Subject: Re: [Tools-discuss] Mangled Internet-Drafts

From: Allison Mankin <[email-masked]>
Date: Wed, 01 Dec 2004 12:21:18 -0800

Hi, Al,

I've just seen a submission where the form-feeds (if that's what
we all call them) had been stripped out, so it's not nailed yet.
I'm pretty sure the rest of the i-d was ok beyond those characters,
though I didn't do the most complete exam on it.

It was the submission of draft-ietf-nsis-signaling-analysis-05.txt 
by Jukka Manner today (20041201).  

Subject: Submission of a final version of an I-D

Allison

> 
> Date:    Mon, 22 Nov 2004 17:36:39 EST
> To:      IESG <[email-masked]>, WG Chairs <[email-masked]>,
> 	 Tools Team Discussion <[email-masked]>
> cc:      [email-masked], [email-masked], [email-masked],
> 	 Scott Blomquist <[email-masked]>, [email-masked]
> From:    Albert Vezza <[email-masked]>
> Subject: Re: [Tools-discuss] Mangled Internet-Drafts
> 
> After more testing we determined that a filter could be placed to 
> intercept email sent to [email-masked] and 
> [email-masked] and ensure email containing attachments sent to 
> those addresses had a "Content-disposition: attachment" as part of 
> the file header.
> 
> A preliminary filter changing "Content-disposition: inline" to 
> "Content-disposition: attachment" was placed in service on 11/18/04. 
> We will soon have a more comprehensive  filter in place that will 
> also handle email from older composers that do not specify a 
> "Content-disposition:".  I will send an update when that filter is in 
> place.
> 
> We belive that this will take care of all three problems that have 
> been observed:  concatenated files, extra linefeeds in IDs, and 
> missing form-feed.  If such problems are found in the future please 
> let us know so we can track down the problem.
> 
> Al
> -- 
> Albert Vezza
> President
> Foretec Seminars, Inc
> 1895 Preston White Drive
> Suite 100
> Reston, VA 20191-5434
> 
> Internet mail: [email-masked]
> Tel: (703) 620-9053
> Fax: (703) 620-9071
> 
> Natick, MA Office
> Tel:  (508) 650 4020
> Fax:  (508) 650 4639
> 

_______________________________________________
Tools-discuss mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tools-discuss

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 03 Dec 2004 09:40:51 +0100

Hi Albert,

Sorry, copied this time ;-)

I don't agree actually with your view. Let me explain.

A zip, sit, tar or other compressed formats, are never executable files. You
only can uncompress the file, and then if it contains an exe (for example)
and you actually execute it, then you may start a virus.

At the end the problem becomes a "user" problem, depending on how the user
do the things and has his operating system configured.

Moreover, today all the antivirus are also able to scan compressed files, so
even in the situation of getting one, it will be detected before is
uncompressed by the user.

What you're telling me about a possible disruption could also be created
even by a virus or DoS attack introduced in the system in some other way.
For example the same user that has a miss configured OS uncompress and
executes an attachment received not as an Internet Draft submission, but
just as a regular email from a friend (or pretending to be a friend). What I
mean is that the security level depends on a proper configuration and usage
of the systems, not on rejecting what is useful for the IETFers AND can be
detected even in the case of a malicious attachment.

It may be even easier to attach the system, depending on the mail client and
the OS that you're using, which an email pretending to be html and actually
being executed automatically. Again, is a question of user attitude and OS
configuration.

So, unless you provide me a better rationale (which I'm not able to imagine
right now), my opinion is that this one is a very poor one to be sufficient
to not accept compressed files ;-)

