Subject: spamtest/virustest "NIL" behaviour

From: "Nigel Swinson" <[email-masked]>
Date: Wed, 30 Apr 2003 13:28:04 +0100

In the spamtest/virustest draft there is the following example:

        if spamtest :value "ge" :comparator "i;ascii-numeric" "3"
        {
            fileinto "INBOX.spam-trap";
        }
        elsif spamtest :is "NIL"
        {
            fileinto "INBOX.unclassified";
        }

When the virus scanner or the anti spam scanner fail, I presume we give the
spamtest/virustest a "NIL" value as though it never even passed through the
scanner.  So according to RFC2244, when we use ascii-numeric, that seems to
imply that "NIL" turns into a very large number.  Is that right?

RFC 2244                          ACAP                     November 1997
      i;ascii-numeric
           Operations: Ordering, Equality

           The i;ascii-numeric comparator interprets strings as decimal
           positive integers represented as US-ASCII digits.  All values
           which do not begin with a US-ASCII digit are considered equal
           with an ordinal value higher than all non-NIL single-valued
           attributes.  Otherwise, all US-ASCII digits (octet values
           0x30 to 0x39) are interpreted starting from the beginning of
           the string to the first non-digit or the end of the string.

That being said, we would never file anything to the "unclassified" folder
as "a very large number" is greater than "3".  Also If we define the
spamtest/virustest values as:

Internet Draft    SIEVE Spamtest and Virustest Extensions    April 2003
    The spamtest result is a string starting with a numeric value in the
    range "0" (zero) through "10", with "0" meaning the message is
    definitely clear of spam, and "10" meaning the message is definitely
    spam.  The underlying SIEVE implementation will map whatever spam
    check is done into this numeric range, as appropriate.  If the
    message has not been categorised by any spam checking tools, then
    the spamtest result is "NIL".

Does that mean that the "NIL" value gets a score of higher than 10 and is
therefore really really really definately spam/a virus?

Is the example therefore not better written as:

        if spamtest :is "NIL"
        {
            fileinto "INBOX.unclassified";
        }
        elsif spamtest :value "ge" :comparator "i;ascii-numeric" "3"
        {
            fileinto "INBOX.spam-trap";
        }

I'd also suggest that we use a different value to "NIL", perhaps "5 NIL" so
that the 5 is mid range 50/50 spam/virus and the "NIL" as the string to say
that scanning failed to protect users from making the fairly subtle mistake
of treating scan failures as either "definately not spam" or "definately
spam".

Or did I misunderstand somewhere.... :o/

Nigel

---

From: [email-masked]
Date: Wed, 30 Apr 2003 09:27:56 -0700 (PDT)

>             fileinto "INBOX.unclassified";

I pointed out that this is broken in an earlier email.

> imply that "NIL" turns into a very large number.  Is that right?

Yes.

> therefore really really really definately spam/a virus?

Yes.

>             fileinto "INBOX.spam-trap";

Yes.

> of treating scan failures as either "definately not spam" or "definately

I dislike assigning a default value in the middle of the range when no check
has been done. I guess I could live with making 0 a special "no check has been
done" value.

				Ned

---

From: Cyrus Daboo <[email-masked]>
Date: Wed, 30 Apr 2003 13:21:16 -0400

Hi Nigel,

--On Wednesday, April 30, 2003 1:28 PM +0100 Nigel Swinson 
<[email-masked]> wrote:

| When the virus scanner or the anti spam scanner fail, I presume we give
| the spamtest/virustest a "NIL" value as though it never even passed
| through the scanner.  So according to RFC2244, when we use ascii-numeric,
| that seems to imply that "NIL" turns into a very large number.  Is that
| right?

Yes - Ned pointed this out and I did fix the example and add some comments 
about this situation.

-- 
Cyrus Daboo

---

From: Cyrus Daboo <[email-masked]>
Date: Wed, 30 Apr 2003 13:27:44 -0400

Hi Ned,

--On Wednesday, April 30, 2003 9:27 AM -0700 [email-masked] wrote:

|> I'd also suggest that we use a different value to "NIL", perhaps "5 NIL"
|> so that the 5 is mid range 50/50 spam/virus and the "NIL" as the string
|> to say that scanning failed to protect users from making the fairly
|> subtle mistake of treating scan failures as either "definately not spam"
|> or "definately spam".
|
| I dislike assigning a default value in the middle of the range when no
| check has been done. I guess I could live with making 0 a special "no
| check has been done" value.

It may be OK to do that for spamtest, but I don't think its valid for 
virustest. What we could do is:

spamtest value:

0 - unchecked
1 - definitely clear of spam
...
10 - definitely contains spam

virustest value:

0 - definitely clear of viruses
1 - possibly contains a virus/unchecked
2 - definitely contains a virus

That would eliminate NIL entirely.

-- 
Cyrus Daboo

---

From: [email-masked]
Date: Wed, 30 Apr 2003 10:48:04 -0700 (PDT)

> That would eliminate NIL entirely.

I like it -- the current situation where NIL sorts at the end is very awkward.
What do other people think?

				Ned

---

From: "Nigel Swinson" <[email-masked]>
Date: Wed, 30 Apr 2003 18:58:20 +0100

> That would eliminate NIL entirely.

Sounds good to me too :o)

I do wonder though if we should just use 0-10 for virustest too, so that
it's the same range as spam test.  It might be more "intuative" to users.
So you'd have varying degrees of suspicion.  If implementations just map to
the values 0, 5 and 10 then that's fine, but I don't know if there are anti
virus implementations that give a "score" in the same way as anti spam
does... or will there be such an implementation in the future?  Just an
idea... I'm not completely sold on it myself I have to say.

Nigel

---

From: Jutta Degener <[email-masked]>
Date: Wed, 30 Apr 2003 11:17:59 -0700

> What do other people think?

Looks like a workable compromise that'll make the world a little safer.
Are we keeping the NIL suffix?  Otherwise I'd ask to have a virustest
number reserved only for untested messages (not for a mix of untested
and unclear).

Jutta

---

From: Cyrus Daboo <[email-masked]>
Date: Wed, 30 Apr 2003 14:10:03 -0400

Hi Nigel,

--On Wednesday, April 30, 2003 6:58 PM +0100 Nigel Swinson 
<[email-masked]> wrote:

|> virustest value:
|>
|> 0 - definitely clear of viruses
|> 1 - possibly contains a virus/unchecked
|> 2 - definitely contains a virus
|>
|> That would eliminate NIL entirely.
|
| Sounds good to me too :o)
|
| I do wonder though if we should just use 0-10 for virustest too, so that
| it's the same range as spam test.  It might be more "intuative" to users.
| So you'd have varying degrees of suspicion.  If implementations just map
| to the values 0, 5 and 10 then that's fine, but I don't know if there are
| anti virus implementations that give a "score" in the same way as anti
| spam does... or will there be such an implementation in the future?  Just
| an idea... I'm not completely sold on it myself I have to say.

I did just think of one other state that might be interesting to enumerate 
and that is 'virus was detected but removed - message is now safe'. That 
could simply be handled as a comment in the 'text' part of the result, or 
by inserting it into the enumeration at index 1. I know a number of 
anti-virus tools are able to 'clean' messages and being able to detect that 
in sieve might be useful. Would this be useful to add?

I do think virustest should be restricted to a very limited set of values 
as the potential for damage caused by letting some through is much more 
significant than spamtest.

-- 
Cyrus Daboo

---

From: [email-masked]
Date: Wed, 30 Apr 2003 11:47:13 -0700 (PDT)

> number reserved only for untested messages (not for a mix of untested

Keeping the suffix is fine with me.

				Ned

---

From: "Nigel Swinson" <[email-masked]>
Date: Wed, 30 Apr 2003 20:26:20 +0100

> significant than spamtest.

Well with the F-Secure scanner (the one I'm most familiar with) the possible
return values are:

- Valid,
- Infected,
- Cured, (The sent content was disinfected.)
- Replaced, (The sent content is infected. The server replaced the original
content.)
- Error.

And probably add to that:

- Untested

So somehow I gotta map to the virustest values....   so I guess if we have

> >2 - definitely contains a virus

Then I could map valid, cured and replaced to 0, infected to 2, and error
and untested to 1.  I suppose we could move to:

0 - contains no known viruses
1 - contained a known virus but the virus was replaced with harmless content
2 - contained a known virus but the conent was "cured" such that it is now
harmless
3 - possibly contains a virus
4 - unchecked
5 - definately contains a known virus.

But it's not clear to be that the above is the right order, but separating
them all is at least explicit, but then what if we get new results in the
future?  I'm happy enough with the three values and using the string part to
work out if it was cured/replaced, or possibly/unchecked.

On a related point, the draft shouldn't say:

    The virustest result is a string starting with a numeric value in
    the range "0" (zero) through "2", with "0" meaning the message is
    definitely clear of viruses, ....

As you can only say "clear of all known viruses given the set of AV updates
currently deployed".  (sorry if this point has been made already :o/ )

Nigel

From: "Nigel Swinson" <[email-masked]>
To: "Cyrus Daboo" <[email-masked]>, <[email-masked]>
Cc: <[email-masked]>
Subject: Re: spamtest/virustest "NIL" behaviour
Date: Wed, 30 Apr 2003 20:26:20 +0100
Sender: [email-masked]

> significant than spamtest.

Well with the F-Secure scanner (the one I'm most familiar with) the possible
return values are:

- Valid,
- Infected,
- Cured, (The sent content was disinfected.)
- Replaced, (The sent content is infected. The server replaced the original
content.)
- Error.

And probably add to that:

- Untested

So somehow I gotta map to the virustest values....   so I guess if we have

> >2 - definitely contains a virus

Then I could map valid, cured and replaced to 0, infected to 2, and error
and untested to 1.  I suppose we could move to:

0 - contains no known viruses
1 - contained a known virus but the virus was replaced with harmless content
2 - contained a known virus but the conent was "cured" such that it is now
harmless
3 - possibly contains a virus
4 - unchecked
5 - definately contains a known virus.

But it's not clear to be that the above is the right order, but separating
them all is at least explicit, but then what if we get new results in the
future?  I'm happy enough with the three values and using the string part to
work out if it was cured/replaced, or possibly/unchecked.

On a related point, the draft shouldn't say:

    The virustest result is a string starting with a numeric value in
    the range "0" (zero) through "2", with "0" meaning the message is
    definitely clear of viruses, ....

