IETF Logo Mail Archive

Re: [marf] Including Mail fields in IODEF

Alessandro Vesely <vesely@tana.it> Sun, 24 February 2013 13:56 UTC

Return-Path: <vesely@tana.it>
X-Original-To: marf@ietfa.amsl.com
Delivered-To: marf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C8BD321F8FF7; Sun, 24 Feb 2013 05:56:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.529
X-Spam-Level:
X-Spam-Status: No, score=-4.529 tagged_above=-999 required=5 tests=[AWL=0.190, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CQJJ8rU5rhXf; Sun, 24 Feb 2013 05:56:46 -0800 (PST)
Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id A588221F8FEC; Sun, 24 Feb 2013 05:56:45 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=beta; t=1361714203; bh=VZw3M738BwZQh/SHY4AHA7G6ptV2LNHmaohutLVd80o=; l=768; h=Date:From:To:CC:References:In-Reply-To; b=eT59g/M2TeI0gZokgDbcK7TVuWpO9utCG9vRGYLL66uYs0GY0YKDGisYVFyC5HwRJ vK14cvAqWTpwROK7oT31Zr1Eusfiik9ZouFsfXsTru2/MEo2eKRRXWElRqZY4if02p ZN4qCscg6eb8qqRAnXdIhqzp3RxHtfQquWYQRPJ0=
Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by wmail.tana.it with ESMTPSA; Sun, 24 Feb 2013 14:56:43 +0100 id 00000000005DC039.00000000512A1C1B.00002764
Message-ID: <512A1C1B.5060802@tana.it>
Date: Sun, 24 Feb 2013 14:56:43 +0100
From: Alessandro Vesely <vesely@tana.it>
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/20130215 Thunderbird/17.0.3
MIME-Version: 1.0
To: "Moriarty, Kathleen" <kathleen.moriarty@emc.com>
References: <F5063677821E3B4F81ACFB7905573F24D6253D43@MX15A.corp.emc.com>, <B14C10CA81885B4AAE1954F18457F2AB057004DB6D@MX36A.corp.emc.com> <F5063677821E3B4F81ACFB7905573F24D6253D5D@MX15A.corp.emc.com>
In-Reply-To: <F5063677821E3B4F81ACFB7905573F24D6253D5D@MX15A.corp.emc.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Cc: Managed Incident Lightweight Exchange IODEF extensions and RID exchanges <mile@ietf.org>, "marf@ietf.org" <marf@ietf.org>
Subject: Re: [marf] Including Mail fields in IODEF
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 24 Feb 2013 13:56:46 -0000

Hi Kathleen,

On Thu 21/Feb/2013 11:19:11 +0100 Moriarty, Kathleen wrote:
> 
> Cross posting with MAIL and MARF - 

Hey, I never realized that meaning of pronouncing "mile", otherwise I
wouldn't have unsubscribed :-)

> There was a draft published last year (link included below) that
> includes MARF in an IODEF extension.

Yeah, that slavishly translated and ARF mail into XML.  Its only
practical trait is to represent header fields with a lowercase name,
for example:

 <arf:Field name="x-mailer">QUALCOMM Windows Eudora</arf:Field>

That kind of thing can be useful to get a value quickly; that is,
while parsing the XML.  If the alternative is to extract the whole
message (or header) and then parse that in turn, it might be worth to
have it.

v2.23.0 | Report a Bug | By Email