Regards,
Jordi

>> De: Albert Vezza <[email-masked]>
>> Responder a: <[email-masked]>
>> Fecha: Thu, 2 Dec 2004 16:22:41 -0500
>> Para: JORDI PALET MARTINEZ <[email-masked]>
>> CC: IESG <[email-masked]>, WG Chairs <[email-masked]>, Tools Team
>> Discussion
>> <[email-masked]>, <[email-masked]>, <[email-masked]>,
>> <[email-masked]>, Scott Blomquist <[email-masked]>,
>> <[email-masked]>
>> Asunto: Re: Fwd: Re: [Tools-discuss] Mangled Internet-Drafts
>> 
>> Hi Jordi,
>> 
>> I am not on any of the mailing lists that you sent your email to, so
>> Barbara forwarded me your email.  Anyway I talked to the technical
>> folks and I have concluded that it is just too risky to accept zip
>> and tar files, because  one virus that might get through the virus
>> filters could disrupt operations.  If that disruption came at a busy
>> time such as just before a meeting there would be a great many people
>> unhappy.
>> 
>> Sorry but we need to be careful about such things.
>> 
>> Al
>> 
>> 
>>> Hi Al:
>>> 
>>> Here is a response to your message that I don't believe was sent to you.
>>> 
>>> B.
>>> ------------------------------------------------------
>>>> Envelope-to: [email-masked]
>>>> User-Agent: Microsoft-Entourage/10.1.4.030702.0
>>>> Date: Tue, 23 Nov 2004 00:12:12 +0100
>>>> From: JORDI PALET MARTINEZ <[email-masked]>
>>>> X-MDRemoteIP: 217.126.187.160
>>>> X-Return-Path: [email-masked]
>>>> X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on
>>>> mail.consulintel.es
>>>> X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=no
>>>>         version=2.64
>>>> X-Spam-Processed: consulintel.es, Tue, 23 Nov 2004 00:19:44 +0100
>>>> X-MDAV-Processed: consulintel.es, Tue, 23 Nov 2004 00:19:44 +0100
>>>> X-Spam-Score: 2.9 (++)
>>>> X-Scan-Signature: 00e94c813bef7832af255170dca19e36
>>>> Cc: [email-masked], [email-masked], [email-masked],
>>>> X-BeenThere: [email-masked]
>>>> X-Mailman-Version: 2.1.5
>>>> Reply-To: [email-masked]
>>>> List-Id: IETF Tools Discussion <tools-discuss.ietf.org>
>>>> List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/tools-discuss>,
>>>>         <mailto:[email-masked]?subject=unsubscribe>
>>>> List-Archive: <http://www1.ietf.org/pipermail/tools-discuss>
>>>> List-Post: <mailto:[email-masked]>
>>>> List-Help: <mailto:[email-masked]?subject=help>
>>>> List-Subscribe: <https://www1.ietf.org/mailman/listinfo/tools-discuss>,
>>>>         <mailto:[email-masked]?subject=subscribe>
>>>> Sender: [email-masked]
>>>> X-Spam-Score: 2.9 (++)
>>>> X-Scan-Signature: d185fa790257f526fedfd5d01ed9c976
>>>> 
>>>> Hi Albert, all,
>>>> 
>>>> As someone already indicated, it will be helpful anyway to allow sending
>>>> zip
>>>> and tar files.
>>>> 
>>>> Some corporate email servers compress all the attachments, and actually is
>>>> not so easy for some to tell their IT services not to compress attachments
>>>> sent to IETF ;-)
>>>> 
>>>> On the other way around, this doesn't harm to the process, right ?
>>>> 
>>>> Regards,
>>>> Jordi
>>>> 
>>>> 
>>>>>  De: Albert Vezza <[email-masked]>
>>>>>  Responder a: [email-masked]
>>>>>  Fecha: Mon, 22 Nov 2004 17:36:39 -0500
>>>>>  Para: IESG <[email-masked]>, WG Chairs <[email-masked]>, Tools Team
>>>>>  Discussion <[email-masked]>
>>>>>  CC: [email-masked], [email-masked], [email-masked],
>>>>> Scott Blomquist
>>>>>  Asunto: Re: [Tools-discuss] Mangled Internet-Drafts
>>>>> 
>>>> **********************************
>>>> Madrid 2003 Global IPv6 Summit
>>>> Presentations and videos on line at:
>>>> http://www.ipv6-es.com
>>>> 
>>>> This electronic message contains information which may be
>>>> privileged or confidential. The information is intended to be for
>>>> the use of the individual(s) named above. If you are not the
>>>> intended recipient be aware that any disclosure, copying,
>>>> distribution or use of the contents of this information, including
>>>> attached files, is prohibited.
>>>> 
>>>> 
>>>> 
>>>> 
>>> ------------------------------------------------
>>> Barbara B. Fuller
>>> Acting Executive Director
>>> Internet Engineering Task Force
>>> 
>>> Natick, Massachusetts Office:
>>> 
>>> Phone: +1-508-650-4020
>>> Fax:     +1-508-650-4639
>>> 
>>> Reston, Virginia Office:
>>> 
>>> Phone: +1-703-620-9053
>>> Fax:     +1-703-620-9071
>> 
>> 
> 

**********************************
Madrid 2003 Global IPv6 Summit
Presentations and videos on line at:
http://www.ipv6-es.com

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.