

>> first steps I was forced to take was to convert the mail message id
>> into something legal for news, since a large number of them seemed to
>> contain spaces. The injecting agent didn't accept that at all. It did
>> not just compare everything from the first '<' to the next '>' or SP or
>> just look for an '@' somewhere.

> Indeed, injecting agents may well have to check for these funny cases
> (but then that is what I said). But relaying and serving agents have no
> time to perform such checks, and so will proceed on the assumption that
> any broken cases will have been weeded out beforehand.

Charles is indeed mistaken about what many relaying and serving agents do.
John is correct, and not just for injecting agents.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Henry Spencer <[email-masked]>
Date: Tue, 7 Dec 2004 16:52:03 -0500 (EST)

> Then I think we are in agreement. But I am aware of people who do not

Hmm, interesting.  This changed from 822 to 2822.  RFC 2821, SMTP, is
explicit that the domain of an addr-spec is case-insensitive, but 2822 is
silent about it... and the body of a message ID is no longer an addr-spec
anyway. 

> cases will have been weeded out beforehand.

I think it would be more accurate to say "might not have time" and "may
proceed on the assumption".  Some will undoubtedly wish to be fussier, but
this should be optional rather than mandatory. 

                                                          Henry Spencer
                                                       [email-masked]

---

From: "Charles Lindsey" <[email-masked]>
Date: Thu, 9 Dec 2004 12:03:55 GMT

>this should be optional rather than mandatory.

Indeed. That is what I meant. 

For example, I believe some relaying agents do still check the id-right
case insensitively. But many (most?) don't, and no way should our draft
require them to.

---

From: "Charles Lindsey" <[email-masked]>
Date: Thu, 9 Dec 2004 12:00:32 GMT

>John is correct, and not just for injecting agents.

Please can you be more explicit? Are you claiming that all relaying and
serving agents make full and exhaustive checks on the format of all
message-ids? To the same extent than injecting agents do, or should do?

Henry Spencer seems to agree that what I said in my last paragraph quoted
above was more or less correct.

---

From: Russ Allbery <[email-masked]>
Date: Thu, 09 Dec 2004 11:05:35 -0800

Charles Lindsey <[email-masked]> writes:
> Russ Allbery <[email-masked]> writes:

>>> (but then that is what I said). But relaying and serving agents have
>>> no time to perform such checks, and so will proceed on the assumption
>>> that any broken cases will have been weeded out beforehand.

>> Charles is indeed mistaken about what many relaying and serving agents
>> do.  John is correct, and not just for injecting agents.

> message-ids? To the same extent than injecting agents do, or should do?

I'm saying that your generalization is false, and many relaying and
serving agents do indeed perform these checks to the same level of
scrutiny as injecting agents.

> Henry Spencer seems to agree that what I said in my last paragraph
> quoted above was more or less correct.

Henry said that many relaying agents perform these checks, but not all of
them do, and therefore we need to proceed on the assumption that they
might not.  That seems reasonable to me, and is not quite what you said.
You were just disagreeing with John in more absolute terms than are
actually warranted.

---

From: Frank Ellermann <[email-masked]>
Date: Fri, 10 Dec 2004 00:36:20 +0100

Charles Lindsey wrote:

> I believe some relaying agents do still check the id-right
> case insensitively. But many (most?) don't, and no way should
> our draft require them to.

Please mention this in the text, it's an important difference
from s-o-1036 or from 1036 plus 822.  I recall discussions with
experts, where some argued that 2822 updated 822, and therefore
1036 implicitly inherited this update, and others argued that
2822 does not yet replace STD 11, and I argued that s-o-1036
is THE LAW and anything else nonsense, unless it's in the book
of Mozilla.

Okay, not all of these discussions were _that_ irrational, but
still funny and technically inconclusive.  Bye, Frank

---

From: Henry Spencer <[email-masked]>
Date: Thu, 9 Dec 2004 19:06:18 -0500 (EST)

On Fri, 10 Dec 2004, Frank Ellermann wrote:
> from s-o-1036 or from 1036 plus 822.

Yes, that's a good point -- it deserves mention in a NOTE, as a warning
to new implementers, even if the specs are believed to be clear about it.

                                                          Henry Spencer
                                                       [email-masked]

---

From: "Charles Lindsey" <[email-masked]>
Date: Fri, 10 Dec 2004 14:12:16 GMT

>to new implementers, even if the specs are believed to be clear about it.

There was indeed such a NOTE in 5.3 of draft-13:

        NOTE: Some old software may treat message identifiers that
        differ only in case within their id-right part as equivalent,
        and implementors of agents that generate message identifiers
        should be aware of this.

But it got lost in the great rush to chuck out all unnecessary texts as
part of the split :-( .

I have now pot it back at the end of Step 5 of the duties of a relaying
agent.

Note that both USEFOR and USEPRO now make the point that a simple
case-sensitive comparison of octets is all that is ever required to
determine the identity of two message-ids.