Subject: Whither OPES? [was: Antigen found W32/Hybris.gen@MM (McAfee4,Sophos) virus]

From: Mark Nottingham <[email-masked]>
Date: Tue, 10 Jul 2001 20:01:40 -0700

[resend; original seems to have been lost]

Interesting... seems to be a message generated by an intermediary
that used a heuristic to vector the message and effect a
transformation... Unfortunately, that transformation was performed
without proper knowledge of the semantics of the application
protocol, incurring unintended and undesireable results.

Maybe if we standardized the heuristics and the means of vectoring,
the transformation engines would magically behave in a more
responsible manner... or maybe it would just encourage the deployment
of transformation engines.

On Tue, Jul 10, 2001 at 12:56:30PM -0700, [email-masked] wrote:

> Antigen for Exchange found blanca de nieve.scr infected with
> W32/Hybris.gen@MM (McAfee4,Sophos) virus. The file is currently
> Removed.  The message, "Enanito si, pero con que pedazo!", was sent
> from Hahaha and was discovered in SMTP Messages\Inbound located at
> zumanetworks/First Administrative Group/MSMAIL.

-- 
Mark Nottingham

---

From: [email-masked]
Date: Tue, 10 Jul 2001 23:47:57 -0400

> of transformation engines.

Umm.. Mark?  The heuristics *are* standardized.

It's called "Thou shalt send this crap to the SMTP MAIL FROM: address".

Of course, if people manage to botch something THAT simple and
well understood, how will we ever deploy a working OPES?

/Valdis

---

From: Keith Moore <[email-masked]>
Date: Tue, 10 Jul 2001 23:58:44 -0400

> Maybe if we standardized the heuristics and the means of vectoring,

in fact, they are standardized, and have been standardized for ~20 years.

that doesn't stop implementors from doing stupid things.

Keith

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 10 Jul 2001 21:11:24 -0700

Hi Valdis. Hi Kieth.

I was speaking of the heuristic to invoke vectoring, not the
application semantics. Please re-read. Apply sarcasm where
appropriate.

The point is, deploying a working OPES means that people will have
more opportunity to stick their noses where they don't belong, and to
ignore application semantics on the grounds of "well, the vectoring
technology takes care of that." Just think - with OPES, anyone with
half a clue (or less) and a OPES server can interpose their newest,
niftiest 'value-added service' into your application data stream.

What fun.

-- 
Mark Nottingham
http://www.mnot.net/

---

From: "Michael W. Condry" <[email-masked]>
Date: Wed, 11 Jul 2001 08:45:31 -0700

And deploying ESI prevents this?

> > well understood, how will we ever deploy a working OPES?

Michael W. Condry
Director,  Network Edge Technology

---

From: Keith Moore <[email-masked]>
Date: Wed, 11 Jul 2001 14:56:22 -0400

> application semantics.

"vectoring" is performed by MX records that cause incoming
mail to be directed to whatever SMTP servers the recipient's
domain wishes to process incoming mail.   

This was defined in RFC 974, and updated in RFC 2821.