Re: [apps-discuss] apps-review team review for draft-melnikov-sieve-external-lists

["Murray S. Kucherawy" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of Barry Leiba
> Sent: Friday, May 06, 2011 8:03 AM
> To: Murray S. Kucherawy
> Cc: [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]
> Subject: Re: [apps-discuss] apps-review team review for draft-melnikov-sieve-external-lists
> 
> Thanks for the review, Murray.
> 
> First, just making sure you reviewed the right document:
> > Document: draft-melnikov-sieve-external-lists
> It hasn't been that for a long time, and the correct current version
> is draft-ietf-sieve-external-lists-07 :
> http://tools.ietf.org/html/draft-ietf-sieve-external-lists

Sorry, yes; I copied it from the top of that URL which has a link to the original name.  I did look at the newest one.

> Hm.  I'd have thought that to be sufficiently obvious as not to
> require mention -- we *are* going out to an *external* list, after
> all.  But I'm happy to put something in for that, sure.  How about
> inserting the following paragraph after the one about "confidentiality
> and authentication"?:
> -------------
> Having the processing and outcome of a Sieve script depend on the contents
> of external data can allow someone with control of the external data to have
> unusual, and perhaps unauthorized, control of the script -- and, consequently,
> of the disposition of the user's email.  A user using such a list for spam control,
> for example, might find important mail being discarded because of tampering
> with the list.  Someone using redirect to an external list could have her email
> redirected to the wrong eyes because of such tampering.  Security and integrity
> protection of external lists is as important as protection of the Sieve script
> itself.
> -------------

That or something like it would be ideal.

> As I've said on the mailing lists about examples: I'm a fan of having
> many examples, and I'll be happy to add more if someone would provide
> me with specific text.  I'm loath to try to concoct more off the top
> of my head at this point, and will rely on dependable submissions.

Fair enough, and I'm not even sure there's an SQL URI scheme yet upon which to base one.  It just seems an obvious one to add since it's referenced.

> > Nits:
> > 1. ":list" is sometimes quoted in the document and sometimes not.
> > It should be consistent throughout.
> 
> It should; I've changed that in my working version.

Thanks!

-MSK