Subject: filter large messages

From: William Allen Simpson <[email-masked]>
Date: Wed, 25 Jul 2001 08:56:54 -0400

At least we could filter messages greater than 32K.  That would get rid 
of the 200 KB and 1.1 MB junk we've been seeing.  Nobody really has 
any reason to bombard us with more than 32K....  This is a discussion 
list, after all!
-- 
William Allen Simpson
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32

---

From: Jon Allen Boone <[email-masked]>
Date: Wed, 25 Jul 2001 10:11:18 -0400

William Allen Simpson <[email-masked]> writes:

>    At least we could filter messages greater than 32K.  That would get
>  rid of the 200 KB and 1.1 MB junk we've been seeing.  Nobody really
>  has  any reason to bombard us with more than 32K....  This is a
>  discussion list, after all!

    This comment - along with so many others in this vein - lacks an
  appreciation of the IETF mentality.  "We do not believe in kings,
  presidents or voting.  We believe in rough consensus and running
  code." 

    I'd say that there is rough consensus that the SPAM/virus damage
  should stop.  But *where* is the running code?  [ Please submit at
  least two independent implementations... oops - slipped into bureaucrat
  mode there.... :-) ]

    Since I don't run an MS MUA, I'm not sure if James Salsman's
  approach counts as running code or not... :-)

-jon
-- 
------------------
Jon Allen Boone
[email-masked]

---

From: "TRAICOVN (NW)" <[email-masked]>
Date: Wed, 25 Jul 2001 12:58:45 -0400 (EDT)

is it possible to just filter attachments?

____________________________________________________________________________
 * TRAICOVN  ----------------------------------- http://www.traicovn.com *
----------------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 17:05:30 -0400

> is it possible to just filter attachments?

yes, for some reasonable definition of "attachment", it's possible.  

but because MIME doesn't recognize a fundamental distinction between
attachments and other components, and because MIME doesn't separate
components from structure (it uses special body parts that contain
other body parts) a reasonable definition of "attachment" is a bit 
tricky to get right.

probably what you want is something like:

- filter out every body part which isn't text/plain, message/rfc822,
  image/*, a signature (there are several types), or a multipart/* 
  (filters apply recursively to components of message/rfc822 and multipart/*)

- if the resulting filter removes every component of a multipart or
  a message/rfc822, also filter the enclosing multipart or message/rfc822.

- if this results in the entire message getting filtered, bounce the message

- otherwise, if any of the filtered contents appear to be critical (for 
  instance they are marked with content-disposition: inline), bounce the message.  

- otherwise, forward the message with the filtered contents removed

it's not exactly a SMOP.

Keith

---

From: John Stracke <[email-masked]>
Date: Wed, 25 Jul 2001 17:11:16 -0400

>is it possible to just filter attachments?
That would block people whose mailers automatically attach their vCard.

-- 
/=================================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own.   |
|Chief Scientist |================================================|
|eCal Corp.      |"How many lifeboats are there?" "None." "Did you|
[email-masked]|*count* them?" "Twice."                         |
\=================================================================/

---

From: stanislav shalunov <[email-masked]>
Date: 25 Jul 2001 23:05:10 -0400

Keith Moore <[email-masked]> writes:

> - otherwise, if any of the filtered contents appear to be critical
>   (for instance they are marked with content-disposition: inline),
>   bounce the message.
> 

You probably don't actually advocate such an approach, but simply
point out how ridiculously and unmanageably complex it would be.

Such complex and counter-intutitive transformations will inevitably
often fail.  The ``if any of the filtered contents *appear* to be
critical'' (emphasis mine) part is especially flaky.  Delivery of
message with semantically important parts missing may well be worse
than no delivery at all.  Example: ``Here's the latest version of our
FUBAR proposal'', with a uSoft Word attachment.  Delivering just the
``Here's...'' part seems pointless.  And the poster will, of course,
immediately followup with ``Sorry, forgot to include the attachment.
Here goes again.  I hope I got it right now.''

Take it or bounce it with an explanation would seem like a much better
approach.  The sender is in a position to make substantive changes to
the message, not the list software.

Heuristics of refusing to take large messages is fine (they probably
contain some garbage anyway, such as proprietary format attachments or
``viruses'' for retarded MUAs--is there a difference between these
categories?).

MAIMed messages per se aren't evil (1KB PNG drawing, message/rfc822,
multipart/signed, etc. are all examples of harmless use of MIME).
Abuse of MIME, OTOH, is often associated with outrageously inflated
messages.  At the same time, small messages can naturally be abuse of
MIME and poor style of using it as well (especially evil being
HTML+plain text in the same message).

Is the same IETF that would scream when faced with an idea to fix
IP packets so that they carry what the sender has *actually meant*
advocating fixing RFC2822 messages in just such fashion with "demime"
tools and such?