As you can only say "clear of all known viruses given the set of AV updates
currently deployed".  (sorry if this point has been made already :o/ )

Nigel

Date: Wed, 30 Apr 2003 11:47:13 -0700 (PDT)
From: [email-masked]
Subject: Re: spamtest/virustest "NIL" behaviour
To: Jutta Degener <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

				Ned

Date: Wed, 30 Apr 2003 11:17:59 -0700
From: Jutta Degener <[email-masked]>
To: [email-masked]
Subject: Re: spamtest/virustest "NIL" behaviour
Sender: [email-masked]

Jutta

Date: Wed, 30 Apr 2003 14:10:03 -0400
From: Cyrus Daboo <[email-masked]>
To: Nigel Swinson <[email-masked]>, [email-masked]
cc: [email-masked]
Subject: Re: spamtest/virustest "NIL" behaviour
Sender: [email-masked]

Hi Nigel,

|> virustest value:
|>

-- 
Cyrus Daboo

Date: Wed, 30 Apr 2003 10:58:57 -0700
From: Jutta Degener <[email-masked]>
To: [email-masked]
Subject: Re: variables: greedy or non-greedy matching
Sender: [email-masked]

On Tue, Apr 29, 2003 at 06:01:19PM -0700, [email-masked] wrote:
> > [Ned Freed]:
> > >
> > >   [Jutta Degener]:
> > >   > So let's stay greedy; thanks for setting me straight!
> > >
> > >   No problem ;-) And let's also remember that a necessary corollary
> > >   here is that the regexp we end up choosing needs to support both
> > >   greedy and non-greedy matching.
> 
> > why?  I thought we only needed that if :matches was non-greedy.
> 
> > I wouldn't mind having non-greedy regexps, but they're not in POSIX.2
> > which the regex draft refers to.
> 
> Jutta's argument, which I believe is valid, is that expectations can only
> be met by having both types available.

Most cases of it can also be met with character classes.

That's why I said "let's stay greedy" in the piece you quote above --
I realized that I wanted to solve problems with non-greed that can
be solved with regexes.

Jutta

From: "Nigel Swinson" <[email-masked]>
To: <[email-masked]>, "Cyrus Daboo" <[email-masked]>
Cc: <[email-masked]>
Subject: Re: spamtest/virustest "NIL" behaviour
Date: Wed, 30 Apr 2003 18:58:20 +0100
Sender: [email-masked]

Nigel

Date: Wed, 30 Apr 2003 10:48:04 -0700 (PDT)
From: [email-masked]
Subject: Re: spamtest/virustest "NIL" behaviour
To: Cyrus Daboo <[email-masked]>
Cc: [email-masked], Nigel Swinson <[email-masked]>, [email-masked]
Sender: [email-masked]

				Ned

Date: Wed, 30 Apr 2003 13:27:44 -0400
From: Cyrus Daboo <[email-masked]>
To: [email-masked], Nigel Swinson <[email-masked]>
cc: [email-masked]
Subject: Re: spamtest/virustest "NIL" behaviour
Sender: [email-masked]

Hi Ned,

spamtest value:

0 - unchecked

virustest value:

-- 
Cyrus Daboo

Date: Wed, 30 Apr 2003 13:21:16 -0400
From: Cyrus Daboo <[email-masked]>
To: Nigel Swinson <[email-masked]>, [email-masked]
Subject: Re: spamtest/virustest "NIL" behaviour
Sender: [email-masked]

Hi Nigel,

-- 
Cyrus Daboo

Date: Wed, 30 Apr 2003 09:27:56 -0700 (PDT)
From: [email-masked]
Subject: Re: spamtest/virustest "NIL" behaviour
To: Nigel Swinson <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

Yes.

Yes.

Yes.

				Ned

From: "Nigel Swinson" <[email-masked]>
To: <[email-masked]>
Subject: spamtest/virustest "NIL" behaviour
Date: Wed, 30 Apr 2003 13:28:04 +0100
Sender: [email-masked]

        if spamtest :is "NIL"
        {

Nigel

To: [email-masked]
Subject: Re: Three new drafts and a question
From: Kjetil Torgrim Homme <[email-masked]>
Date: 30 Apr 2003 12:12:30 +0200
Lines: 41
Sender: [email-masked]

[Arnt Gulbrandsen]:
>
>   Kjetil Torgrim Homme writes:
>   > good point. most GUI's will only need to understand their own
>   > Sieve code,
>   
>   Oh?

sorry, I should say "their own idioms".

>   When a program is about to parse a sieve script, it cannot know
>   whether that script was written by itself. Right? That's more or
>   less a design decision. There's nothing like the postscript
>   Creator field in sieve.
>   
>   Because of that, a program cannot enable or disable its 'parse
>   existing sieve script' command depending on who wrote the sieve
>   script.

agreed, it must _always_ give a functionally equivalent
representation.  if you select "lower case Subject" in one editor, it
may emit

    if header :matches "Subject" "*" {
        set :lower "_lc" "${1}";
        deleteheader "Subject";
        addheader "Subject" "${_lc}";
    }

it is OK for a different editor to present this differently, say:

   lower case content of header Subject and store in variable _lc
   delete header Subject
   add header Subject with content from variable _lc

I think most users will stick to one editor, or edit the code
directly, so they will be happy even if it lacks advanced code pattern
matching.

-- 
Kjetil T.

To: [email-masked]
Subject: Re: Three new drafts and a question
From: Kjetil Torgrim Homme <[email-masked]>
Date: 30 Apr 2003 11:56:33 +0200
Lines: 32
Sender: [email-masked]

[Marc Mutz]:
>
>   On Wednesday 30 April 2003 01:07, Kjetil Torgrim Homme wrote:
>   > I know you wanted a failed match to not influence the numeric
>   > variables, Ned, it seems like you were right.
>   
>   Well, _obviously_ this particular problem stems from
>   unconditionally executing deleteheader+addheader. The correct way
>   to do this would be:
>   
>   if header :matches "Subject" "[ietf] *" {
>   	deleteheader "Subject";
>   	addheader "Subject" "${1}";
>   }

it is always possible to add code to avoid the problem, e.g.,

   set "oldsubj" "${1}"

the question is which behaviour is more convenient.  my previous
example omitted the classifying test, it could look like this:

   if header :contains "List-ID" "ietf" {
      deleteheader :matches "Subject" "[ietf] *";
      deleteheader :matches "Subject" "Re: [ietf] *";
      addheader "Subject" "${1}";
   }

another test inside the block is a bit more verbose, but it may be
clearer code.
-- 
Kjetil T.

From: Arnt Gulbrandsen <[email-masked]>
To: Kjetil Torgrim Homme <[email-masked]>
Subject: Re: Three new drafts and a question
Cc: [email-masked]
Date:   Wed, 30 Apr 2003 10:41:04 +0200
Sender: [email-masked]

Kjetil Torgrim Homme writes:
> [Ned Freed]:
>
>>    [Nigel Swinson]:
>>
>>    > One other thing to say is complexity for guis.  If the intention
>>    > is to "replace header" and you have to do this via removeheader
>>    > and addheader, then it becomes much more difficult to "extract"
>>    > from the script.
>
> good point. most GUI's will only need to understand their own Sieve code,

Oh?

When a program is about to parse a sieve script, it cannot know whether 
that script was written by itself. Right? That's more or less a design 
decision. There's nothing like the postscript Creator field in sieve.

Because of that, a program cannot enable or disable its 'parse existing 
sieve script' command depending on who wrote the sieve script.

> but it is important that the constructs we provide lend themselves 
> easily to common idioms.

Agree wholeheartedly.

--Arnt

From: Marc Mutz <[email-masked]>
Organization: "Old Europe" - and proud
To: [email-masked]
Subject: Re: Three new drafts and a question
Date: Wed, 30 Apr 2003 10:11:02 +0200
Sender: [email-masked]

--Boundary-02=_XU4r+KZV4u61h4M
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Description: signed data
Content-Disposition: inline

On Wednesday 30 April 2003 01:22, [email-masked] wrote:
<snip>
> That's not an excuse for turning sieve so heavy that many if not most
> service providers will be unwilling to provide support for it.
<snip>

Not every ISP will want to support all Sieve extensions. They don't need=20
to. Many ISP will probably refrain from allowing regex use, of=20
variables, for that matter. I think it's perfectly OK to create Sieve=20
extensions that are explicitely not suitable for all Sieve use cases.=20
E.g. the envelope extension can't be used in MUAs since that=20
information in general is lost on final delivery. OTOH, people will=20
want to have execute command/play sound actions (the latter could be=20
added to notify) on the client.

I agree, though, that the I-Ds currently floating around should first be=20
advanced to RFCs before proposing even more extensions. It's a bit too=20
much currently ;-)

Marc

=2D-=20
They [RIAA,MPAA] are trying to invent a new crime:
interference with a business model.
                           --Bruce Schneier, Crypto-Gram 08/2002

--Boundary-02=_XU4r+KZV4u61h4M
Content-Type: application/pgp-signature
Content-Description: signature

--Boundary-02=_XU4r+KZV4u61h4M--

From: Marc Mutz <[email-masked]>
Organization: "Old Europe" - and proud
To: [email-masked]
Subject: Re: Three new drafts and a question
Date: Wed, 30 Apr 2003 09:43:19 +0200
Sender: [email-masked]

--Boundary-02=_r63r+yVSx+2/oyf
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Description: signed data
Content-Disposition: inline

On Wednesday 30 April 2003 01:07, Kjetil Torgrim Homme wrote:
<snip>
> I know you wanted a failed match to not influence the numeric
> variables, Ned, it seems like you were right.
<snip>

Well, _obviously_ this particular problem stems from unconditionally=20
executing deleteheader+addheader. The correct way to do this would be:

if header :matches "Subject" "[ietf] *" {
	deleteheader "Subject";
	addheader "Subject" "${1}";
}

Marc

=2D-=20
If free-software authors lose the right to disclaim all warranties and
find themselves getting sued over the performance of the programs
they've written, they'll stop contributing free software to the world.
 -- Bruce Perens: Open Sources: Voices from the Open Source Revolution

--Boundary-02=_r63r+yVSx+2/oyf
Content-Type: application/pgp-signature
Content-Description: signature

--Boundary-02=_r63r+yVSx+2/oyf--

Date: Tue, 29 Apr 2003 18:01:19 -0700 (PDT)
From: [email-masked]
Subject: Re: variables: greedy or non-greedy matching
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> [Ned Freed]:
> >
> >   [Jutta Degener]:
> >   > So let's stay greedy; thanks for setting me straight!
> >
> >   No problem ;-) And let's also remember that a necessary corollary
> >   here is that the regexp we end up choosing needs to support both
> >   greedy and non-greedy matching.

> why?  I thought we only needed that if :matches was non-greedy.

> I wouldn't mind having non-greedy regexps, but they're not in POSIX.2
> which the regex draft refers to.

Jutta's argument, which I believe is valid, is that expectations can only
be met by having both types available. As for the reference to POSIX, I thought
that had already been determined to be unsufficient and there was a suggestion
to replace it with something else (ECMAScript maybe?).

				Ned

To: [email-masked]
Cc: [email-masked]
Subject: Re: Three new drafts and a question
From: Kjetil Torgrim Homme <[email-masked]>
Date: 30 Apr 2003 02:02:21 +0200
Lines: 23
Sender: [email-masked]

[Ned Freed]:
>
>   [Kjetil T Homme]:
>   > I do feel that keeping the header name separate is best, if only for
>   > consistency with deleteheader and replaceheader.
>   
>   Consistency with header is actually more important IMO.

agreed, but I don't think a list of header names is very useful.  the
following is the best I can come up with :-)

    addheader ["Precedence", "X-Priority"] "cosmic top important";

>   [...] it begs the question of why deleteheader/addheader aren't
>   sufficient in the same way that a sequence of addheader actions is
>   sufficient to avoid the use of lists in addheader.

the only point I can see in favour of keeping replaceheader, is
Nigel's (general) point on idioms for GUIs.  and it doesn't seem very
compelling here.

