Subject: [secdir] secdir review of draft-ietf-eai-mailinglistbis-05

From: Charlie Kaufman <[email-masked]>
Date: Wed, 22 Aug 2012 20:45:57 +0000

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This Informational document describes "considerations" for the design and operations of mailing list expanders not collocated with the sender when non-ASCII email addresses are involved. It is truly informational in that it does not prescribe how to deal with the various problems that one might encounter. It simply enumerates the problems, describes the alternatives, and the range of behaviors observed in existing implementations. It suggests a number of areas where future standardization would be helpful.

The document lists no security considerations. An issue discussed in the document that could be considered a security issue is that mail recipients that cannot accept non-ASCII email addresses might or might not receive messages sent to the list (depending on approaches the forwarder takes), and generally the original sender is not notified. I don't recommend any changes.

                --Charlie

---

From: John C Klensin <[email-masked]>
Date: Thu, 30 Aug 2012 14:38:31 -0400

Charlie,

As WG Co-chair, let me respond to this on behalf of the WG (and
just to be sure we don't have open loops).  

Your careful review is much appreciated, as is the "no changes
recommended" conclusion.  It is always good to have additional
assurances that nothing important was overlooked.

The issue of a multiple-recipient message that requires SMTPUTF8
capability being undeliverable to some recipients, and hence
misleading to those who do receive it about who else got it, is
endemic in any approach that attempts to permit non-ASCII
local-parts of addresses while preserving rough compatibility
with the existing email infrastructure.  That is the case
whether the list of recipients is determined by the message
originator (e.g., in "To:" or "Cc:" fields) or as part of
distribution list processing.   Of course, such recipient lists
are _never_ guaranteed to be accurate: addresses may become
obsolete or undeliverable for all sorts of reasons and none of
them are reported back to other recipients (or, in the case of
mailing lists that follow the specs, to the message originator).
In that sense, the "None beyond what mailing list agents do now"
statement in this draft is precisely and narrowly correct.

For the specific case of these extensions, many of the issues --
but not the specific one of misleading recipient lists-- are
discussed at length in RFC 6530.  In retrospect, the particular
issue with recipient lists should probably have been called out
in either the Security Considerations section or, more likely,
Section 11 of that document, but it is a little bit late for
that now.  That said, if you (or others) think the Security
Consideration section of this document would be improved by an
explicit pointer to the discussion in RFC 6530, I can't imagine
the WG finding that objectionable.

Thanks again for the review.

best,
    john

--On Wednesday, August 22, 2012 20:45 +0000 Charlie Kaufman
<[email-masked]> wrote:

> I have reviewed this document as part of the security
> directorate's ongoing effort to review all IETF documents
> being processed by the IESG.  These comments were written
> primarily for the benefit of the security area directors.
> Document editors and WG chairs should treat these comments
> just like any other last call comments.
> 
> This Informational document describes "considerations" for the
> design and operations of mailing list expanders not collocated
> with the sender when non-ASCII email addresses are involved.
> It is truly informational in that it does not prescribe how to
> deal with the various problems that one might encounter. It
> simply enumerates the problems, describes the alternatives,
> and the range of behaviors observed in existing
> implementations. It suggests a number of areas where future
> standardization would be helpful.
> 
> The document lists no security considerations. An issue
> discussed in the document that could be considered a security
> issue is that mail recipients that cannot accept non-ASCII
> email addresses might or might not receive messages sent to
> the list (depending on approaches the forwarder takes), and
> generally the original sender is not notified. I don't
> recommend any changes.
> 
>                 --Charlie