Subject: Re: C-T-E: base64 and the real world.. what should an MUA do?
From: Arnt Gulbrandsen <[email-masked]>
To: [email-masked]
Date: Tue, 22 Apr 2008 09:35:30 +0200
List-Id: <ietf-822.imc.org>

Valdis Klētnieks writes:
> Of course, the last 5 lines are bogus as base64, and it's easy to just 
> say "Majordomo is at fault".  But such things happen in the real 
> world, and what's the recommended algorithm for an MUA to recover 
> from this?

Stop decoding at '=' (that's two thirds of the cases). Stop decoding 
when you see "--" at the beginning of a line (that's most of the rest).

And if all else fails, following the rules in RFC 2045 result in a few 
random bytes at/after the end of the decoded data. Usually harmless.

Arnt

Date: Mon, 21 Apr 2008 22:49:41 -0400
From: Tony Hansen <[email-masked]>
To: [email-masked]
CC: [email-masked]
Subject: Re: C-T-E: base64 and the real world.. what should an MUA do?
Sender: [email-masked]

If there's a padding "=" at the end of the base64, you can stop 
processing right at that point. You *could* also stop processing when 
you run into a non-whitespace character that isn't in the base64 
alphabet, such as the "-" or ":" in your example. It's not perfect.

	Tony Hansen
	[email-masked]

[email-masked] wrote:
> (Sorry I've been silent on this list for a while, I've been off doing other
> stuff for the nonce and only posting if something egregious happened to
> catch my eye...)
> 
> OK, so the following mail showed up on the linux-kernel mailing list (and it's
> not a singleton mail, I've seen this same broken behavior a lot lately...)
> 
> It had 1 bodypart, correctly tagged as
> 
> Content-type: text/plain; charset=UTF-8
> Content-transfer-encoding: base64
> 
> Majordomo then goes and sticks some stuff on the end, so the last few lines
> of the message are:
> 
> --- cut here ---
> IGRldmljZV9yZW1vdmVfZmlsZShkZXYsICZkZXZ0X2F0dHIpOwo+ICAgICAgICAgfQo+ICAgICAg
> ICAgaWYgKGRldi0+Y2xhc3MpIHsKPgo+ICAtLQoKQXBwbHlpbmcgdGhpcyBwYXRjaCB3b3JrZWQg
> Zm9yIG1lLgoKVGhhbmtzIQogICAgICBNaWxlcwo> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [email-masked]
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> --- cut here ---
> 
> Of course, the last 5 lines are bogus as base64, and it's easy to just say
> "Majordomo is at fault".  But such things happen in the real world, and what's
> the recommended algorithm for an MUA to recover from this?

To: [email-masked]
Subject: C-T-E: base64 and the real world.. what should an MUA do?
From: [email-masked]
Date: Mon, 21 Apr 2008 22:03:07 -0400
Sender: [email-masked]

--=_Exmh_1208829787_3478P
Content-Type: text/plain; charset=us-ascii

(Sorry I've been silent on this list for a while, I've been off doing other
stuff for the nonce and only posting if something egregious happened to
catch my eye...)

OK, so the following mail showed up on the linux-kernel mailing list (and it's
not a singleton mail, I've seen this same broken behavior a lot lately...)

It had 1 bodypart, correctly tagged as

Content-type: text/plain; charset=UTF-8
Content-transfer-encoding: base64

Majordomo then goes and sticks some stuff on the end, so the last few lines
of the message are:

--- cut here ---
IGRldmljZV9yZW1vdmVfZmlsZShkZXYsICZkZXZ0X2F0dHIpOwo+ICAgICAgICAgfQo+ICAgICAg
ICAgaWYgKGRldi0+Y2xhc3MpIHsKPgo+ICAtLQoKQXBwbHlpbmcgdGhpcyBwYXRjaCB3b3JrZWQg
Zm9yIG1lLgoKVGhhbmtzIQogICAgICBNaWxlcwo--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email-masked]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/
--- cut here ---

Of course, the last 5 lines are bogus as base64, and it's easy to just say
"Majordomo is at fault".  But such things happen in the real world, and what's
the recommended algorithm for an MUA to recover from this?

