Re: [apps-discuss] apps-review team review for draft-ietf-eai-rfc5335bis-07

[Claudio Allocchio <[e-mail]>]

> The Security Considerations section should discuss the problem of having 
> UTF-8 aware transport (i.e. MTAs) coupled with UTF-8 unaware user agents 
> (e.g. readers) as well as filters and the like.  The author talks about 
> needing bigger buffers, but I think that's far less interesting than the 
> possible semantic implications.  I consider this a major issue, and so I 
> would expect this discussion to be non-trivial in size, and include some 
> admonishment about not upgrading a delivery MTA to support UTF-8 message 
> headers until the entire infrastructure it serves has already been 
> verified to handle it.  This might be discussed in one of the other EAI 
> documents already; if it is, this one should contain a reference to 
> that.

a late (never too late!) +1

>
> On a related note, Security Considerations should also talk about abuse 
> mechanisms.  If, for example, there are lots of ways of using UTF-8 to 
> represent something equivalent or similar to a particular displayed 
> character or group of characters (all the variants of "e" in French, 
> using accents, for example), then filtering systems can be bypassed by 
> using one of the variants to avoid detection while still reaching the 
> end user with largely the same original effect.  This too might be 
> discussed elsewhere in general, in which case a reference to that 
> discussion can be left here.

and another +1 here!

------------------------------------------------------------------------------
Claudio Allocchio             G   A   R   R          [e-mail]
                         Senior Technical Officer
tel: [phone]      Italian Academic and       G=Claudio; S=Allocchio;
fax: [phone]        Research Network         P=garr; A=garr; C=it;

            PGP Key: http://www.cert.garr.it/PGP/keys.php3#ca