ietf
[Top] [All Lists]

Re: Attachment Stripped in Transaction

2001-08-01 10:50:02
--On Wednesday, August 01, 2001 8:38 AM -0600 Vernon Schryver
<vjs(_at_)calcite(_dot_)rhyolite(_dot_)com> wrote:

From: John C Klensin <klensin(_at_)jck(_dot_)com>

...
As has been said many times before, text attachments are both
useful and reasonably safe. ...

I could live with prohibiting almost anything else, but
banning multiple-body-part MIME messages where all of the
terminal body parts are plain text strikes me as pretty close
to shooting ourselves in the foot.

Ok, would you support rejecting any submissions containing
non-text attachments?

Personally, I probably would, although I can see a case for a
few other forms.  On the other hand, the one that would probably
end up on the list right after "text" is likely HTML or XML and
they are known to be dangerous.

If not that, then how about length restrictions on all
submissions or non-text submissions?

I could easily live with length restrictions on non-text.  But I
suspect that, if we go to length restrictions, we had best be
clear about what problem(s) we are trying to solve.   Due to a
server failure, I've recently (and temporarily, I hope) gone
from IMAP back to POP3, and the changeover has made me very
sensitive to lengths (again).  But, again, it is important to be
clear about what problems are being solved.

Or do you think that no censoring at all should be done, and
that those who want it should subscribe to via a secondary
list?  If so, you are changing a powerful precedent.  As
someone else pointed out, individual people have been banned
from this list.  If it is now decided that even viruses cannot
be banned, then how could you ever again ban people?

Well, first of all, wrt this issue, I'm just an IETF participant
like most others who read these lists and are impacted by them.
So my opinion isn't worth anything special.   But I think that
organizations ought to have the right to protect themselves and
the work they are doing against nonsense and deliberate and
inadvertent attacks.  After that, we can quibble about which
things are "noise removal" and "protection against attacks" and
which things are "censorship".    I tend to oppose the latter,
but my definition of the term is probably much narrower than
those for whom the idea of keeping anything off a list or out of
general circulation is a moral outrage.

It has been proposed that submissions to the list be edited
into compliance by deleting some but not all attachments.
That would be wrong because it would violate the spirit of the
author's copyright. The IETF's "NOTE WELL" might make such
editing legal, or perhaps not since it allows derivative works
and if you don't publish the original, how can you have a
derivative?  Regardless, no matter how much people say
obnoxious, stupid, offensive, or irrelevant things, misspell
words, or otherwise beg for copy editing, their submissions
should not be corrected, fixed, improved or partially
censored.  Every author should be respected enough to be
published or rejected, completely unedited.

Personally, I tend to agree -- on logical, moral, and technical
grounds and without needing to appeal to amateur lawyering or
copyright hair-splitting.  Any given submission should either go
through or be diverted, not "improved" by any process not under
the author's control.

     john