IETF Logo Mail Archive

Re: [Uta] CBOR, XML, JSON (was Re: Updated SMTP STS Draft)

"John R Levine" <johnl@taugh.com> Thu, 05 May 2016 15:11 UTC

Return-Path: <johnl@taugh.com>
X-Original-To: uta@ietfa.amsl.com
Delivered-To: uta@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF0B112DA4E for <uta@ietfa.amsl.com>; Thu, 5 May 2016 08:11:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=iyImKu8p; dkim=pass (1536-bit key) header.d=taugh.com header.b=wSi9Ufj0
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VJS7mniWD5X3 for <uta@ietfa.amsl.com>; Thu, 5 May 2016 08:11:54 -0700 (PDT)
Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E37312D56C for <uta@ietf.org>; Thu, 5 May 2016 08:04:30 -0700 (PDT)
Received: (qmail 94131 invoked from network); 5 May 2016 15:04:29 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=16fb2.572b60fd.k1605; bh=rtSPYuYWn0QnODLgXxs4cNXPsBh1GK0/c9evaRiKTHg=; b=iyImKu8pn9J4gQFD1A6CkWRpIVrg1OsKEtIo6H76lr9IZ2tPF+gsTiypVwmzHhciPH1Dl+4cj5eTNPVkeg+hkWZwnWahWIhml9BAV67hk60dBKEszYCGDxuMg1DO6aqBQ1nBfwtrDh3e9FKa/NPxPOIh7bes6n/aPkp2VkbBPIMzxFffjENMRKj2Y7xUr53PWjsahNhs+ynQglUV5HsO6R22qXwf4G1n9n7IUbfm+x6T4OTOo9ypm5FEcOj1yL5V
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=16fb2.572b60fd.k1605; bh=rtSPYuYWn0QnODLgXxs4cNXPsBh1GK0/c9evaRiKTHg=; b=wSi9Ufj0lLixkPxB9k45d1iXviiFKy67q6szIe9wgtlaUPuR27WVVdifUmc9frClpHDo2B2b7nAZmtVKf+Fn8g2/1tLddRjzQatoBmJET8oOJfoKjOxWbrPW6Ep5oNjbkmwz3WVAXdmiEExvoGOrSS+d+jzn8GFt/mRfeHikVCLxGBe6uD23iVOLjdgI7YebHFtg4ZAi3xqUVeHbErLtmdL6faXCiFgeLYEAHe+CCIRZCLijB6etFslfFYCQuAd+
Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 05 May 2016 15:04:29 -0000
Date: Thu, 05 May 2016 11:04:28 -0400
Message-ID: <alpine.OSX.2.11.1605051057310.39064@ary.lan>
From: John R Levine <johnl@taugh.com>
To: Aaron Zauner <azet@azet.org>
In-Reply-To: <BF2136BB-6406-4796-8575-6C42043F37FD@azet.org>
References: <20160505141746.27164.qmail@ary.lan> <BF2136BB-6406-4796-8575-6C42043F37FD@azet.org>
User-Agent: Alpine 2.11 (OSX 23 2013-08-11)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"; format="flowed"
Archived-At: <http://mailarchive.ietf.org/arch/msg/uta/6YWGnBK3Jh_EcEqBeRKTdPnxbhA>
Cc: uta@ietf.org
Subject: Re: [Uta] CBOR, XML, JSON (was Re: Updated SMTP STS Draft)
X-BeenThere: uta@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: UTA working group mailing list <uta.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/uta>, <mailto:uta-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/uta/>
List-Post: <mailto:uta@ietf.org>
List-Help: <mailto:uta-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/uta>, <mailto:uta-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 May 2016 15:11:56 -0000

>> People have beens mailing around vast numbers of DMARC reports, most
>> of which have an application/gzip body.  If there have been attacks
>> using DEFLATE bugs, nobody's gotten around to reporting them.
>
> I'm not much worried about attacks on DEFLATE and SMTP traffic. But as I 
> understand from the draft, there's also an option to report back via 
> HTTPS. Here DEFLATE may become a security issue.

I don't see why.  HTTP has had gzip encoding since http/1.0 twenty years 
ago, but I only defined application/gzip for mail in 2012.  Your browser 
probably decodes deflated pages dozens of times a day.

Also, remember the DMARC experience, that in practice nobody is interested 
in http reports if they can send mail.  You might ask around and see if 
you can find anyone who would send http reports if they had the option to 
do so. I implemented the http option from the DMARC draft (sort of, given 
that the draft language was a mess) and the number of attempts I saw was 
zero.

Regards,
John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

v2.23.0 | Report a Bug | By Email