-- 
Kjetil T.

Date: Tue, 29 Apr 2003 16:29:20 -0700 (PDT)
From: [email-masked]
Subject: Re: Three new drafts and a question
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked], [email-masked]
Sender: [email-masked]

> [Ned Freed]:
> >
> >   > I don't follow.  could you write an example?
> >
> >   addheader ["Comment: 1", "Comment: 2"];

> I don't like mixing the header name and the content.  I don't see what
> this buys you compared to two calls to addheader.

OK, I'm now convinced this was a bad idea on my part. Having multiple
addheaders also seems preferable to me given that we don't really want
to encourage wholesalle header additions.

> >   > list of header names makes sense with deleteheader, but for
> >   > addheader I think it makes more sense to only support a list of
> >   > values.
> >   >
> >   >   addheader "Comment" ["1", "2"];
> >
> >   Ick. This merely adds complexity without actually adding the issue:
> >
> >   addheader ["Comment: 1", "Content-description: 2"];

> see above :-).  adding two instances of a header is very uncommon, so
> it's not a very useful feature.  it's more of a general design
> principle: do we want to support lists rather than single strings
> wherever we can give the action a useful meaning?

> I do feel that keeping the header name separate is best, if only for
> consistency with deleteheader and replaceheader.

Consistency with header is actually more important IMO.

> >   I think replaceheader is too complex. Think for a bit about the
> >   right way to handle modifications to encoded words. It gets very
> >   very nasty in a great big hurry.  For example, suppose I have an
> >   encoded-word in iso-8859-1

> "invisible" to Sieve.  the string will be in Unicode.

Yes, that's one way to implement it, and probably the approach I'd take. But
now when you apply replaceheader it ends up affecting parts of the field that
weren't specified in the action. Least astonishment principle and all that.

Of course a deleteheader/addheader sequence has the same characteristics.
But in this case it is very clear that the old header is gone and has 
been replaced with something else.

> >   and I use replaceheader to change an a with an accent grave to an
> >   a with an ogonek.  What does the result look like?  Are adjacent
> >   encoded-words affected? Should they be?

> I think a fresh re-encoding is the way to go.  regrettably there are
> some clients with limited support for charsets, so it would be nice if
> the Sieve implementation tried to use the same charset as was used
> originally, if only one charset suffices.  encoding it all as UTF-8
> should be good enough, though.  remember that the user must explicitly
> request this munging.  if his e-mail client can't handle it, he should
> turn it off.

I agree with this implementation choice, but it begs the question of why
deleteheader/addheader aren't sufficient in the same way that
a sequence of addheader actions is sufficient to avoid the use of lists
in addheader.

				Ned

Date: Tue, 29 Apr 2003 16:22:28 -0700 (PDT)
From: [email-masked]
Subject: Re: Three new drafts and a question
To: Simon Josefsson <[email-masked]>
Cc: [email-masked], Marc Mutz <[email-masked]>, [email-masked]
Sender: [email-masked]

> [email-masked] writes:

> >> Deleteheader/addheader will likely not maintain sort order, but a
> >> replaceheader ought to (which is useful).
> >
> >> I agree it is complex, but I have always wanted Sieve to be a real
> >> language (= complex) so I don't consider that a problem.
> >
> > This is not a desire I share. In fact one of the original design goals of sieve
> > was that it not be "a real language". If I want a real language I'll use one.
> > There are plenty of them around; no need to invent another.

> The only standardized language, used for mail handling, which has
> multi-vendor support in MUAs and MTAs, that I know of, is Sieve.
> There are not plenty of them around.

That's not an excuse for turning sieve so heavy that many if not most service
providers will be unwilling to provide support for it.

> I agree with you that there is no need to invent another language,
> fortunately, but my reason is that I believe Sieve is being enhanced
> into a complex language.

Not if I have anything to say about it.

				Ned

To: [email-masked]
Subject: Re: variables: greedy or non-greedy matching
From: Kjetil Torgrim Homme <[email-masked]>
Date: 30 Apr 2003 01:13:50 +0200
Lines: 16
Sender: [email-masked]

[Ned Freed]:
>
>   [Jutta Degener]:
>   > So let's stay greedy; thanks for setting me straight!
>   
>   No problem ;-) And let's also remember that a necessary corollary
>   here is that the regexp we end up choosing needs to support both
>   greedy and non-greedy matching.

why?  I thought we only needed that if :matches was non-greedy.

I wouldn't mind having non-greedy regexps, but they're not in POSIX.2
which the regex draft refers to.

-- 
Kjetil T.

To: [email-masked]
Subject: Re: Three new drafts and a question
From: Kjetil Torgrim Homme <[email-masked]>
Date: 30 Apr 2003 01:07:02 +0200
Lines: 64
Sender: [email-masked]

[Ned Freed]:
>   [Nigel Swinson]:

>   > One other thing to say is complexity for guis.  If the intention
>   > is to "replace header" and you have to do this via removeheader
>   > and addheader, then it becomes much more difficult to "extract"
>   > from the script.

good point.  most GUI's will only need to understand their own Sieve
code, but it is important that the constructs we provide lend
themselves easily to common idioms.

>   > The intention being to populate a control that has an array of
>   > desired actions, one of which is "Prepend the following
>   > substring to the Subject line".
>   >
>   > ie either:
>   >
>   > if spamtest :value "ge" :comparator "i;ascii-numeric" "3" {
>   >     replaceheader :newvalue "[SPAM] ${1}" :matches "Subject" "*";
>   > }
>   >
>   > or:
>   >
>   > if spamtest :value "ge" :comparator "i;ascii-numeric" "3" {
>   >     deleteheader :matches "Subject" "*";
>   >     addheader "Subject" "[SPAM] ${1}";
>   > }
>   
>   I actually prefer the second. It makes it clear a new header is
>   being generated with all that implies (changes to encoded words,
>   etc.). The former implies that the operation may only be a simple
>   prepend. The world isn't this simple.

Nigel's second example is quite clever.  the reverse, removing a
prefix, exposes unintuitive behaviour in my draft, though:

    deleteheader :matches "Subject" "[ietf] *";
    addheader "Subject" "${1}";
    fileinto "INBOX.lists.ietf";

consider this message:

    Subject: [ietf] meeting on Thursday
    Subject: buggy header

the result will actually be:

    Subject: buggy header
    Subject: 

since the failed match will empty the numeric variables.  two Subject
headers is a bit obscure, so a better example may be:

    deleteheader :matches "Subject" "[ietf] *";
    deleteheader :matches "Subject" "Re: [ietf] *";
    addheader "Subject" "${1}";

I know you wanted a failed match to not influence the numeric
variables, Ned, it seems like you were right.

-- 
Kjetil T.

To: [email-masked]
Cc: [email-masked]
Subject: Re: Three new drafts and a question
From: Kjetil Torgrim Homme <[email-masked]>
Date: 30 Apr 2003 00:52:06 +0200
Lines: 48
Sender: [email-masked]

[Ned Freed]:
>
>   > I don't follow.  could you write an example?
>   
>   addheader ["Comment: 1", "Comment: 2"];

I don't like mixing the header name and the content.  I don't see what
this buys you compared to two calls to addheader.

>   > list of header names makes sense with deleteheader, but for
>   > addheader I think it makes more sense to only support a list of
>   > values.
>   >
>   >   addheader "Comment" ["1", "2"];
>   
>   Ick. This merely adds complexity without actually adding the issue:
>   
>   addheader ["Comment: 1", "Content-description: 2"];

see above :-).  adding two instances of a header is very uncommon, so
it's not a very useful feature.  it's more of a general design
principle: do we want to support lists rather than single strings
wherever we can give the action a useful meaning?

I do feel that keeping the header name separate is best, if only for
consistency with deleteheader and replaceheader.

>   I think replaceheader is too complex. Think for a bit about the
>   right way to handle modifications to encoded words. It gets very
>   very nasty in a great big hurry.  For example, suppose I have an
>   encoded-word in iso-8859-1

"invisible" to Sieve.  the string will be in Unicode.

>   and I use replaceheader to change an a with an accent grave to an
>   a with an ogonek.  What does the result look like?  Are adjacent
>   encoded-words affected? Should they be?

I think a fresh re-encoding is the way to go.  regrettably there are
some clients with limited support for charsets, so it would be nice if
the Sieve implementation tried to use the same charset as was used
originally, if only one charset suffices.  encoding it all as UTF-8
should be good enough, though.  remember that the user must explicitly
request this munging.  if his e-mail client can't handle it, he should
turn it off.

-- 
Kjetil T.

To: [email-masked]
Cc: Marc Mutz <[email-masked]>, [email-masked]
Subject: Re: Three new drafts and a question
From: Simon Josefsson <[email-masked]>
Date: Wed, 30 Apr 2003 00:25:54 +0200
Sender: [email-masked]

[email-masked] writes:

>> Deleteheader/addheader will likely not maintain sort order, but a
>> replaceheader ought to (which is useful).
>
>> I agree it is complex, but I have always wanted Sieve to be a real
>> language (= complex) so I don't consider that a problem.
>
> This is not a desire I share. In fact one of the original design goals of sieve
> was that it not be "a real language". If I want a real language I'll use one.
> There are plenty of them around; no need to invent another.

The only standardized language, used for mail handling, which has
multi-vendor support in MUAs and MTAs, that I know of, is Sieve.
There are not plenty of them around.

I agree with you that there is no need to invent another language,
fortunately, but my reason is that I believe Sieve is being enhanced
into a complex language.

Date: Tue, 29 Apr 2003 08:32:08 -0700 (PDT)
From: [email-masked]
Subject: Re: Three new drafts and a question
To: Nigel Swinson <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> > > Please explain why you cannot use deleteheader/addheader for this.
> >
> > I don't think this is the example Marc had in mind, but anyway:

> One other thing to say is complexity for guis.  If the intention is to
> "replace header" and you have to do this via removeheader and addheader,
> then it becomes much more difficult to "extract" from the script.  The
> intention being to populate a control that has an array of desired actions,
> one of which is "Prepend the following substring to the Subject line".

> ie either:

> if spamtest :value "ge" :comparator "i;ascii-numeric" "3" {
>     replaceheader :newvalue "[SPAM] ${1}" :matches "Subject" "*";
> }

> or:

> if spamtest :value "ge" :comparator "i;ascii-numeric" "3" {
>     deleteheader :matches "Subject" "*";
>     addheader "Subject" "[SPAM] ${1}";
> }

I actually prefer the second. It makes it clear a new header is being
generated with all that implies (changes to encoded words, etc.). The
former implies that the operation may only be a simple prepend. The 
world isn't this simple.