-- 
Stanislav Shalunov		http://www.internet2.edu/~shalunov/

"I didn't attend the funeral, but I sent a nice letter saying that I
approved of it."				-- Mark Twain

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jul 2001 23:53:38 -0400

> That would block people whose mailers automatically attach their vCard.

might be a good thing :)

but I presume such filters would just remove the vCard, not the
message text.

---

From: Ari Ollikainen <[email-masked]>
Date: Wed, 25 Jul 2001 21:33:17 -0700

>That would block people whose mailers automatically attach their vCard.

	That would be an EXCELLENT side effect...

---

From: Melinda Shore <[email-masked]>
Date: Thu, 26 Jul 2001 07:17:21 -0400

>That would block people whose mailers automatically attach their vCard.

Remind us why that would be a bad thing.

Melinda
(whose mailers don't automatically attach a vCard unless I tell
them to)

---

From: John Stracke <[email-masked]>
Date: Thu, 26 Jul 2001 11:34:46 -0400

>> That would block people whose mailers automatically attach their vCard.

Yeah, at least half a dozen people have said this.  I disagree, though; 
vCards improve communication by making it easier to maintain your 
address book, and they're usually too small to complain about.

I don't disagree *too* strongly, though.  :-)

> but I presume such filters would just remove the vCard, not the

Um.  Personally, I would object to such a thing; I don't want a mailing 
list editing my messages.  (I avoid lists like eGroups, for example, 
which put ads at the bottom.)

Anyway, if the goal is to block vires, and save us from getting flooded 
with messages from the WinDOS boxen infected with them, then you want to 
bounce the whole message.

-- 
/===============================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own. |
|Chief Scientist |==============================================|
|eCal Corp.      |Reality is what refuses to go away when I stop|
[email-masked]|believing in it.                              |
\===============================================================/

---

From: Garrett Wollman <[email-masked]>
Date: Thu, 26 Jul 2001 13:36:16 -0400 (EDT)

> yes, for some reasonable definition of "attachment", it's possible.  

I don't think the correct answer is to filter ``attachments''.  A more
plausible rule -- and one which I use in my own mailing-lists -- is to
filter any content which has a Content-Transfer-Encoding of base64.
(This would obviously be a problem for certain languages and character
sets; for an international English-language mailing-list, however,
there should be no issues.)  I personally also filter Content-Type:
text/html as well, for unrelated reasons.

-GAWollman

---

From: Keith Moore <[email-masked]>
Date: Thu, 26 Jul 2001 13:49:36 -0400

> A more plausible rule -- and one which I use in my own mailing-lists 
> -- is to filter any content which has a Content-Transfer-Encoding of base64.

it's easier to implement but completely unreasonable.  it's quite
permissable, and not unusual, for English text in plain ASCII to be
encoded in base64

(this usually happens because the message is being sent from a MUA
that normally uses a different charset, that is best encoded in base64.
but it happens even if the message is entirely ASCII)

Keith

---

From: Garrett Wollman <[email-masked]>
Date: Thu, 26 Jul 2001 13:53:00 -0400 (EDT)

> but it happens even if the message is entirely ASCII)

Then that MUA is broken.  I have no sympathy.  Just because the
standard happens to permit stupid behavior doesn't mean it should be
catered to.  (I have never seen a legitimate message bounce on any of
my mailing-lists as a result of this restriction, nor in nine years
have I seen a legitimate message on the IETF list which was
base64-encoded.)

-GAWollman

---

From: Keith Moore <[email-masked]>
Date: Thu, 26 Jul 2001 13:57:36 -0400

> Then that MUA is broken.

not according to the standard it's not.

shouldn't we expect people to format their messages according to the
standards, which were reached by community consensus, rather than 
according to your personal whim (or ignorance)?

Keith

---

From: John Stracke <[email-masked]>
Date: Thu, 26 Jul 2001 14:33:50 -0400

> filter any content which has a Content-Transfer-Encoding of base64.

I have seen people with mailers that encode plaintext (or maybe 
plaintext with a few Windows characters) in base64.  I think it was Outlook.

---

From: Keith Moore <[email-masked]>
Date: Thu, 26 Jul 2001 19:24:31 -0400

> point out how ridiculously and unmanageably complex it would be.

Actually, I was advocating such an approach, and I had been designing 
a mail filter for my own lists.    That doesn't mean that I considered
it either fully specified or ideal in its current form.

For better or worse, MIME wasn't designed to facilitate the easy
filtering of messages that aren't appropriate on mailing lists.

> The ``if any of the filtered contents *appear* to be
> critical'' (emphasis mine) part is especially flaky.  

It was intended to look flaky - Obviously it's lacking a good definition 
for what is critical.  That was part of the point - it's hard to define
such things.

it might be sufficient to just bounce all mail with objectionable
content.  I even like that idea better, if we can make it stick, 
because it encourages people to get their broken mailers fixed. 

> IP packets so that they carry what the sender has *actually meant*

since when does the network (or any intermediary) know what IP packets 
"actually mean"?
 
Keith