Subject: [websec] mimesniff feedback, part 2

From: Philip Jägenstedt <[email-masked]>
Date: Fri, 25 Nov 2011 16:15:06 +0100

A rather serious issue in "Signature for MP4": the spec says that box size  
is little-endian, but every .mp4 file I have tested are in fact  
big-endian. For example, here's a hexdump of the beginning of  
sample_100kbit.mp4, a sample file from Darwin Streaming Server 6.0.3:

00000000  00 00 00 18 66 74 79 70  6d 70 34 32 00 00 00 01   
|....ftypmp42....|
00000010  6d 70 34 32 6d 70 34 31  00 00 5a eb 6d 6f 6f 76   
|mp42mp41..Z.moov|
00000020  00 00 00 6c 6d 76 68 64  00 00 00 00 be 44 3f 8d   
|...lmvhd.....D?.|

-- 
Philip Jägenstedt
Core Developer
Opera Software

---

From: Adam Barth <[email-masked]>
Date: Fri, 25 Nov 2011 20:26:05 -0800

Yes.  Bid-endian is correct.  The IETF draft you're reading expired on
November 8.

Adam

On Fri, Nov 25, 2011 at 7:15 AM, Philip Jägenstedt <[email-masked]> wrote:
> is little-endian, but every .mp4 file I have tested are in fact big-endian.
> For example, here's a hexdump of the beginning of sample_100kbit.mp4, a
> sample file from Darwin Streaming Server 6.0.3:
>
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec
>

---

From: Julian Reschke <[email-masked]>
Date: Sat, 26 Nov 2011 13:57:20 +0100

On 2011-11-26 05:26, Adam Barth wrote:
> ...

Well, it's the last that was published. Are you saying people should 
stop reading it?

Best regards, Julian

---

From: Adam Barth <[email-masked]>
Date: Sat, 26 Nov 2011 12:23:15 -0800

On Sat, Nov 26, 2011 at 4:57 AM, Julian Reschke <[email-masked]> wrote:
> Well, it's the last that was published. Are you saying people should stop
> reading it?

I believe standard IETF practice is to stop reading drafts that have expired.

Depending on how the working group resolves some of the issues it is
considering, the draft will need to be substantially re-written.  For
example, if we decide to use an IANA registry (as seems likely) all of
the text that Philip commented on will be removed from the document.

Adam

---

From: Larry Masinter <[email-masked]>
Date: Sun, 27 Nov 2011 09:24:44 -0800

> Depending on how the working group resolves some of the issues it is considering, the draft will need to be substantially re-written.  For example, if we 
> decide to use an IANA registry (as seems likely) all of the text that Philip commented on will be removed from the document.

I think the body of the text might say "Use the values in the IANA registry", but that the "IANA considerations" section would contain all of the instructions for how to set up the registry.

That is, the document would stay the authoritative source for the _initial_  contents of the registry, but updates and additions could be managed through whatever registration process we decided on, without having to update the document or algorithm itself.

Larry

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 29 Nov 2011 10:14:45 -0700

> That is, the document would stay the authoritative source for the _initial_  contents of the registry, but updates and additions could be managed through whatever registration process we decided on…

Makes sense to me (as an individual).

Peter

-- 
Peter Saint-Andre
https://stpeter.im/