				Ned

Date: Tue, 29 Apr 2003 08:28:31 -0700 (PDT)
From: [email-masked]
Subject: Re: Three new drafts and a question
To: Marc Mutz <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

Content-transfer-encoding: 7BIT

> <snip>
> > I'm afraid I don't find this to be a credible example. Sieve is
> > intended to be a language used in or around delivery time so users
> > can exercise some control over delivery processing. It is not
> > intended to be a general purpose message alteration facility.
> <snip>

> It isn't? The whitepaper mentions not only final delivery uses, but also
> periodic sweeps through a message store for administrative purposes
> (aka cron jobs) as well as client-side filtering.

This was for filtering and redirection purposes, not for message alteration.

> Esp. the editheader draft is one that is mandatory for client-side
> filtering, b/c many clients provide that functionality now and it is
> used where offered.

> I'd even welcome a shell-out (execute_command/pipe_trough) extension,
> even if it was never ever implemented on a server (and shouldn't), but
> only in clients and local tools (like GNU mailutils' sieve).

I object in the strongest possible terms to this.

				Ned

From: "Nigel Swinson" <[email-masked]>
To: <[email-masked]>
Subject: Re: Three new drafts and a question
Date: Tue, 29 Apr 2003 10:52:23 +0100
Sender: [email-masked]

> > Please explain why you cannot use deleteheader/addheader for this.
>
> I don't think this is the example Marc had in mind, but anyway:

One other thing to say is complexity for guis.  If the intention is to
"replace header" and you have to do this via removeheader and addheader,
then it becomes much more difficult to "extract" from the script.  The
intention being to populate a control that has an array of desired actions,
one of which is "Prepend the following substring to the Subject line".

ie either:

if spamtest :value "ge" :comparator "i;ascii-numeric" "3" {
    replaceheader :newvalue "[SPAM] ${1}" :matches "Subject" "*";
}

or:

if spamtest :value "ge" :comparator "i;ascii-numeric" "3" {
    deleteheader :matches "Subject" "*";
    addheader "Subject" "[SPAM] ${1}";
}

Cheers

Nigel

From: Marc Mutz <[email-masked]>
Organization: "Old Europe" - and proud
To: [email-masked]
Subject: Re: Three new drafts and a question
Date: Tue, 29 Apr 2003 10:14:18 +0200
Sender: [email-masked]

--Boundary-02=_nRjr+1/9uI82Jxk
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Description: signed data
Content-Disposition: inline

On Tuesday 29 April 2003 04:42, [email-masked] wrote:
<snip>
> I'm afraid I don't find this to be a credible example. Sieve is
> intended to be a language used in or around delivery time so users
> can exercise some control over delivery processing. It is not
> intended to be a general purpose message alteration facility.
<snip>

It isn't? The whitepaper mentions not only final delivery uses, but also=20
periodic sweeps through a message store for administrative purposes=20
(aka cron jobs) as well as client-side filtering.

Esp. the editheader draft is one that is mandatory for client-side=20
filtering, b/c many clients provide that functionality now and it is=20
used where offered.

I'd even welcome a shell-out (execute_command/pipe_trough) extension,=20
even if it was never ever implemented on a server (and shouldn't), but=20
only in clients and local tools (like GNU mailutils' sieve).

Marc

=2D-=20
Eternal vigilance is the price of liberty   -- Thomas Jefferson

--Boundary-02=_nRjr+1/9uI82Jxk
Content-Type: application/pgp-signature
Content-Description: signature

--Boundary-02=_nRjr+1/9uI82Jxk--

Date: Mon, 28 Apr 2003 19:42:21 -0700 (PDT)
From: [email-masked]
Subject: Re: Three new drafts and a question
To: Simon Josefsson <[email-masked]>
Cc: [email-masked], Marc Mutz <[email-masked]>, [email-masked]
Sender: [email-masked]

> [email-masked] writes:

> >> On Sunday 27 April 2003 19:17, [email-masked] wrote:
> >> <snip>
> >> > I think replaceheader is too complex.
> >
> >> But it's needed in the real world. Adding/removing the [mailing list]
> >> tag to/from the subject line and fixing mangled/mangling reply-to
> >> headers is popular among people who need to handle large (or large
> >> amounts of) mailing list traffic.
> >
> > Please explain why you cannot use deleteheader/addheader for this.

> I don't think this is the example Marc had in mind, but anyway:

> Consider if you want to replace the obscure MTA identification strings
> in Received: headers with the full name of the MTA product.

I'm afraid I don't find this to be a credible example. Sieve is intended to be
a language used in or around delivery time so users can exercise some control
over delivery processing. It is not intended to be a general purpose message
alteration facility.

> Deleteheader/addheader will likely not maintain sort order, but a
> replaceheader ought to (which is useful).

> I agree it is complex, but I have always wanted Sieve to be a real
> language (= complex) so I don't consider that a problem.

This is not a desire I share. In fact one of the original design goals of sieve
was that it not be "a real language". If I want a real language I'll use one.
There are plenty of them around; no need to invent another.

				Ned

From: Marc Mutz <[email-masked]>
Organization: "Old Europe" - and proud
To: [email-masked]
Subject: Re: Three new drafts and a question
Date: Tue, 29 Apr 2003 02:38:20 +0200
Sender: [email-masked]

--Boundary-02=_9lcr+wtNFQGeQTq
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Description: signed data
Content-Disposition: inline

On Tuesday 29 April 2003 01:43, [email-masked] wrote:
<snip>
> Please explain why you cannot use deleteheader/addheader for this.
<snip>

OK, if the variables extension is present, you can of course emulate=20
this with a :regex/:matches test and a deleteheader/addheader pair.

If the variables extension isn't available, the replaceheader itself is=20
pretty limited, too, since
  replaceheader :newvalue "" :regex "Subject" "^\[ml-name\] *";
doesn't work (should it? Probably, since without it, how does one write=20
the equivalent of perl's s///g?).

The arguments that remains, then, is that replaceheader is easier to=20
write for a script author and that it can't be that complex if it's=20
functionality is already present in addheader/deleteheader/variables...=20
In addition, replaceheader :index <num> has no equivalent due to lack=20
of indexing support in the header test.

Marc

=2D-=20
The first casualty of war is the truth.

--Boundary-02=_9lcr+wtNFQGeQTq
Content-Type: application/pgp-signature
Content-Description: signature

--Boundary-02=_9lcr+wtNFQGeQTq--

To: [email-masked]
Cc: Marc Mutz <[email-masked]>, [email-masked]
Subject: Re: Three new drafts and a question
From: Simon Josefsson <[email-masked]>
Date: Tue, 29 Apr 2003 02:33:23 +0200
Sender: [email-masked]

[email-masked] writes:

>> On Sunday 27 April 2003 19:17, [email-masked] wrote:
>> <snip>
>> > I think replaceheader is too complex.
>
>> But it's needed in the real world. Adding/removing the [mailing list]
>> tag to/from the subject line and fixing mangled/mangling reply-to
>> headers is popular among people who need to handle large (or large
>> amounts of) mailing list traffic.
>
> Please explain why you cannot use deleteheader/addheader for this.

I don't think this is the example Marc had in mind, but anyway:

Consider if you want to replace the obscure MTA identification strings
in Received: headers with the full name of the MTA product.

Deleteheader/addheader will likely not maintain sort order, but a
replaceheader ought to (which is useful).

I agree it is complex, but I have always wanted Sieve to be a real
language (= complex) so I don't consider that a problem.

Date: Mon, 28 Apr 2003 16:43:02 -0700 (PDT)
From: [email-masked]
Subject: Re: Three new drafts and a question
To: Marc Mutz <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> On Sunday 27 April 2003 19:17, [email-masked] wrote:
> <snip>
> > I think replaceheader is too complex.

> But it's needed in the real world. Adding/removing the [mailing list]
> tag to/from the subject line and fixing mangled/mangling reply-to
> headers is popular among people who need to handle large (or large
> amounts of) mailing list traffic.

Please explain why you cannot use deleteheader/addheader for this.

> > Think for a bit about the right
> > way to handle modifications to encoded words. It gets very very nasty
> > in a great big hurry.  For example, suppose I have an encoded-word in
> > iso-8859-1 and I use replaceheader to change an a with an accent
> > grave to an a with an ogonek. What does the result look like? Are
> > adjacent encoded-words affected? Should they be?

> The base Sieve spec deals with recognizing encoded-words and IMO all
> that this extension needs to say is that if the result of the
> replaceheader action needs encoding, the Sieve implementation MUST do
> so.

This is not even close to sufficient. The interaction with existing
encoded words also has to be considered.

> The _how_ is up to the implementation and can range from re-encoding
> only the affected (encoded-)words using a minimal charset (for a
> certain definition of that) to brutally encoding the whole result in
> =?utf-8?b?...?= chunks unconditionally.

A cure that is worse than the disease given the state of many clients today.

> One could add a :preferred_charsets option that takes a stringlist as
> parameter, but I think that's hacky. One could specify a preferred
> algorithm that SHOULD be followed along the lines of

> 1. Only touch encoded-words that are affected.
> 2. If the affected portions of the result are US-ASCII, remove the
> encoding, else
> 3. If the affected portions of the result can be represented in one of
> the charsets already used in encoded-words in the original form of the
> header, encode using that charset, else
> 4. If they can be represented in iso-8859-1 or the server's locale
> charset or any site-defined sorted list of charsets, use the best
> (latin-1, locale, first in the list), else
> 5. use utf-8.

Yeah, and given past experience with encoded-word handling, how many
implementations do you think are going to get this right?

> but I don't see the need to require a particular behavior when encoding.

I'm afraid I do.

					Ned

From: Marc Mutz <[email-masked]>
Organization: "Old Europe" - and proud
To: [email-masked]
Subject: Re: Three new drafts and a question
Date: Mon, 28 Apr 2003 20:02:24 +0200
Sender: [email-masked]

--Boundary-02=_GzWr+qbD4GTuKu5
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Description: signed data
Content-Disposition: inline

On Sunday 27 April 2003 19:17, [email-masked] wrote:
<snip>
> I think replaceheader is too complex.

But it's needed in the real world. Adding/removing the [mailing list]=20
tag to/from the subject line and fixing mangled/mangling reply-to=20
headers is popular among people who need to handle large (or large=20
amounts of) mailing list traffic.

> Think for a bit about the right
> way to handle modifications to encoded words. It gets very very nasty
> in a great big hurry.  For example, suppose I have an encoded-word in
> iso-8859-1 and I use replaceheader to change an a with an accent
> grave to an a with an ogonek. What does the result look like? Are
> adjacent encoded-words affected? Should they be?

The base Sieve spec deals with recognizing encoded-words and IMO all=20
that this extension needs to say is that if the result of the=20
replaceheader action needs encoding, the Sieve implementation MUST do=20
so.

The _how_ is up to the implementation and can range from re-encoding=20
only the affected (encoded-)words using a minimal charset (for a=20
certain definition of that) to brutally encoding the whole result in=20
=3D?utf-8?b?...?=3D chunks unconditionally.

