Subject: [lemonade] Why are we keeping X-MMS headers?

From: Eric Burger <[email-masked]>
Date: Fri, 24 Jun 2005 00:20:53 -0400

Are we keeping X-MMS headers because they are of use *ONLY* to a MMS MTA or
MUA?  That is, do we want to tunnel the X-MMS header from MMS land through
Internet land back to MMS land?

Conversely, do we want to enable an Internet MUA the ability to set a MMS
header that gets appropriately translated into MMS land?  Do we want an
Internet MUA or MTA to take special action based on a X-MMS header?

If the former, I would offer that X-MMS is probably, IMHO, not speaking as
the Chair, speaking just a participant, OK.  This is just a weird set of
octets starting with an X-, with no special meaning.  However, we then MUST
include a note in the security considerations that MMS land absolutely,
positively cannot trust the contents of the header.  See the headers in any
of Randy's messages (X-message-flag).

If the latter, then I would offer that we are creating an Internet header,
and thus MUST NOT start with X-.

Note that for the former case (only MMS gateways care and it is OK to lose
the information), we addressed precisely the "private" or "User-Defined",
yet standard label, problem in the SIP world by using P- headers.  P-
headers are documented, but have no meaning in the global Internet world.
IANA manages the name space, so there are no collisions.  However, the
values of the headers are opaque objects as far as the Internet is
concerned.  The Internet infrastructure can feel free to drop or ignore P-
headers.

Entities that care about MMS, like a MMS-Internet e-mail gateway or an
MMS-aware Internet Mail MUA, know about the well-defined P- headers.  Note
that if there is specified behavior for anything other than an MMS gateway,
by definition you have an Internet header.  In this case, the particular
header cannot be X- or P- headers.

Thoughts?

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Mark Crispin <[email-masked]>
Date: Thu, 23 Jun 2005 23:48:12 -0700 (PDT)

> Internet land back to MMS land?

I don't think that you are asking the right question.  A better question 
is:

What harm is caused by requiring that all X-MMS headers be removed?  If 
there is no harm, then why haven't we required the removal of these 
headers?

> Internet MUA or MTA to take special action based on a X-MMS header?

The first question is OK.  The second question needs to be rephrased as 
the following two questions:

Do we want to permit an Internet MUA or MTA to take special action based 
upon an MMS header?  If a hacker decides to generate X-MMS headers for the 
private use of the My Magic Service mailer, is there the slightest 
possibility that this will cause a problem for another Internet MUA or 
MTA?

I contend that:
 	if there is any harm caused by removing MMS headers
OR
 	if we want to permit an Internet MUA or MTA to take special action
 	based upon an MMS header
OR
 	if we want to allow an Internet MUA or MTA to set an MMS header
 	that can be passed to MMS land
OR
 	if our hacker using X- headers for the My Magic Service will
 	create the slightest possibility of grief for an Internet MUA or
 	MTA
then we MUST define non-experimental named (e.g. MMS) headers to represent 
these headers, and we MUST NOT use X-MMS headers.

Corrolary:

If there is no harm caused by removing MMS headers, then they MUST be 
removed because retaining them causes harm.  This is because:
  . if a header is defined, some hacker will decide to take special action
    based upon it.
  . some entity will presently to want to create an Internet->MMS gateway
    and define headers that go to MMS land.
  . there will presently be a hacker who uses X-MMS for the My Magic
    Service mailer.  [If challenged on this point, I hereby volunteer to be
    that hacker.]

If it is absolutely vital for debugging purposes that the MMS headers be 
passed, but NOT interpreted by Internet software, then use the existing 
comment mechanism of RFC 2822:

Comment: The following lines are from MMS for debugging purposes.  This
  data MUST NOT be used to take any special action.
   X-MMS-blurdybloop: 234
   X-MMS-sarasoop: owatagusiam
   X-MMS-Rena: a puppy rabbit, a twirly girl, a Missy Muddy-Paws
   X-MMS-MRC: this guy is freaking nuts
  E$B+)(Bnd of MMS debugging da.

Conclusion:

I see no place for X-MMS headers in the Internet world.  Either the 
headers are of value (their removal causes harm) and need real names of 
their own, or they are truly useless and their preservation causes harm.

I also don't understand why we are even discussing this point.  Whether or 
not you think that X-MMS is a problem, the fact that some people consider 
it to be a problem should suffice to deploy one of the presented 
alternatives which will silence our objections and allow us to move on to 
problems where there is no clear alternative.

Stubbornness in defense of something that is necessary may be a virtue. 
Stubbornness in defense of something that is unnecessary is not.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: Randall Gellens <[email-masked]>
Date: Fri, 24 Jun 2005 09:55:57 -0700

>  Internet land back to MMS land?

That was the original intent, yes, but it only applied to two of the 
many x-mms-* headers, and I've already agreed that we can drop this 
special treatement of these two.

>  Internet MUA or MTA to take special action based on a X-MMS header?

No, this was never the intent, and I am not aware of any wording in 
any version of the document that ever could have been interpreted in 
that way.

-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly-selected tag: ---------------
There are things that are so serious that you can only joke about them
                                                          --Heisenberg