Subject: Ftp-WG: SIZE

From: "Shesterikov Maxim (sm)" <[email-masked]>
Date: Mon, 3 Jan 2000 06:52:52 -0500

Having SIZE as decribed in the draft is vulnerable to
denial-of-service-attack (ASCII mode). 

LIST has the same vulnerability if it filters pathnames according to some
criteria. I suppose that was the reason for the restriction of LIST's
behavior. 

The text of the draft says that the primary purpose of SIZE is to determine
whether the file on the other side has changed. IMHO MDTM will suffice for
that. With respect of this the only purpose of SIZE I see is all these nice
progress bars. 

regards
Maxim

---

From: Richard Koenning <[email-masked]>
Date: Mon, 3 Jan 2000 07:23:06 -0500

>denial-of-service-attack (ASCII mode). 

See p. 53 of the draft (11. Security considerations) for this.

>that. With respect of this the only purpose of SIZE I see is all these nice

As described on p. 11 the SIZE command is normally used in conjunction with
the REST command for determining the restart point.

regards 

Richard
-- 
Dr. Richard W. Könning
Fujitsu Siemens Computers GmbH, EP LP DC 21
Phone/Fax: +49-89-636-47852 / 41143
email: [email-masked]

---

From: Stephen Tihor <[email-masked]>
Date: Mon, 3 Jan 2000 09:28:30 -0500

It can also be used to preallocate disk space for the entire file to e transfered in one big shot which is an advantage with some file systems.

---

From: Robert Elz <[email-masked]>
Date: Tue, 4 Jan 2000 23:54:39 -0500

Date:        Mon, 3 Jan 2000 06:52:52 -0500
    From:        "Shesterikov Maxim (sm)" <[email-masked]>
    Message-ID:  <AF3DE24E780AD211970800600861154B381ACB@TOLSTOI>

  | The text of the draft says that the primary purpose of SIZE is to determine
  | whether the file on the other side has changed.

Does it?  I will have to check - the primary reason is in conjunction
with the REST/STOR combination, so if an "upload" is interrupted part
way through, the source knows exactly where to restart to complete the
transfer.   Its use in checking that a source file for a RETR has not
altered (as one component of that test) is just a frill, and generally
yes, MDTM is better suited to that.

If there is something that ought be changed in, or added to, the doc
before we are done with it, that needs to be suggested quite explicitly
here now, so it can be fixed as a WG last call comment, before an IETF
last call is requested.   So far, I haven't been able to detect anything
that really ought be changed (especially considering that SIZE has been
around now for many years - just not written).

kre