One could add a :preferred_charsets option that takes a stringlist as=20
parameter, but I think that's hacky. One could specify a preferred=20
algorithm that SHOULD be followed along the lines of

1. Only touch encoded-words that are affected.
2. If the affected portions of the result are US-ASCII, remove the=20
encoding, else
3. If the affected portions of the result can be represented in one of=20
the charsets already used in encoded-words in the original form of the=20
header, encode using that charset, else
4. If they can be represented in iso-8859-1 or the server's locale=20
charset or any site-defined sorted list of charsets, use the best=20
(latin-1, locale, first in the list), else
5. use utf-8.

but I don't see the need to require a particular behavior when encoding.

Marc

=2D-=20
Silent leges inter arma      -- Cicero

--Boundary-02=_GzWr+qbD4GTuKu5
Content-Type: application/pgp-signature
Content-Description: signature

--Boundary-02=_GzWr+qbD4GTuKu5--

Date: Mon, 28 Apr 2003 10:48:06 -0700
From: Jutta Degener <[email-masked]>
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Subject: Re: Three new drafts and a question
Sender: [email-masked]

On Sat, Apr 26, 2003 at 11:54:44PM +0200, Kjetil Torgrim Homme wrote:
> [Ned Freed]:
> >   [Jutta Degener]:
> >   > [editheader]
> 
> interesting, the draft says "replaceheader".  "editheader" is a better
> name, especially if :newname goes away.

The extension is "editheader",  comprising the three commands
"addheader", "deleteheader", and "replaceheader".

>   addheader "Comment" ["1", "2"];

Sorry, but I'd rather stick to simple name/value pairs.

> this might be an issue for the variables draft, it could say that the
> search must be short-circuited (given, but perhaps not strongly enough
> worded in existing documents), and the search done in first to last
> order.  would that be appropriate?

I'd rather leave it undefined, so that people have more freedom
in how to implement their search.  If a script writer needs a
specific order, they can always force it by separating the statements.

Jutta

Date: Sun, 27 Apr 2003 13:33:49 -0700 (PDT)
From: [email-masked]
Subject: Re: variables: greedy or non-greedy matching
To: Jutta Degener <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> On Thu, Apr 24, 2003 at 07:14:43AM -0700, [email-masked] wrote:
> > Um, no. For the very small subset of users sophisticated enough to
> > write this sort of code themselves, I believe their expectation will
> > be set by past experience with other matching systems, and these
> > systems tend to default to greedy matching.

> I think even in that sophisticated subset, most people just live
> their pattern-matching lives without really thinking about the
> difference.

> But admittedly, my own expectations are muddy, and, worse,
> seem to change with the lexical structure of the pattern.
> Speaking naively -- I know that this isn't how things work
> or should work --

> * If the end of my pattern is part of a grammatical whole, I want
>   the wildcard to  be greedy; certainly, I, too, would expect
>   "f*o" to fully match "foo", not to stop after the first "o".

> * But if the end of my pattern is a delimiter, I tend to implicitly
>   expect the expression be defined as something that doesn't
>   contain that delimiter, as in the example Kjetil quoted where few
>   people would expect the * before a closing > in an e-mail address
>   to itself contain another >.

> I think what this all says is that what felt to me like a problem
> with greed is really a problem with globbing and insufficient
> expressiveness of * (regexps have problems, too, once you get
> to comments and quoting, but one has to work a little harder to
> make things fail.)

> So let's stay greedy; thanks for setting me straight!

No problem ;-) And let's also remember that a necessary corollary here
is that the regexp we end up choosing needs to support both greedy and
non-greedy matching.

				Ned

Date: Sun, 27 Apr 2003 10:17:49 -0700 (PDT)
From: [email-masked]
Subject: Re: Three new drafts and a question
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> [Ned Freed]:
> >   [Jutta Degener]:
> >   > [editheader]

> interesting, the draft says "replaceheader".  "editheader" is a better
> name, especially if :newname goes away.

> >   > [Ned Freed]:
> >   > >     I prefer the approach of having a single argument,
> >   > >     which can either be a string specifying a single field or a list
> >   > >     specifying multiple fields.
> >   >
> >   > Hm, you mean a real ["foo", "bar"] list, or a chunk of text
> >   > that becomes the header?
> >
> >   I mean ["Comment: 1", "Comment: 2"].

> I don't follow.  could you write an example?

addheader ["Comment: 1", "Comment: 2"];

> list of header names makes sense with deleteheader, but for addheader
> I think it makes more sense to only support a list of values.

>   addheader "Comment" ["1", "2"];

Ick. This merely adds complexity without actually adding the issue:

addheader ["Comment: 1", "Content-description: 2"];

> you could do a list of header names with replaceheader as well, but
> the counting is a bit tricky, and I think it's complex enough already.
> you can always do N separate replaceheader instead.

I think replaceheader is too complex. Think for a bit about the right way to
handle modifications to encoded words. It gets very very nasty in a great big
hurry.  For example, suppose I have an encoded-word in iso-8859-1 and I use
replaceheader to change an a with an accent grave to an a with an ogonek.
What does the result look like? Are adjacent encoded-words affected? Should
they be?

> >   Good point. Even if we retain replaceheader I'd argue that
> >   :newname should go. You can always get the effect by deleting and
> >   adding.

> if there is only one header, yes.

>    if header "Message-ID" :matches "<*@*>" {
>        deleteheader "Message-ID";
>        addheader "Old-Message-ID" "<${1}@${2}>";
>        addheader "Message-ID" "<[email-masked]>";
>    }

> if there is more than one instance of a header, you can't get at one
> of them in particular.  the content in ${N} could be from the first or
> last or a random one.

This argues for adding index capabilites to header, which is something we
need independently of this facility.

> this might be an issue for the variables draft, it could say that the
> search must be short-circuited (given, but perhaps not strongly enough
> worded in existing documents), and the search done in first to last
> order.  would that be appropriate?

I have no problem with nailing down first to last scanning order for multiple
versions of the same field. But keep in mind that this doesn't solve the entire
problem: You can potentially have three iterates in a header operation: A list
of field names, a list of field values, and more then one instance of a given
field. I suspect different implementations organize their iterates differently
(I iterate on field, field instance and finally field value myself). I don't
think we want to mandate a particular way of ordering  the iterates.

Of course you can work around the iteration order by using simpler tests,
whereas you can't work around the problem of multiple fields other than
by specifying the short-circuit behavior to some extent.

				Ned

To: [email-masked]
Subject: Re: Three new drafts and a question
From: Kjetil Torgrim Homme <[email-masked]>
Date: 26 Apr 2003 23:54:44 +0200
Lines: 52
Sender: [email-masked]

[Ned Freed]:
>   [Jutta Degener]:
>   > [editheader]

interesting, the draft says "replaceheader".  "editheader" is a better
name, especially if :newname goes away.

>   > [Ned Freed]:
>   > >     I prefer the approach of having a single argument,
>   > >     which can either be a string specifying a single field or a list
>   > >     specifying multiple fields.
>   >
>   > Hm, you mean a real ["foo", "bar"] list, or a chunk of text
>   > that becomes the header?
>   
>   I mean ["Comment: 1", "Comment: 2"].

I don't follow.  could you write an example?

list of header names makes sense with deleteheader, but for addheader
I think it makes more sense to only support a list of values.

  addheader "Comment" ["1", "2"];

you could do a list of header names with replaceheader as well, but
the counting is a bit tricky, and I think it's complex enough already.
you can always do N separate replaceheader instead.

>   Good point. Even if we retain replaceheader I'd argue that
>   :newname should go. You can always get the effect by deleting and
>   adding.

if there is only one header, yes.

   if header "Message-ID" :matches "<*@*>" {
       deleteheader "Message-ID";
       addheader "Old-Message-ID" "<${1}@${2}>";
       addheader "Message-ID" "<[email-masked]>";
   }

if there is more than one instance of a header, you can't get at one
of them in particular.  the content in ${N} could be from the first or
last or a random one.

this might be an issue for the variables draft, it could say that the
search must be short-circuited (given, but perhaps not strongly enough
worded in existing documents), and the search done in first to last
order.  would that be appropriate?

-- 
Kjetil T.

Date: Fri, 25 Apr 2003 15:55:52 -0700
From: Jutta Degener <[email-masked]>
To: [email-masked]
Subject: Soure routes vs. "address" (was: Re: request for clarification)
Sender: [email-masked]

On Fri, Apr 25, 2003 at 03:03:36PM -0700, Philip Guenther explains:
> 
> The "@foo.com,@bar.com:" part is a source route.  The Sieve rfc is just
> saying that tests must act as if the address didn't include the source
> route when determining whether they match.

Hm!  Now that you mention it, the fact that RFC 3028 says that about
_envelope_ addresses only and not about _all_ e-mail addresses (that is,
also the ones used with "address") seems like an omission to me.

The text about the "address" test excludes comments and groups from the
comparison, but doesn't mention source routes:

#  The address primitive never acts on the phrase part of an email
#  address, nor on comments within that address.  It also never acts on
#  group names, although it does act on the addresses within the group
#  construct.

Source routes are part of the RFC 2822 "obs-angle-addr" nonterminal,
and RFC 2822 asks that they be ignored:

#  When interpreting addresses, the route portion SHOULD be ignored.

Is there any reason not to always throw out the source route?

Jutta

To: Keith Grennan <[email-masked]>
Cc: [email-masked]
From: Philip Guenther <[email-masked]>
Subject: Re: request for clarification "MUST drop source routes" 
Date: Fri, 25 Apr 2003 15:03:36 -0700
Sender: [email-masked]

Keith Grennan <[email-masked]> writes:
>I was wondering if someone could expand on the following:
>
>All tests against envelopes MUST drop source routes.
>
>What is a "source route" in this context and how does one drop it?

These are described in rfc2821.  An example would be:
	<@foo.com,@bar.com:[email-masked]>

The "@foo.com,@bar.com:" part is a source route.  The Sieve rfc is just
saying that tests must act as if the address didn't include the source
route when determining whether they match.  So, if the above address
occured in the envelope 'to', then the test

	envelope :all :contains "to" "foo.com"

must fail, while the test

	envelope :all :is "[email-masked]"

must succeed.

Philip Guenther
[email-masked]

Subject: request for clarification "MUST drop source routes"
From: Keith Grennan <[email-masked]>
To: [email-masked]
Organization: 
Date: 25 Apr 2003 14:13:17 -0700
Sender: [email-masked]

Hi,

I was wondering if someone could expand on the following:

All tests against envelopes MUST drop source routes.

What is a "source route" in this context and how does one drop it?

Thanks,
Keith

Date: Thu, 24 Apr 2003 21:20:54 -0700 (PDT)
From: [email-masked]
Subject: Re: Three new drafts and a question
To: Jutta Degener <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> On Thu, Apr 24, 2003 at 11:08:49AM -0700, [email-masked] wrote:
> [editheader]
> >     I prefer the approach of having a single argument,
> >     which can either be a string specifying a single field or a list
> >     specifying multiple fields.

> Hm, you mean a real ["foo", "bar"] list, or a chunk of text
> that becomes the header?

I mean ["Comment: 1", "Comment: 2"].

> If you're using ["foo", "bar"], you'll quickly run into the
> lack of list operations and -variables.

