Subject: Re: [websec] I-D Action:draft-ietf-websec-mime-sniff-03.txt

From: Julian Reschke <[email-masked]>
Date: Sat, 24 Sep 2011 13:03:00 +0200

On 2011-05-08 02:45, [email-masked] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Web Security Working Group of the IETF.
>
>
> 	Title           : Media Type Sniffing
> 	Author(s)       : A. Barth, I. Hickson
> 	Filename        : draft-ietf-websec-mime-sniff-03.txt
> 	Pages           : 24
> 	Date            : 2011-05-07
> ...

I think it would be good if the Internet Drafts database could be 
updates to say that draft-ietf-websec-mime-sniff replaces 
draft-abarth-mime-sniff (this helps with various tools that try to check 
for upto-date-ness and successor documents).

Best regards, Julian

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 24 Sep 2011 15:51:48 +0100

Julian Reschke wrote:

> draft-abarth-mime-sniff (this helps with various tools that try to 
> check for upto-date-ness and successor documents).

Will do.

---

From: Tobias Gondrom <[email-masked]>
Date: Thu, 29 Sep 2011 00:15:37 +0100

Hello,

although this has been around for a while, just stumbled again over this 
http header when I analysed the bits on the wire of some web applications:

X-Content-Type-Options: nosniff – This prevents “mime” based attacks. 
The header instructs the browser not to override the response content 
type. For example, some browsers try to be smart by deciding for 
themselves if the content is really is text/html or an image. So with 
the nosniff option, if the server says the content is text/html, then 
the browser needs to render it as text/html.

Is this something we should mention in mime-sniff or even consider to 
encourage?

Kind regards, Tobias

---

From: Adam Barth <[email-masked]>
Date: Wed, 28 Sep 2011 16:26:09 -0700

As I recall, the nosniff directive is pretty controversial.

Adam

On Wed, Sep 28, 2011 at 4:15 PM, Tobias Gondrom
<[email-masked]> wrote:
> X-Content-Type-Options: nosniff – This prevents “mime” based attacks. The
> header instructs the browser not to override the response content type. For
> example, some browsers try to be smart by deciding for themselves if the
> content is really is text/html or an image. So with the nosniff option, if
> the server says the content is text/html, then the browser needs to render
> it as text/html.
>
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec
>

---

From: Tobias Gondrom <[email-masked]>
Date: Thu, 29 Sep 2011 00:31:02 +0100

I can imagine. As there come problems with it, just thinking of empty 
content-types and then forbidding to sniff. Just a thought.

Tobias

---

From: Adam Barth <[email-masked]>
Date: Wed, 28 Sep 2011 16:33:20 -0700

That's treated as text/plain, for what it's worth.

Strangely, it's more common to get an empty content type with a
nosniff directive than without one (by a few fractions of a percent).

Adam

---

From: "Martin J. Dürst" <[email-masked]>
Date: Thu, 29 Sep 2011 09:44:23 +0900

> As I recall, the nosniff directive is pretty controversial.

But then, as I recall, the whole business of sniffing is pretty 
controversial to start with. Are there differences between the 
controversiality of sniffing as such and the controversiality of the 
nosniff directive that explain why one is in the draft and the other is not?

Regards,   Martin.

---

From: Adam Barth <[email-masked]>
Date: Wed, 28 Sep 2011 19:45:33 -0700

On Wed, Sep 28, 2011 at 5:44 PM, "Martin J. Dürst"
<[email-masked]> wrote:
> controversiality of sniffing as such and the controversiality of the nosniff
> directive that explain why one is in the draft and the other is not?

The reason why one is in and the other isn't is just historical.
nosniff didn't exist at the time the document was originally written.

Adam

---

From: "Martin J. Dürst" <[email-masked]>
Date: Sat, 01 Oct 2011 14:14:24 +0900

Hello Adam,

> nosniff didn't exist at the time the document was originally written.

Your first answer sounded as if the nosniff directive was too 
controversial to be included in any draft, but your second answer seems 
to suggest that it was left out by (historical) accident, and that it 
might be worth to include it.

Regards,    Martin.

---

From: Adam Barth <[email-masked]>
Date: Fri, 30 Sep 2011 23:47:55 -0700

On Fri, Sep 30, 2011 at 10:14 PM, "Martin J. Dürst"
<[email-masked]> wrote:
>>> nosniff
> Your first answer sounded as if the nosniff directive was too controversial
> to be included in any draft, but your second answer seems to suggest that it
> was left out by (historical) accident, and that it might be worth to include
> it.

The essential question isn't whether we should include it in the
draft.  The essential question is whether folks want to implement it.
If no one wants to implement it, putting it in the draft is a
negative.  If folks want to implement, then we can deal with the
controversy.

Adam