Re: Comments on Malformed Message BCP draft

On Fri Apr 15 18:38:50 2011, Keith Moore wrote:
> Bouncing is absolutely what should happen if the message is merely  
> malformed.  Otherwise, the sender has no idea that his message  
> didn't arrive (or why), and nothing will ever be done to fix the  
> problem.

But the problem is that the message didn't arrive. The reason is that  
it's malformed, but that's not the problem that people care most  
about. Now, *we* may care, but that's a wholly different thing, and  
largely irrelevant to the average user.

Bouncing has problems too - it's trivial to use such a server to  
bounce malformed MIME back to some other address which then processes  
the MIME and allows some malware through.

As I said before, differences in error handling behaviour may result  
in malware vectors being available. If you standardize the error  
handling (to whatever you like - pass through, bounce, or reject)  
then the net result is that exploits of this form cannot happen.

Dave.
-- 
Dave Cridland - mailto:[email protected] - xmpp:[email protected]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade