RE: [Syslog] RE: byte-counting vs special character

Balazs Scheidler <bazsi@balabit.hu> Thu, 17 August 2006 20:25 UTC

Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1GDoR7-0001Dv-6B; Thu, 17 Aug 2006 16:25:53 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1GDoR5-0001BY-Qz for syslog@ietf.org; Thu, 17 Aug 2006 16:25:51 -0400
Received: from balabit.hu ([82.141.167.23]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1GDoEJ-0001SP-Ft for syslog@ietf.org; Thu, 17 Aug 2006 16:12:40 -0400
Subject: RE: [Syslog] RE: byte-counting vs special character
From: Balazs Scheidler <bazsi@balabit.hu>
To: Chris Lonvick <clonvick@cisco.com>
In-Reply-To: <Pine.GSO.4.63.0608170721250.8687@sjc-cde-003.cisco.com>
References: <0bfb01c6c199$01c71860$0400a8c0@china.huawei.com> <Pine.GSO.4.63.0608170721250.8687@sjc-cde-003.cisco.com>
Content-Type: text/plain
Date: Thu, 17 Aug 2006 22:12:32 +0200
Message-Id: <1155845552.15643.28.camel@bzorp.balabit>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22
Cc: syslog@ietf.org
X-BeenThere: syslog@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Security Issues in Network Event Logging <syslog.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/syslog>
List-Post: <mailto:syslog@lists.ietf.org>
List-Help: <mailto:syslog-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@lists.ietf.org?subject=subscribe>
Errors-To: syslog-bounces@lists.ietf.org

On Thu, 2006-08-17 at 07:22 -0700, Chris Lonvick wrote:
> Hi,
> 
> I agree; we don't want a vote here.  We want strong technical reasons for 
> making a decision.
> 

As I see:

We have a technically superior (we all seem to agree on this one)
solution that breaks compatibility. Compatibility is important, this is
documented in our charter.

If we are to break compatibility we definitely need to have important
incentives to do so. As I see the byte counter in itself is not
important enough, I would simply forbid LF in messages as a compromise
if that is acceptable to others.

Thus we should not simply stop at adding the byte counter. There are
other features currently missing from the protocol which can only be
implemented with an incompatible change. An important example is
application layer acknowledgements. (not the complex one in
syslog/COOKED but a simpler scheme) What I'm afraid about this path is
that we need to deliver something soon.

-- 
Bazsi


_______________________________________________
Syslog mailing list
Syslog@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/syslog