Re: Security

New Message Reply About this list Date view Thread view Subject view Author view

From: Clive D.W. Feather (clive@demon.net)
Date: Mon Apr 09 2001 - 02:50:08 CDT


Charles Lindsey said:
>> The mailbox in the From-content SHOULD either be a valid address,
>> belonging to the poster(s) of the article (or person or agent on
>> whose behalf the post is being sent - see the Sender header, 6.2),
>> or it should be a syntactically correct string which ends in
>> ".invalid" [RFC 2606].
>
> A problem with this is that it has a "SHOULD" and a "should", which leaves
> me unsure of its meaning.

Oops. In fact, better wording would be:

    The mailbox in the From-content SHOULD be either a valid address,
    belonging to the poster(s) of the article (or person or agent on
    whose behalf the post is being sent - see the Sender header, 6.2),
    or else a syntactically correct string which ends in
    ".invalid" [RFC 2606].

> However, my main objection is that it is a considerable retreat from our
> previous stance which was, AIUI:
>
> You SHOULD NOT munge.

I thought we'd already retreated to:

    You SHOULD NOT munge; saying "I'm not telling you" is not munging.

> Now your wording is weaker than that, insofar as it seems to make having a
> valid address OR having a munged.invalid address are equally acceptable.
> Is that what we want to say?

I believe so, yes.

However, I don't consider ".invalid" to be munging; that implies that I'm
hiding my true address in the munged string. We should be encouraging, or
at least allowing, things like:

    From: clive@see.reply.to.invalid
    Reply-to: clive@demon.net

In this case I think we should be stating what the valid options are and
not making a moral decision between them. If people disagree violently with
me, then I suggest adding to my text:

    The first form Ought to be used; the second form is available where
    the poster - for some reason - does not wish to use it.

> NOTE: Since such addresses ending in ".invalid" are
> undeliverable, user agents Ought to warn any user attempting to
> reply to them and Ought Not, in any case, to attempt to deliver
> to them (since that would be pointless anyway). Whether or not
> a valid address can subsequently be extracted from such an
> address falls outside the scope of this standard (though it
> would be pointless to use a disguise so easily penetrable).

I would be happy for that text to stay.

-- 
Clive D.W. Feather  | Work:  <clive@demon.net>   | Tel:  +44 20 8371 1138
Internet Expert     | Home:  <clive@davros.org>  | Fax:  +44 20 8371 1037
Demon Internet      | WWW: http://www.davros.org | DFax: +44 20 8371 4037
Thus plc            |                            | Mobile: +44 7973 377646 


New Message Reply About this list Date view Thread view Subject view Author view


This archive was generated by hypermail 2b29.