Subject: RE: [lemonade] Strawman for Submit based message composition

From: Erev Ari <[email-masked]>
Date: Wed, 11 Jun 2003 11:45:34 +0300

Chris,

Isn't the GENURL/GETURL very similar to the proposed IMAP CHANNEL extension?
http://www.ietf.org/internet-drafts/draft-nerenberg-imap-channel-03.txt (now
expired)

As far as I remember with CHANNEL you could ask the IMAP server for a "URL"
for a specific MIME part of a message (or to the whole message)

Ari

> -----Original Message-----
> From: Chris Newman [mailto:[email-masked]]
> Sent: Wednesday, June 11, 2003 3:08 AM
> To: IETF LEMONADE (E-mail)
> Subject: [lemonade] Strawman for Submit based message composition
> 
> 
> I'll start by defining message composition as the process of 
> assembling
> multiple byte-counted objects from potentially different 
> locations into a
> single byte stream.  IMAP has no such facility.
> 
> SMTP/Submit, however, already has 90% of this facility with 
> the CHUNKING
> extension.  In particular, it assembles a series of 
> byte-counted objects into a
> single byte stream.
> 
> Suppose we create a new Submit extension called "BURL" which 
> can be interleaved
> with "BDAT" commands.  So you can now compose a message as follows:
> 
> BDAT ....               headers and first part
> BURL 8bit <imap-url>    forwarded 8bit content from IMAP
> BDAT ....               MIME delimiters or whatever
> BURL base64 <http-url>  get http content, base64 encode it 
> and include it
> BDAT ....               final data
> 
> This can all be pipelined into one round-trip.
> 
> The BURL extension should advertise what types of URLs it supports:
> 
> 250-BURL http imap://trusted-host.example.com/
> 
> This extension alone would solve the forward-without-download 
> extension for the
> subset of the problem space where the submit server has 
> pre-existing trust
> relationship with the IMAP server.
> 
> Indeed since 99% of the world uses plain text passwords (with 
> or without TLS)
> for authentication.  Authenticating to the submit server will 
> grant sufficient
> rights for the user to access and forward their own mail from 
> IMAP anyway.  So
> why not use it when appropriate?
> 
> If we wanted to go for the additional case where there isn't a trust
> relationship between the submit server and IMAP server, then 
> we simply add two
> extensions to IMAP:
> 
> 1. a "GENURL" command which turns a message or body-part 
> reference within the
> selected mailbox into an extended IMAP URL with an 
> authorization token.  This
> could either have a time-limit or a number of use limit.  The 
> authorization
> token would likely be an HMAC-MD5 covering the URL, a nonce, 
> a time-limit and
> using a per-user random secret known only to the IMAP server.
> 
> 2. a "GETURL" command which is accessible by any IMAP user (including
> anonymous) which returns a literal of the the relevant 
> message/body part if the
> authorization token is valid.
> 
> This just doesn't seem complicated to me.  Indeed it seems 
> much simpler than
> any approach to extending IMAP with a redundant submission 
> and composition
> facility in addition to the one already present in CHUNKING Submit.
> 
>                 - Chris
> 
> _______________________________________________
> lemonade mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/lemonade
>