Re: Comments on draft-homme-sieve-variables-01.txt

[Kjetil Torgrim Homme <kjetilho@xxxxxxxxxx>]

[Simon Josefsson]:
>
>   * The setdate command is useful, but wouldn't it be even more useful
>     if there was a command that extracts comparable time/date
>     variables from Date: headers?  To handled obs-zone's timezones.
>     E.g., consider if I want to sort messages sent (Date:) between
>     01 am and 04 am (in the senders timezone) into a folder
>     INBOX.rants.

like
  SETDATE :header "Date";
vs. just
  SETDATE;
to access the current time.

Ned, you had some ideas for more date related tests, what do you
think?

it seems to me that the only interesting data to be found in Date: is
the local time and time zone of the sender (I feel SETDATE should
normalise the timezone to offset format if it recognises it).  the
date itself should be no more than a few minutes earlier than current
time.  if it isn't, there is a misconfiguration or an outage going on.

oh!  if you run the Sieve script in batch, long after the delivery was
made, the current date is completely useless.  SETDATE should be
changed to initialise the variables to the time of delivery, not
current time.

>   * A security consideration is that people should be aware that RFC
>     2047 encoded-word, IDNA etc potentially encode information that the
>     script wants to trigger on.  This should have been in RFC 3028, but
>     as variables makes it even more likely that people will try to use
>     sieve scripts to filter for virus etc it might be useful to mention
>     it.  Compare the sieve-body draft:
>   
>      Filters relying on string matches in the raw body of an e-mail
>      message may be more general than intended.  Text matches are no
>      replacement for a virus or spam filtering system.

I'd appreciate it if you could formulate a paragraph for me :-)

>   * The examples in Section 3.1 and 4.1.1 should be terminated with
>     semi-colons to be complete Sieve commands.

thanks.

>   * I feel variable variable names (e.g., ${foo-${bar}-baz}) would be
>     useful, but I can't come up with a good example why it is really
>     required so I'm just mentioning it if someone else can come up
>     with a illustrative example.

it could be used as a poor man's associative arrays.  there'd be no
function to list all keys in the "array", though.  if we do this, we
need a way of escaping the dollar character other than the ${dollar}
hack.  I don't think it is worth it.  if we want to support
associative arrays, let's do it explicitly.

-- 
Kjetil T.