Subject: [apps-discuss] Document Shepherd review of draft-ietf-appsawg-malformed-mail-07

From: S Moonesamy <[email-masked]>
Date: Sat, 14 Sep 2013 14:29:01 -0700

Hello,

Here's my review of draft-ietf-appsawg-malformed-mail-07.  Sorry for 
the long delay in getting this out.

The draft is almost ready for publication as Informational 
RFC.  There are a few minor changes not included in this message 
which I discussed about with the authors.

In Section 1.2:

   "It is important to understand that this work is not an effort to
    endorse or standardize certain common malformations.  The code and
    culture that introduces such messages into the mail stream needs to
    be repaired, as the security penalty now being paid for this lax
    processing arguably outweighs the reduction in support costs to end
    users who are not expected to understand the standards."

Section 1 quotes Postel's directive.  I read that directive as 
favoring interoperability as it is not possible to fix the code 
already in the wild.  I don't think that it is about support 
costs.  It is more about both of us being able to communicate with 
each other through, for example, email.  It might be better to argue 
that the malformations give more leeway to security issues.

Regards,
S. Moonesamy

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 14 Sep 2013 18:07:48 -0700

On Sat, Sep 14, 2013 at 2:29 PM, S Moonesamy <[email-masked]> wrote:

> Section 1 quotes Postel's directive.  I read that directive as favoring
> interoperability as it is not possible to fix the code already in the wild.
>  I don't think that it is about support costs.  It is more about both of us
> being able to communicate with each other through, for example, email.  It
> might be better to argue that the malformations give more leeway to
> security issues.
>
>
What Postel said encourages interoperability, to be sure, and I don't
believe he had support costs in mind.  When applied to protocols far from
layers 7 and up, it works as he stated.  I think, though, that taken to an
extreme, and especially in the higher layers where the air is thin, we get
to the situation in which we now find ourselves.  It has introduced
security concerns at least in the area of email handling.

Hence, I believe the document does exactly what you're suggesting already.

-MSK

---

From: S Moonesamy <[email-masked]>
Date: Tue, 17 Sep 2013 11:17:35 -0700

Hi Murray,
At 18:07 14-09-2013, Murray S. Kucherawy wrote:
>What Postel said encourages interoperability, to be sure, and I 
>don't believe he had support costs in mind.  When applied to 
>protocols far from layers 7 and up, it works as he stated.  I think, 
>though, that taken to an extreme, and especially in the higher 
>layers where the air is thin, we get to the situation in which we 
>now find ourselves.  It has introduced security concerns at least in 
>the area of email handling.
>

As nobody else expressed an opinion I suggest leaving the text as it is.

Can you submit -08 and I'll post the write-up?

Sorry for the very long delay.

Regards,
S. Moonesamy