--=_Exmh_1208829787_3478P
Content-Type: application/pgp-signature

--=_Exmh_1208829787_3478P--

Date: Wed, 02 Apr 2008 09:37:59 -0400
From: Barry Leiba <[email-masked]>
To: [email-masked]
Subject: Conference on Email and Anti-Spam final call for papers
Sender: [email-masked]

This seems sufficiently on-topic for this list:
The 2008 Conference on Email and Anti-Spam submission deadline is approaching, 
and has been extended by a week, to 10 April.  If you have any work to report on 
in the area of Internet messaging abuse and its prevention — not limited to 
email spam; see the topic list in the CfP, below — please form it into a paper 
by next week, and submit it.

Barry

----------------------------------------------------------------------
      THE FIFTH CONFERENCE ON EMAIL AND ANTI-SPAM (CEAS 2008)

            Thursday August 21 and Friday August 22, 2008
                   Microsoft Research Silicon Valley
                      Mountain View, California
                        <http://www.ceas.cc>

                       FINAL CALL FOR PAPERS

The Conference on Email and Anti-Spam (CEAS) invites the submission
of papers for its fifth meeting. Papers are invited on all aspects of
electronic communication including email, instant messaging, text
messaging, and voice over internet protocol (VoIP). Topics of interest
include novel applications of electronic messaging, abatement of abuses
of electronic messaging, spam, spit (spam over internet telephony), spim
(spam over instant messenger), phishing, identity theft via messaging,
viruses, and spyware.

Paper submissions can be either research papers, extended abstracts,
industry reports, or law and policy papers. Submissions from
practitioners and vendors are encouraged. Papers will be selected by
peer review for presentation at CEAS 2008. Papers will be reviewed based
on their contribution to the literature.

SUGGESTED TOPICS:

*  Message filtering, blocking, authentication
   -  Machine learning
   -  Natural language processing
   -  Adversarial learning
   -  Challenge-response
   -  Payment schemes
   -  Disposable addresses
   -  Messaging protocols
   -  Digital signatures
*  Evaluation
   - Corpus and benchmark creation
   - Measures and methodologies
   - Comparative tests of methods or products
*  Analysis
   - Economics of spam, spit, spim, phishing, etc.
   - Abuse tactics and patterns
   - Legitimate use patterns
   - Historical data
*  Message organization and search
   - Advanced calendaring and scheduling
   - Automatic foldering
   - Automatic routing
   - Summarization
   - Search
*  Systems and network issues
   - Performance & scalability
   - Reliability & security
   - Archival & retrieval
*  User issues
   - User interfaces
   - Usability studies
   - Messaging in support of user activities
*  Social issues
   - Deducing social networks
   - Costs and benefits of messaging use and abuse
   - Other social impacts
*  Industry
   - Cooperation for stopping abuse
   - Messaging and abuse reporting standards
   - Interoperability
*  Legal issues
   - Spam, spit, spim and phishing, etc.
   - Identity theft
   - Privacy
   - Freedom of speech
   - Digital rights management

KEY DATES:

*  Submission deadline: April 10, 2008 (10:59pm UTC) -- EXTENDED DATE
*  Notification of acceptance: June 6, 2008.
*  Final camera-ready version of papers: June 21, 2008
*  Conference: August 21 and 22, 2008

REQUIREMENTS:

Papers may be of one of two types:
*  Extended abstracts (up to 2 pages) may outline work in progress,
   exceptional papers published for different scientific communities,
   original research, or industry reports.
*  Full papers (up to 10 pages). Work may not have been previously
   published in, or under consideration for publication in any other
   conference or journal.

Submissions must use the CEAS electronic system at:
https://cmt.research.microsoft.com/CEAS2008/. The style for
submissions and final papers is a two-column, 8.5 by 11 inch format. See
http://www.ceas.cc/2008/format.htm for details.

Papers will be reviewed by a committee of experts from academic and
industrial research centers. Accepted papers will be made freely
available on the web, and will be published on CD-ROM. Authors will
retain copyright of their work.

CONTACT:

*  The conference chair and co-chairs can be reached at
   [email-masked]

CEAS PRESIDENT

*  Gordon Cormack
   University of Waterloo
   http://plg.uwaterloo.ca/~gvcormac/

GENERAL CONFERENCE CHAIR:

*  Aleksander Kolcz
   Microsoft Live Labs
   http://ir.iit.edu/~alek/

PROGRAM CO-CHAIRS:

*  Andrej Bratko
   Jozef Stefan Institute
   http://ai.ijs.si/andrej/

*  Barry Leiba
   IBM Research
   http://www.research.ibm.com/people/l/leiba/

*  Tobias Scheffer
   Max Planck Institute for Computer Science
   http://www.mpi-inf.mpg.de/~scheffer/
----------------------------------------------------------------------