Re: [Extra] Status of draft-ietf-extra-sieve-fcc

[Ken Murchison <[e-mail]>]

On 1/13/19 10:22 AM, Ned Freed wrote:
>> On 1/10/19 11:40 AM, Alexey Melnikov wrote:
>> > Hi,
>> >
>> > Based on IESG review, I think the document should have some text about
>> > the following security/privacy considerations:
>> >
>> > 1) Possible information disclosure from generated messages which are
>> > filed to shared folders (as opposed to private folders). I.e. non
>> > intended parties might discover that a Sieve script owner is on
>> > holidays, owner's location, etc.
>> >
>> > 2) FCC can put owner over quota, causing denial of service.
>
>
>> How would this cause DoS?  If the FCC would put the user over quota,
>> presumably this would be treated as a run-time error, and the incoming
>> message would be be stored by an implicit keep.  Or are you just saying
>> that the FCC itself is what would be denied?
>
> It's not the effect of a single fcc, but rather that fcc can be used 
> to create
> an additional stream of messages, the cumulative effect of which would 
> be to
> put the user at or over quota.


Ahh, yes!  I hadn't thought about that.


> As for the handling of situations where the fcc can't be delivered, we're
> talking about notifications here, and we've learned the hard way that
> generating more traffic as as result of a notification delivery 
> failure is a
> REALLY bad idea. As such, I would expect an fcc delivery failure to be
> silently ignored. That's certainly how my implementation works.


Should we add text to this effect?


-- 
Ken Murchison
Cyrus Development Team
FastMail US LLC