I don't think so. But we can handle that fairly easily by saying empty
strings add nothing.

> If you're using a big chunk of text, I think it will still have
> to be parsed into names and values and checked or, more likely,
> reformatted.  I don't like doing that, not so much for efficiency
> reasons but because it pretends to the script writer that they're
> touching the true outgoing header when I really can't let them
> do that.

I agree. I don't think the chunk of text approach is appropriate.

> Do you have a usage scenario where a single string vs. multiple
> makes a big difference?

Not really. It just looks better to have all of the fields added in a
single operation.

> > (2) I sure wish we'd allowed signed integers as numbers in the base sieve
> >     specification. If we had them available we could use negative indices
> >     to represent offsets from the last occurence of a given field.

> Yeah, that would be nice, but I couldn't get it to work either.

OK. Just wanted to check and see if there was something I was missing.

> > (3) I see considerable value in addheader and deleteheader. Replaceheader,
> >     however, goes a bit too far for my tastes. Do we really need this? Is
> >     it worth the complexity?

> The "replaceheader" command started out as a "tagheader" command
> that just gave its user a choice of adding a prefix or a suffix.

> The original audience for this was users with message stores that
> don't support direct fileinto.  They can tag their messages by adding
> or changing the Subject: line, and then filter based on the Subject
> line in their browsers.

> Then people wanted an "untagheader" command, and didn't generally
> respond well to the complexity of picking a header vs. the simplicity
> of what I let them do it once they had it, so "replaceheader"
> replaced the "tag" and "untag" versions and got a little more solid.

> We can argue whether :newname has any business being there, though.

Good point. Even if we retain replaceheader I'd argue that :newname should
go. You can always get the effect by deleting and adding.

There's also the question of the interaction of a replaceheader
aimed at the third instance of one field being renamed to a field that
already exists.

> > > <http://www.ietf.org/internet-drafts/draft-degener-sieve-multiscript-00.txt>
> > >
> > > 	Sequential execution of (unrelated) sieve scripts by the
> > > 	environment.  A meta-feature -- it doesn't define new sieve
> > > 	language elements -- that's interesting in particular in
> > > 	contrast to Cyrus's "include" draft.
> >
> > Hmm. The approach taken here is very similar but not quite identical to the
> > approach I've used to combine multiple scripts. We agree in that any script
> > that ends in an implicit keep in effect cedes control to the next script
> > in the sequence, and that the explicit actions reject, fileinto, and
> > redirect that cancel implicit keep prevent subsequent scripts from running.
> >
> > The place where we differ is in the handling of explicit keep. The draft calls
> > for subsequent scripts to be called. I don't do that; in my implementation an
> > explicit keep prevents subsequent scripts from acting.

> Interesting.  I've had some push-back about that, too, where colleagues
> felt (and probably still feel) uncomfortable that the system would react
> to an explicit command with this big-brotheresque "well, you're saying you
> want to keep the message, but what you _really_ may want is to give it the
> default trailing script treatment".

> > I don't think this is something I can change at this point either. One of the
> > things that's often done is to have some kind of filtering in a system-level
> > sieve script. That script may elect to discard a message. I wanted the ability
> > for users to override such system-level decisions by issuing an explicit
> > "keep" in their scripts. This trick got documented and is now in use.

> We'd just have used "fileinto "INBOX"" for that, but okay.  And of
> course you might not have "fileinto".

Good point. Since I implement it I tend to forget it is optional...

> > There's also one semantics issue I see here: RFC 3028 says that fileinto
> > "INBOX" and "keep" are equivalent in an IMAP environment. This specification
> > tweaks that equivalence somewhat.

> Yeah, I know...

> I guess the alternative here is to make explicit keep and implicit
> keep once again behave differently.  That's ugly, but it does seem
> to be closer to expectations.

> Did you ever run into a situation where that gave you trouble --
> where you wished you could have an explicit implicit keep?

I don't believe I ever have. But it is hard to predict what is going to
happen once variables are available. I suspect they are going to
change usage patterns fairly substantially, and it is hard to know which
of these little quirks of the language are going to prove problematic.

				Ned

Date: Thu, 24 Apr 2003 19:19:31 -0700
From: Jutta Degener <[email-masked]>
To: [email-masked]
Subject: Re: Three new drafts and a question
Sender: [email-masked]

On Thu, Apr 24, 2003 at 11:08:49AM -0700, [email-masked] wrote:
[editheader]
>     I prefer the approach of having a single argument,
>     which can either be a string specifying a single field or a list
>     specifying multiple fields.

Hm, you mean a real ["foo", "bar"] list, or a chunk of text
that becomes the header?

If you're using ["foo", "bar"], you'll quickly run into the
lack of list operations and -variables.

If you're using a big chunk of text, I think it will still have
to be parsed into names and values and checked or, more likely,
reformatted.  I don't like doing that, not so much for efficiency
reasons but because it pretends to the script writer that they're
touching the true outgoing header when I really can't let them
do that.

Do you have a usage scenario where a single string vs. multiple
makes a big difference?

> (2) I sure wish we'd allowed signed integers as numbers in the base sieve
>     specification. If we had them available we could use negative indices
>     to represent offsets from the last occurence of a given field.

Yeah, that would be nice, but I couldn't get it to work either.

> (3) I see considerable value in addheader and deleteheader. Replaceheader,
>     however, goes a bit too far for my tastes. Do we really need this? Is
>     it worth the complexity?

The "replaceheader" command started out as a "tagheader" command
that just gave its user a choice of adding a prefix or a suffix.

The original audience for this was users with message stores that
don't support direct fileinto.  They can tag their messages by adding
or changing the Subject: line, and then filter based on the Subject
line in their browsers.

Then people wanted an "untagheader" command, and didn't generally
respond well to the complexity of picking a header vs. the simplicity
of what I let them do it once they had it, so "replaceheader"
replaced the "tag" and "untag" versions and got a little more solid.

We can argue whether :newname has any business being there, though.

> > <http://www.ietf.org/internet-drafts/draft-degener-sieve-multiscript-00.txt>
> > 	
> > 	Sequential execution of (unrelated) sieve scripts by the
> > 	environment.  A meta-feature -- it doesn't define new sieve
> > 	language elements -- that's interesting in particular in
> > 	contrast to Cyrus's "include" draft.
> 
> Hmm. The approach taken here is very similar but not quite identical to the
> approach I've used to combine multiple scripts. We agree in that any script
> that ends in an implicit keep in effect cedes control to the next script
> in the sequence, and that the explicit actions reject, fileinto, and
> redirect that cancel implicit keep prevent subsequent scripts from running.
> 
> The place where we differ is in the handling of explicit keep. The draft calls
> for subsequent scripts to be called. I don't do that; in my implementation an
> explicit keep prevents subsequent scripts from acting.

Interesting.  I've had some push-back about that, too, where colleagues
felt (and probably still feel) uncomfortable that the system would react
to an explicit command with this big-brotheresque "well, you're saying you
want to keep the message, but what you _really_ may want is to give it the
default trailing script treatment".

> I don't think this is something I can change at this point either. One of the
> things that's often done is to have some kind of filtering in a system-level
> sieve script. That script may elect to discard a message. I wanted the ability
> for users to override such system-level decisions by issuing an explicit
> "keep" in their scripts. This trick got documented and is now in use.

We'd just have used "fileinto "INBOX"" for that, but okay.  And of
course you might not have "fileinto".

> There's also one semantics issue I see here: RFC 3028 says that fileinto
> "INBOX" and "keep" are equivalent in an IMAP environment. This specification
> tweaks that equivalence somewhat.

Yeah, I know...

I guess the alternative here is to make explicit keep and implicit
keep once again behave differently.  That's ugly, but it does seem
to be closer to expectations.

Did you ever run into a situation where that gave you trouble --
where you wished you could have an explicit implicit keep?

Jutta

To: [email-masked]
Subject: Re: Three new drafts and a question
From: Kjetil Torgrim Homme <[email-masked]>
Date: 25 Apr 2003 01:08:52 +0200
Lines: 103
Sender: [email-masked]

[Jutta Degener]:
>
>   I sent out three new sieve drafts last week that may be of interest:
>   
>    <http://www.ietf.org/internet-drafts/draft-degener-sieve-copy-00.txt>
>     	
>   	fileinto :copy, redirect :copy -- keyword parameter that
>   	prevents cancelling the implicit "keep".

great idea!  a small typo, quotes are missing around ":copy" in

   Syntax:
        "fileinto" [:copy] <folder: string>
        "redirect" [:copy] <folder: string>

>    <http://www.ietf.org/internet-drafts/draft-degener-sieve-editheader-00.txt>
>     	Deleting, adding, and changing message header fields.

| 5. Action replaceheader
|    [...]
|    The field-name is mandatory and always matched as a
|    case-insensitive us-ascii string.

I take it you mean an exact match (:is) ?  the following shouldn't
work:

   replaceheader "Original-*" :newname "${1}"

but it would be interesting, eh?  actually, :matches could be the
mandatory match type for the field-name, I don't think it influences
the rest.  if you do

   replaceheader "Original-*" :newname "${1}" :matches "*foo" :newvalue "${1}"

this will _not_ work, since the value match will run after the field
name match, and thus destroy the contents of the back references.

btw, it is interesting that this extension requires variable
references in strings to be resolved inside the action itself.  it
makes me wonder if I should add a "Note to implementers" in the
variables draft about this.

| 7. Security Considerations
|    [...]
|    A sieve filter that removes headers may unwisely destroy
|    evidence about the path a header has taken.

perhaps tampering with "Received" should be explicitly forbidden.
(even with that restriction, the above warning must be kept.)

>    <http://www.ietf.org/internet-drafts/draft-degener-sieve-multiscript-00.txt>
>     	
>   	Sequential execution of (unrelated) sieve scripts by the
>   	environment.  A meta-feature -- it doesn't define new sieve
>   	language elements -- that's interesting in particular in
>   	contrast to Cyrus's "include" draft.

yes, I think they both are useful.  this is for site configuration,
"include" is for user convenience.

| 4. Locality of script actions
|    [...]
|    For sieve engines that implement the "variables" extension,
|    variable state is not carried over between scripts.

I think this is the right choice, since a set of scripts using
"include" should be considered _one_ script and variable state thus
carry over in that single script.  this also fits in with:

|    The "stop;" command ends the execution of its single
|    containing script, not of scripts in general.

so the "return" in Cyrus's draft is still useful.

I agree that a capability string is unnecessary.

>   There may or may not be another one for fileinto in the wings.
>   It's about Kjetil's open issue 0.3 b):
>   
>   Some implementations of "fileinto" create IMAP folders on the
>   fly if they don't exist; others don't.  (They redirect to
>   the inbox instead.)  Sieve doesn't proscribe either way.
>   
>   My own implementation used to only reuse existing folders; but now
>   that we're thinking about creating them on demand in conjunction
>   with the "variables" extension, I'm getting requests for a way for
>   a user to express their intention; something like
>   
>   	fileinto :create 	"If it doesn't exist, create it"
>   or
>   	fileinto :exists	"If it doesn't exist, redirect to INBOX."
>   
>   or something in that area.

it is unfortunate that behaviour is undefined.  both behaviours are
useful, so I think both should be in the draft.  well, the draft could
instead mandate fileinto to file into INBOX if the folder doesn't
exist and ":create" isn't specified.  this can also serve as a hint to
new implementers of Sieve.

