Re: #1416 Injection-Date: current wording proposal (corrected)

["Charles Lindsey" <chl@xxxxxxxxxxxxxxxx>]

In <87hcq5tpv6.fsf@xxxxxxxxxxxxxxxxxxxxx> Russ Allbery <rra@xxxxxxxxxxxx> writes:

>Charles Lindsey <chl@xxxxxxxxxxxxxxxx> writes:
>> Russ Allbery <rra@xxxxxxxxxxxx> writes:

>>>>> +            not syntactically valid as defined by <xref target="USEFOR"
>>>>> +            />.  It SHOULD reject any proto-article which contains a
>>>>> +            header field deprecated for Netnews.  It MAY reject any
>>>>                                                  ^
>>>>                                       (see e.g. <xref RFC2298>)

>>> RFC 2298 is obsolete, so I don't really want to generate even an
>>> informative reference to it, and the superseding RFC (RFC 3798) makes no
>>> mention of Netnews, so I'm not sure this is a great example or
>>> particularly helpful for the reader.


>> The problem is that use of that header in Netnews can give rise to the
>> Mother of all Mailbombs. This is also a Security Consideration, and I
>> think it is also mentioned as such (or should be).

>I think it's overkill to be that worried about an obscure header that no
>one has ever implemented for Netnews.

I think the problem is combined mail/news user agents, or which there are
a lot around. The naive user is likely to configure his agent to always
include this header ("because it seems like a Good Idea"), and for the
badly written user agent (or which, again, there are many) not to notice
that the option is not supposed to be activated for News.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: chl@xxxxxxxxxxxxxxxx      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5