ietf-822
[Top] [All Lists]

Re: Last Call: 'The APPLICATION/MBOX Media-Type' to Proposed Standard

2004-08-16 04:13:28

In <01LDM23SDIVE00005R(_at_)mauve(_dot_)mrochek(_dot_)com> 
ned+ietf-822(_at_)mrochek(_dot_)com writes:

q>FWIW, I do not regard schemes using Content-length: (there are several
incompatible variants) in lieu of colonless from lines as being legitimate mbox
files.

Why not? They exist (they even work in the contexts they were intended
for, which does not include the Wire). You can't bury your head in the
sand and assume otherwise.

Clearly, it needs to be written down somewhere that the Content-Length
MUST NOT occur within individual RFC 2822 messages (and must be
ignored/removed if it does). It is only meaningful where it was created by
the person/entity that created the mbox, and only for as long as the
message remained in that mbox. (A bit like the Xref header in Netnews,
which in only meaningful on the server for which it was written.)

(1) An optional parameter will likely be neither generated or read. I certainly
   wouldn't bother with it in the vaarious tools I've developed that deal
   with mbox files.

(2) A mandatory parameter stands a good chance of scaring people away from
   ever using the media type. Alternately, they'll use the media type
   but ignore the parameter requirement.

Yes, it certainly must not be mandatory.

(3) To the extent that people would generate such a parameter, I view the
   chances that it would be done correctly as fairly low.

(4) There are performance and security issues associated with the use of
   regular expressions. Writing a regexp that consumes vast amounts of
   CPU isn't hard, which means anyone developing, say, an automatic
   tool that accepts and converts labelled mbox files from random sources
   would be vulnerable. Very large mbox files are pretty common as well -
   I've seen a bunch weighing in at in excess of 2GB, so the performance
   impact of regexp scanning also cannot be ignored.

This is one of the things to be looked into when you come to design that
parameter. Yes it is possible to write obfuscated regular expressions, but
that does not mean that people will regularly do it. And remember that it
is only those lines beginning with "^From " that will ever consume any CPU
load.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: chl(_at_)clerew(_dot_)man(_dot_)ac(_dot_)uk      Snail: 5 Clerewood Ave, 
CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5


<Prev in Thread] Current Thread [Next in Thread>