-- 
Kjetil T.

Date: Thu, 24 Apr 2003 11:08:49 -0700 (PDT)
From: [email-masked]
Subject: Re: Three new drafts and a question
To: Jutta Degener <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> I sent out three new sieve drafts last week that may be of interest:

>  <http://www.ietf.org/internet-drafts/draft-degener-sieve-copy-00.txt>
  	
> 	fileinto :copy, redirect :copy -- keyword parameter that
> 	prevents cancelling the implicit "keep".

This isn't a problem I've seen myself, but it seems like a reasonable
thing to have and the implementation burden should be low.

>  <http://www.ietf.org/internet-drafts/draft-degener-sieve-editheader-00.txt>

>   	Deleting, adding, and changing message header fields.

I see several issues here:

(1) The use of separate field-name/field-value arguments to specify a header
    field matches up nicely with the header test. But it effectively precludes
    specification of more than one header in a single addheader or
    deleteheader command. I prefer the approach of having a single argument,
    which can either be a string specifying a single field or a list
    specifying multiple fields.

(2) I sure wish we'd allowed signed integers as numbers in the base sieve
    specification. If we had them available we could use negative indices
    to represent offsets from the last occurence of a given field. This in
    turn would make it possible to specify ranges of fields in deleteheader
    fairly easily. I wish I had an alternative to suggest here that would
    give us this functionality, but I don't.

(3) I see considerable value in addheader and deleteheader. Replaceheader,
    however, goes a bit too far for my tastes. Do we really need this? Is
    it worth the complexity?

>  <http://www.ietf.org/internet-drafts/draft-degener-sieve-multiscript-00.txt>
  	
> 	Sequential execution of (unrelated) sieve scripts by the
> 	environment.  A meta-feature -- it doesn't define new sieve
> 	language elements -- that's interesting in particular in
> 	contrast to Cyrus's "include" draft.

Hmm. The approach taken here is very similar but not quite identical to the
approach I've used to combine multiple scripts. We agree in that any script
that ends in an implicit keep in effect cedes control to the next script in the
sequence, and that the explicit actions reject, fileinto, and redirect that
cancel implicit keep prevent subsequent scripts from running.

The place where we differ is in the handling of explicit keep. The draft calls
for subsequent scripts to be called. I don't do that; in my implementation an
explicit keep prevents subsequent scripts from acting.

I don't think this is something I can change at this point either. One of the
things that's often done is to have some kind of filtering in a system-level
sieve script. That script may elect to discard a message. I wanted the ability
for users to override such system-level decisions by issuing an explicit "keep"
in their scripts. This trick got documented and is now in use.

I suppose I could always implement an option to control how explicit keeps
affect the operation of multiple scripts.

There's also one semantics issue I see here: RFC 3028 says that fileinto
"INBOX" and "keep" are equivalent in an IMAP environment. This specification
tweaks that equivalence somewhat.

> There may or may not be another one for fileinto in the wings.
> It's about Kjetil's open issue 0.3 b):

> Some implementations of "fileinto" create IMAP folders on the
> fly if they don't exist; others don't.  (They redirect to
> the inbox instead.)  Sieve doesn't proscribe either way.

> My own implementation used to only reuse existing folders; but now
> that we're thinking about creating them on demand in conjunction
> with the "variables" extension, I'm getting requests for a way
> for a user to express their intention; something like

> 	fileinto :create 	"If it doesn't exist, create it"
> or
> 	fileinto :exists	"If it doesn't exist, redirect to INBOX."

> or something in that area.

> Is anyone hearing similar requests from their users?
> Have you thought about the issue and come to conclusions for
> your own releases?

We opted for the other course: We create new folders on demand. Thus far I
don't believe we've gotten requests for "only file to folders that already
exist", but of course that could change once variables support is available.

I have no problem with implementing such an extension in any case.

				Ned

Date: Thu, 24 Apr 2003 10:35:57 -0700
From: Jutta Degener <[email-masked]>
To: [email-masked]
Subject: Re: variables: greedy or non-greedy matching
Sender: [email-masked]

On Thu, Apr 24, 2003 at 07:14:43AM -0700, [email-masked] wrote:
> Um, no. For the very small subset of users sophisticated enough to
> write this sort of code themselves, I believe their expectation will
> be set by past experience with other matching systems, and these
> systems tend to default to greedy matching.

I think even in that sophisticated subset, most people just live
their pattern-matching lives without really thinking about the
difference.

But admittedly, my own expectations are muddy, and, worse,
seem to change with the lexical structure of the pattern. 
Speaking naively -- I know that this isn't how things work
or should work --

* If the end of my pattern is part of a grammatical whole, I want
  the wildcard to  be greedy; certainly, I, too, would expect
  "f*o" to fully match "foo", not to stop after the first "o".

* But if the end of my pattern is a delimiter, I tend to implicitly
  expect the expression be defined as something that doesn't
  contain that delimiter, as in the example Kjetil quoted where few
  people would expect the * before a closing > in an e-mail address
  to itself contain another >.

I think what this all says is that what felt to me like a problem
with greed is really a problem with globbing and insufficient
expressiveness of * (regexps have problems, too, once you get
to comments and quoting, but one has to work a little harder to
make things fail.)

So let's stay greedy; thanks for setting me straight! 

Jutta

Date: Thu, 24 Apr 2003 07:14:43 -0700 (PDT)
From: [email-masked]
Subject: Re: variables: greedy or non-greedy matching
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> I can not find any precedence for greedy/non-greedy matching in the
> RFC's (I only checked NNTP, I don't know where else to look).  it
> seems to me that previously, we have only been interested in
> TRUE/FALSE, _how_ the match was performed can not be observed.  the
> variables extension introduces ${<n>} which allows us to observe
> matching behaviour, and therefore whether to do greedy/non-greedy
> matching must be part of the variables specification.

> Jutta points out in private e-mail that greedy matching does not
> follow the prinicple of least surprise for ordinary users.  e.g., in

>   string :matches "<[email-masked]>, <[email-masked]>" "<[email-masked]>*"

> most users will probably expect ${1} to contain "alice", not
> "[email-masked]>, <bob".  change it into:

>   string :matches "<[email-masked]>, <[email-masked]>" "*<[email-masked]>*"
>                                                     ^
> and ${2} is now "bob"...  not intuitive, right?

Um, no. For the very small subset of users sophisticated enough to
write this sort of code themselves, I believe their expectation will
be set by past experience with other matching systems, and these
systems tend to default to greedy matching.

> this issue was raised here earlier, and by analogy with regular
> expressions, I claimed the wildcard "*" in :matches should match
> greedily.  this allows an implementation to convert a match string to
> a regular expression very easily, but is potentially confusing for
> users.

> non-greedy matching requires implementers to write their own matching
> code, or to use a regexp library which supports non-greedy matching.

> what do you think?

I prefer greedy matching.

> if we go for non-greedy, Jutta suggested using "**" as a special case
> to get greedy matching.  (actually, I think the rule should be that
> "*" followed by another wildcard is greedy.)  I'm not sure it is worth
> it, after all a site supporting variables will most likely also offer
> regex.

I don't think it is worth it either.

				Ned

Date: Thu, 24 Apr 2003 11:25:58 -0400 (EDT)
From: Rob Siemborski <[email-masked]>
To: [email-masked]
cc: [email-masked]
Subject: Re: Three new drafts and a question
Sender: [email-masked]

On Thu, 24 Apr 2003 [email-masked] wrote:

> Do we need a way to set the implicit keep flag? I can't think why right
> now; it just looks not symmetric that it can be reset or left alone, but
> not set.

Personally, I'd feel a little wierd about an "implicit" flag being
settable.

-Rob

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rob Siemborski | Andrew Systems Group * Research Systems Programmer
PGP:0x5CE32FCC | Cyert Hall 207 * [email-masked] * 412.268.7456
-----BEGIN GEEK CODE BLOCK----
Version: 3.12
GCS/IT/CM/PA d- s+: a-- C++++$ ULS++++$ P+++$ L+++(++++) E W+ N o? K-
w O- M-- V-- PS+ PE++ Y+ PGP+ t+@ 5+++ R@ tv-@ b+ DI+++ G e h r- y?
------END GEEK CODE BLOCK-----

Date: 24 Apr 2003 14:50:31 -0000
From: [email-masked]
To: [email-masked]
Subject: Re: Three new drafts and a question
Sender: [email-masked]

> >  <http://www.ietf.org/internet-drafts/draft-degener-sieve-copy-00.txt>
> >
> > fileinto :copy, redirect :copy -- keyword parameter that
> > prevents cancelling the implicit "keep".

That is certainly useful.

The Exim filter uses "seen" and "unseen" deliveries.  If any seen
deliveries take place, there is no implicit keep.  Each delivery of a
message has a default of being seen or unseen, that can be changed using
an option.  "seen" is like "discard", "unseen" is like ":copy".

I would prefer if the draft expressed more clearly that "keep" is not
symmetric to "discard", because keep stores the message, whereas discard
just clears the implicit keep.  In fact, RFC 3028 could be more clear
on that issue.  It gives a better motivation why ":copy" is needed, though.

Do we need a way to set the implicit keep flag? I can't think why right
now; it just looks not symmetric that it can be reset or left alone, but
not set.

Michael

From: "Nigel Swinson" <[email-masked]>
To: "Jutta Degener" <[email-masked]>
Cc: <[email-masked]>
Subject: Re: Three new drafts and a question
Date: Thu, 24 Apr 2003 15:09:26 +0100
Sender: [email-masked]

> I sent out three new sieve drafts last week that may be of interest:

As if this list wasn't busy enough at the moment ;o)

>  <http://www.ietf.org/internet-drafts/draft-degener-sieve-copy-00.txt>
>
> fileinto :copy, redirect :copy -- keyword parameter that
> prevents cancelling the implicit "keep".

Spelling mistake in first line of this paragraph... should read "possible"

   It is possibly to generate sieve code that perfectly
    <snip>

Yeah I like this idea.  I found the whole interaction between implicit keep
and discard really difficult to get my head round.  this extension sounds
like it will help.

<http://www.ietf.org/internet-drafts/draft-degener-sieve-editheader-00.txt>
>
>   Deleting, adding, and changing message header fields.

Heh, was thinking of authoring one of these soon.  Thanks for beating me to
it.  I haven't been able to digest it in detail yet but it looks ok to me on
a first pass :o)

<http://www.ietf.org/internet-drafts/draft-degener-sieve-multiscript-00.txt>
>
> Sequential execution of (unrelated) sieve scripts by the
> environment.  A meta-feature -- it doesn't define new sieve
> language elements -- that's interesting in particular in
> contrast to Cyrus's "include" draft.

