Re: [Simple] <note> in IMDN

[Eric Burger <eburger at standardstrack.com>]

Do you have text for the Security Considerations section short of  
"here is a nice big attack vector that, by the way, has no protocol  
use"?

On May 14, 2008, at 10:39 AM, Hisham Khartabil wrote:

> well, its in there already and we are passes WGLC and into IESG  
> Discusses. I think its too late to be asking the question of  
> requirements.
>
> Regards,
> Hisham
>
>
> On 14/05/2008, eburger at standardstrack.com  
> <eburger at standardstrack.com> wrote: Nice to have, but useless  
> (language issue) as well as an attack vector. If that information is  
> really important, we should have codes or tokens an automoton can  
> interpret.
> ------Original Message------
> From: Hisham Khartabil
> To: Eric Burger
> Cc: simple at ietf.org
> Subject: Re: [Simple] <note> in IMDN
> Sent: May 14, 2008 7:17 AM
>
> It for the IMDN to carry extra information about the IM. For  
> example, information on why it was not delivered.
>
>    <?xml version="1.0" encoding="UTF-8"?>
>    <imdn xlmns="urn:ietf:params:xml:ns:imdn">
>       <message-id>34jk324j</message-id>
>       <datetime>2006-04-04T12:16:49-05:00</datetime>
>        <recipient-uri>im:bob at example.com <mailto:im 
> %3Abob at example.com> </recipient-uri>
>       <original-recipient-uri>
>           im:bob at example.com <mailto:im%3Abob at example.com>
>        </original-recipient-uri>
>       <disposition>
>          <delivery/>
>       </disposition>
>       <status>
>          <failed/>
>       </status>
>       <note lang="en">The IM could not be delivered due to network  
> failure</note>
>     </imdn>
>
>
>
> On 13/05/2008, Eric Burger <eburger at standardstrack.com <mailto:eburger at standardstrack.com 
> > > wrote: Why do we have a <note> field in an IMDN?
>
> It cannot be for correlation, as the sender MUST have a Message-ID.
>
> It cannot be for letting the user what the message is, because we are
> talking about IMs here, not e-mails.
>
> It cannot be for displaying status to the IM sender, because the IM
> Recipient UA has no idea what the locale of the sender is and will
> undoubtably use the wrong language and character set.
>
> It could be used as a spam attack vector, but that would be silly of
> us to build in to a protocol.
>
> Does ANYONE object to simply taking out the field?
> Does ANYONE want the field to be present?
>
> Please respond to the list ASAP, as this document is WAY overdue.
> _______________________________________________
> Simple mailing list
> Simple at ietf.org <mailto:Simple at ietf.org>
> https://www.ietf.org/mailman/listinfo/simple <https://www.ietf.org/mailman/listinfo/simple 
> >
>
>
>
> Sent from my Verizon Wireless BlackBerry
>

_______________________________________________
Simple mailing list
Simple at ietf.org
https://www.ietf.org/mailman/listinfo/simple