Re: [marf] Including Mail fields in IODEF

Alessandro Vesely <vesely@tana.it> Sun, 24 February 2013 13:56 UTC

Return-Path: <vesely@tana.it>
X-Original-To: marf@ietfa.amsl.com
Delivered-To: marf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C8BD321F8FF7; Sun, 24 Feb 2013 05:56:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.529
X-Spam-Level:
X-Spam-Status: No, score=-4.529 tagged_above=-999 required=5 tests=[AWL=0.190, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CQJJ8rU5rhXf; Sun, 24 Feb 2013 05:56:46 -0800 (PST)
Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id A588221F8FEC; Sun, 24 Feb 2013 05:56:45 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=beta; t=1361714203; bh=VZw3M738BwZQh/SHY4AHA7G6ptV2LNHmaohutLVd80o=; l=768; h=Date:From:To:CC:References:In-Reply-To; b=eT59g/M2TeI0gZokgDbcK7TVuWpO9utCG9vRGYLL66uYs0GY0YKDGisYVFyC5HwRJ vK14cvAqWTpwROK7oT31Zr1Eusfiik9ZouFsfXsTru2/MEo2eKRRXWElRqZY4if02p ZN4qCscg6eb8qqRAnXdIhqzp3RxHtfQquWYQRPJ0=
Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by wmail.tana.it with ESMTPSA; Sun, 24 Feb 2013 14:56:43 +0100 id 00000000005DC039.00000000512A1C1B.00002764
Message-ID: <512A1C1B.5060802@tana.it>
Date: Sun, 24 Feb 2013 14:56:43 +0100
From: Alessandro Vesely <vesely@tana.it>
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/20130215 Thunderbird/17.0.3
MIME-Version: 1.0
To: "Moriarty, Kathleen" <kathleen.moriarty@emc.com>
References: <F5063677821E3B4F81ACFB7905573F24D6253D43@MX15A.corp.emc.com>, <B14C10CA81885B4AAE1954F18457F2AB057004DB6D@MX36A.corp.emc.com> <F5063677821E3B4F81ACFB7905573F24D6253D5D@MX15A.corp.emc.com>
In-Reply-To: <F5063677821E3B4F81ACFB7905573F24D6253D5D@MX15A.corp.emc.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cc: Managed Incident Lightweight Exchange IODEF extensions and RID exchanges <mile@ietf.org>, "marf@ietf.org" <marf@ietf.org>
Subject: Re: [marf] Including Mail fields in IODEF
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 24 Feb 2013 13:56:46 -0000

Hi Kathleen,

On Thu 21/Feb/2013 11:19:11 +0100 Moriarty, Kathleen wrote:
> 
> Cross posting with MAIL and MARF - 

Hey, I never realized that meaning of pronouncing "mile", otherwise I
wouldn't have unsubscribed :-)

> There was a draft published last year (link included below) that
> includes MARF in an IODEF extension.

Yeah, that slavishly translated and ARF mail into XML.  Its only
practical trait is to represent header fields with a lowercase name,
for example:

 <arf:Field name="x-mailer">QUALCOMM Windows Eudora</arf:Field>

That kind of thing can be useful to get a value quickly; that is,
while parsing the XML.  If the alternative is to extract the whole
message (or header) and then parse that in turn, it might be worth to
have it.