Subject: Re: [secdir] SECDIR Review of draft-ietf-morg-multimailbox-search-06

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 2 Mar 2011 08:13:05 -0500

On Sat, Feb 26, 2011 at 6:43 AM, Samuel Weiler <[email-masked]> wrote:
> On Tue, 22 Feb 2011, Phillip Hallam-Baker wrote:
>
>> This document makes a minor adjustment to the search mechanism of imap,
>> allowing searches to be made slightly more efficiently.
>
>
> If the user specifies some mailbox(es) which she doesn't have access rights
> to AND some mailbox(es) which she can access, the doc says to IGNORE the
> ones she can't access.  Wouldn't it be more useful to send an error for
> those mailboxes rather than silently fail?

I don't see any value there.

If the user is not permitted access to a mailbox, they don't get the
information. There might be value sending the notice to an exception
log, but it does not make much sense to send it to the user's client.
If the user is trying to maliciously access material they should not,
what would be the value in telling them?

The use case that would likely arise for this would be where there are
shared folders (e.g. mailing lists) in some sort of hierarchy.

-- 
Website: http://hallambaker.com/

---

From: Samuel Weiler <[email-masked]>
Date: Thu, 3 Mar 2011 08:55:48 -0500 (EST)

> what would be the value in telling them?

I'm thinking about this the other way around: if we're dealing with 
the (perhaps more common) case of misconfiguration rather than malice, 
this delivers a poor user experience.  With a silent failure, the user 
is likely to be misled into assuming that no messages matched the 
search.

> The use case that would likely arise for this would be where there 
> are shared folders (e.g. mailing lists) in some sort of hierarchy.

Yep.

-- Sam

---

From: Barry Leiba <[email-masked]>
Date: Thu, 3 Mar 2011 09:00:12 -0500

> I'm thinking about this the other way around: if we're dealing with the
> (perhaps more common) case of misconfiguration rather than malice, this
> delivers a poor user experience.  With a silent failure, the user is likely
> to be misled into assuming that no messages matched the search.

Understood.  But as I said in my previous response, it would
significantly go against WG consensus to change this, and there are
pitfalls in trying to get the change right anyway.

Barry