Re: [Simple] <note> in IMDN

["Hisham Khartabil" <hisham.khartabil at gmail.com>]

Can you explain how it is an attack vector?

On 14/05/2008, Eric Burger <eburger at standardstrack.com> wrote:

Do you have text for the Security Considerations section short of "here is a nice big attack vector that, by the way, has no protocol use"?

On May 14, 2008, at 10:39 AM, Hisham Khartabil wrote:

well, its in there already and we are passes WGLC and into IESG Discusses. I think its too late to be asking the question of requirements.

Regards,
Hisham


On 14/05/2008, eburger at standardstrack.com <eburger at standardstrack.com> wrote: Nice to have, but useless (language issue) as well as an attack vector. If that information is really important, we should have codes or tokens an automoton can interpret.
------Original Message------
From: Hisham Khartabil
To: Eric Burger
Cc: simple at ietf.org
Subject: Re: [Simple] <note> in IMDN
Sent: May 14, 2008 7:17 AM

It for the IMDN to carry extra information about the IM. For example, information on why it was not delivered.

  <?xml version="1.0" encoding="UTF-8"?>
  <imdn xlmns="urn:ietf:params:xml:ns:imdn">
     <message-id>34jk324j</message-id>
     <datetime>2006-04-04T12:16:49-05:00</datetime>
      <recipient-uri>im:bob at example.com <mailto:im%3Abob at example.com> </recipient-uri>
     <original-recipient-uri>
         im:bob at example.com <mailto:im%3Abob at example.com>
      </original-recipient-uri>
     <disposition>
        <delivery/>
     </disposition>
     <status>
        <failed/>
     </status>
     <note lang="en">The IM could not be delivered due to network failure</note>
   </imdn>



On 13/05/2008, Eric Burger <eburger at standardstrack.com <mailto:eburger at standardstrack.com> > wrote: Why do we have a <note> field in an IMDN?

It cannot be for correlation, as the sender MUST have a Message-ID.

It cannot be for letting the user what the message is, because we are
talking about IMs here, not e-mails.

It cannot be for displaying status to the IM sender, because the IM
Recipient UA has no idea what the locale of the sender is and will
undoubtably use the wrong language and character set.

It could be used as a spam attack vector, but that would be silly of
us to build in to a protocol.

Does ANYONE object to simply taking out the field?
Does ANYONE want the field to be present?

Please respond to the list ASAP, as this document is WAY overdue.
_______________________________________________
Simple mailing list
Simple at ietf.org <mailto:Simple at ietf.org>
https://www.ietf.org/mailman/listinfo/simple <https://www.ietf.org/mailman/listinfo/simple>



Sent from my Verizon Wireless BlackBerry

_______________________________________________
Simple mailing list
Simple at ietf.org
https://www.ietf.org/mailman/listinfo/simple