Subject: [secdir] SecDir review of draft-leiba-5322upd-from-group-06

From: Warren Kumari <[email-masked]>
Date: Thu, 25 Oct 2012 10:27:41 -0400

I have reviewed this document as part of the security directorate's  ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

Summary:
This document updates RFC5322 to allow group syntax in From: and Sender: (and "Resent-
   From:" and "Resent-Sender:").

Notes:
I found the security considerations section to be well written, clear and complete (enough!). It appears that the author has considered and explained the security implications of the changes.
As From: addresses are frequently spoofed (and contain random crap), they are treated as untrusted data, and so this does not seem to significantly change the threat model.

As a general note I think that it could be made clearer *why* this is being done -- this document does a good job of explaining *how* this change gets implemented, and the implications of this change, but the reason why remains kinda vague to me-- I'm not an email geek, so it may be blindingly obvious to others. There is some use case text about "group syntax evolving" and EAI, but for someone not skilled in the art it doesn't communicate much.
Anyway, this is just a general observation…

Nits:
None

W

-- 
There are only 10 types of people in this world -- those who understand binary arithmetic and those who don't.

---

From: Barry Leiba <[email-masked]>
Date: Thu, 25 Oct 2012 11:08:01 -0400

Warren, thanks for the review.  Indeed, I do intend to make some
clarification about the resons before this goes to the RFC Editor, based on
your and others' comments.

Barry

---

From: Warren Kumari <[email-masked]>
Date: Thu, 25 Oct 2012 11:29:58 -0400

On Oct 25, 2012, at 11:08 AM, Barry Leiba <[email-masked]> wrote:

> Warren, thanks for the review.  Indeed, I do intend to make some clarification about the resons before this goes to the RFC Editor, based on your and others' comments.
> 

Cool thanks. I'm suspecting that this is simply a case where is it blinding obvious to those poor souls who spend their days fiddling with the innards of mail, but (luckily!) this ain't me :-)

W

--
It's a mistake trying to cheer up camels. You might as well drop meringues into a black hole. -- Terry Prachett