When you are doing server/domain level filtering, you might want to allow a
server script to file into a specific user folder.  So you could have a user
folder called "Bulk" or "Spam" or something, and the server level script
could have ask to file a message into that users "Bulk" folder (rather than
just delete it).

In MailSite we have server and domain level scripts, and there seemed to be
a few possible interpretations of the "fileinto" command.  Either it could:

a) "fileinto" a folder on the local file system
b) file into a folder of the target user (at server/domain level there may
be many recipients in the envelope at this stage)
c) file into a folder of the server/domain postmaster.

Sadly we chose a), which I thought was going to be the most useful, but now
we have a need to do b) as well.  So we were wondering if fileinto should
have some kind of arg to say:

    fileinto :filesystem "DirectoryName";

To file into the "DirectoryName" folder on the file system of the MTA, or

    fileinto "Spam";

To fileinto the Spam folder of the recipient (if local) or

    fileinto :user "Postmaster" "Spam";

To file into the Spam folder of the Postmaster mailbox.

I know most of this is probably a spearate extension, but the draft as it
stands implies that it's only Keep and implicit Keep actions in previous
scripts that can allow subsequent scripts to be executed, and I'm not sure
that's true.

I think fileinto(s) in a previous script should "change the location" of
where implicit keep would post the message.  Explicit Keep could probably
change the filed location to Inbox (or add Inbox if there were multiple
fileintos in a previous script).  Another fileinto would change the filed
location (or add the new folder if there were multiple fileintos in a
previous script).

I think we need to think through all this pretty carefully, but it'll be
worth it...

Cheers,

Nigel

To: [email-masked]
Subject: variables: greedy or non-greedy matching
From: Kjetil Torgrim Homme <[email-masked]>
Date: 24 Apr 2003 14:08:45 +0200
Lines: 39
Sender: [email-masked]

I can not find any precedence for greedy/non-greedy matching in the
RFC's (I only checked NNTP, I don't know where else to look).  it
seems to me that previously, we have only been interested in
TRUE/FALSE, _how_ the match was performed can not be observed.  the
variables extension introduces ${<n>} which allows us to observe
matching behaviour, and therefore whether to do greedy/non-greedy
matching must be part of the variables specification.

Jutta points out in private e-mail that greedy matching does not
follow the prinicple of least surprise for ordinary users.  e.g., in

  string :matches "<[email-masked]>, <[email-masked]>" "<[email-masked]>*"

most users will probably expect ${1} to contain "alice", not
"[email-masked]>, <bob".  change it into:

  string :matches "<[email-masked]>, <[email-masked]>" "*<[email-masked]>*"
                                                    ^
and ${2} is now "bob"...  not intuitive, right?

this issue was raised here earlier, and by analogy with regular
expressions, I claimed the wildcard "*" in :matches should match
greedily.  this allows an implementation to convert a match string to
a regular expression very easily, but is potentially confusing for
users.

non-greedy matching requires implementers to write their own matching
code, or to use a regexp library which supports non-greedy matching.

what do you think?

if we go for non-greedy, Jutta suggested using "**" as a special case
to get greedy matching.  (actually, I think the rule should be that
"*" followed by another wildcard is greedy.)  I'm not sure it is worth
it, after all a site supporting variables will most likely also offer
regex.
-- 
Kjetil T.

Date: Wed, 23 Apr 2003 13:14:05 -0700
From: Jutta Degener <[email-masked]>
To: [email-masked]
Subject: Three new drafts and a question
Sender: [email-masked]

I sent out three new sieve drafts last week that may be of interest:

 <http://www.ietf.org/internet-drafts/draft-degener-sieve-copy-00.txt>
  	
	fileinto :copy, redirect :copy -- keyword parameter that
	prevents cancelling the implicit "keep".

 <http://www.ietf.org/internet-drafts/draft-degener-sieve-editheader-00.txt>

  	Deleting, adding, and changing message header fields.

 <http://www.ietf.org/internet-drafts/draft-degener-sieve-multiscript-00.txt>
  	
	Sequential execution of (unrelated) sieve scripts by the
	environment.  A meta-feature -- it doesn't define new sieve
	language elements -- that's interesting in particular in
	contrast to Cyrus's "include" draft.

There may or may not be another one for fileinto in the wings.
It's about Kjetil's open issue 0.3 b):

Some implementations of "fileinto" create IMAP folders on the
fly if they don't exist; others don't.  (They redirect to
the inbox instead.)  Sieve doesn't proscribe either way.

My own implementation used to only reuse existing folders; but now
that we're thinking about creating them on demand in conjunction
with the "variables" extension, I'm getting requests for a way
for a user to express their intention; something like 

	fileinto :create 	"If it doesn't exist, create it"
or
	fileinto :exists	"If it doesn't exist, redirect to INBOX."

or something in that area.

Is anyone hearing similar requests from their users?
Have you thought about the issue and come to conclusions for
your own releases?

Jutta

Date: Mon, 21 Apr 2003 22:44:21 -0600
From: Alexey Melnikov <[email-masked]>
Organization: ACI WorldWide / MessagingDirect
To: Jutta Degener <[email-masked]>
CC: [email-masked]
Subject: Imapflags and variables (was Re: List variables in Sieve)
Sender: [email-masked]

[I've modified the subject once again to reflect our current discussion].

Jutta Degener wrote:

> On Sat, Apr 19, 2003 at 04:54:09AM -0700, [email-masked] wrote:
> > > After I rewrote my example in "imapflags" I've realised how ugly this will
> > > look, because
> > > 1). The script author has to remember all flags that were set on the
> > > message and specify them all.
>
> Hm!  I thought of that as an advantage, not a downside.

See below.

> > > 2). setflags has to be replaced with multiple "set"s as we have to clear
> > > all flags.
>
> Similarly, I don't think that it's so bad that we get a list
> of what flags are available that way.
>
> Maybe we have very different applications in mind.  To me, the range
> of flags is severely limited by the ability of clients to display
> them and use them in the interface, and by the ability of users to
> remember and use them.
>
> Can you describe a typical application of your multitude of flags?

I am think from the point of view of a user writing scripts by hand, not scripts
generated by UI.
Also, I am thinking more in IMAP terms, i.e. each script is a list of blocks like
this:

if <condition> add/remove <flag>;

I don't want an end user to require to remember at each point in the script which
flags are to be set on the message.
IMHO, this reduces script complexity and, as a result, user errors.

> > > So, I am thinking now about using a single string parameter (instead of a
> > > string list) that contains space delimited flags. Adding flags (old
> > > "addflags") to the list would be simpler, e.g.
> >
> > > set "flags" "${flags} \\Seen"
> >
> > I was wondering if we'd eventually get to this. I'm not delighted by it, but
> > I think it probably is the best solution to the problem.
>
> I'd like to get a better understanding of the problem first.
>
> This is introducing a second list type with roughly the same function
> as the existing one, making sieve in the long term more expensive to

> implement and harder to understand; because now, every time you specify
> a list, you'll have to ask yourself whether it was type A or type B.

I don't think I share your concern. If you are afraid that this will open gates to
multiple Sieve extensions that misuse strings,
Sieve mailing list exists not to let such extensions be standardized.

All functionality required is already available in the base Sieve document or the
variable draft. So, my proposal doesn't make it harder to implement.

Besides, if you want to be explicit, you can still use "${flag1} ${flag2}
${flag3}" construct instead of specifying a single variable.
So, UI-generated scripts are still possible with my proposal.

And yes, I grew up as a Pascal programmer as well and I miss set types and set
related operations ;-).

> > > "removeflags" would be trickier to implement, but "string" test with
> > > :matches can be used to test if a flag was set, e.g.
> >
> > > if string :matches "${flags}" "*\\Draft*" {
> > >     set "flags" "${1}${2}"
> > > }
>
> The mistake in this expression -- it'll match \Draft as well
> as \DraftBeer

Good catch.

> -- will be made many times over, and mostly without
> harm, in scripts all over the world.

Hopefully, if a correct example is shown in the document, everybody will just
cut&paste it.

> It can be fixed by using trailing
> white space in both the matches and the flags string, but I don't
> think most authors will remember to do that.

Regards,
Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Watford, UK

Work Phone: +44 1923 81 2877
Home Page: http://orthanc.ab.ca/mel
IETF standard
related pages: http://orthanc.ab.ca/mel/devel/Links.html

I speak for myself only, not for my employer.
__________________________________________

Date: Mon, 21 Apr 2003 07:44:12 -0700
From: Jutta Degener <[email-masked]>
To: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft (draft-homme-sieve-variables-00.txt))
Sender: [email-masked]

On Sat, Apr 19, 2003 at 04:54:09AM -0700, [email-masked] wrote:
> > After I rewrote my example in "imapflags" I've realised how ugly this will
> > look, because
> > 1). The script author has to remember all flags that were set on the
> > message and specify them all.

Hm!  I thought of that as an advantage, not a downside.

> > 2). setflags has to be replaced with multiple "set"s as we have to clear
> > all flags.

Similarly, I don't think that it's so bad that we get a list
of what flags are available that way.

Maybe we have very different applications in mind.  To me, the range
of flags is severely limited by the ability of clients to display
them and use them in the interface, and by the ability of users to
remember and use them.

Can you describe a typical application of your multitude of flags?

> > So, I am thinking now about using a single string parameter (instead of a
> > string list) that contains space delimited flags. Adding flags (old
> > "addflags") to the list would be simpler, e.g.
> 
> > set "flags" "${flags} \\Seen"
> 
> I was wondering if we'd eventually get to this. I'm not delighted by it, but
> I think it probably is the best solution to the problem.

I'd like to get a better understanding of the problem first.

This is introducing a second list type with roughly the same function
as the existing one, making sieve in the long term more expensive to
implement and harder to understand; because now, every time you specify
a list, you'll have to ask yourself whether it was type A or type B.

> > "removeflags" would be trickier to implement, but "string" test with
> > :matches can be used to test if a flag was set, e.g.
> 
> > if string :matches "${flags}" "*\\Draft*" {
> >     set "flags" "${1}${2}"
> > }

The mistake in this expression -- it'll match \Draft as well
as \DraftBeer -- will be made many times over, and mostly without
harm, in scripts all over the world.  It can be fixed by using trailing
white space in both the matches and the flags string, but I don't
think most authors will remember to do that.

> Very cute. How to folks who precompile all this stuff feel about allowing
> this sort of variable pattern?

Well, you can't (precompile all this stuff), so what's the use.

Jutta

Date: Sat, 19 Apr 2003 19:45:31 -0700 (PDT)
From: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
To: Simon Josefsson <[email-masked]>
Cc: Kjetil Torgrim Homme <[email-masked]>, [email-masked]
Sender: [email-masked]

> Kjetil Torgrim Homme <[email-masked]> writes:

> >>   >>    For an example of a less general than expected test,
> >>   >>    consider looking for Subject: containing "MAKE MONEY FAST"
> >>   >>    to filter spam into a separate folder, and an incoming
> >>   >>    message having a Subject: of "=?CP-1252?q?MAKE_MONEY_FAST?=.
> >>   >
> >>   > I believe that message should be filtered just fine.
> >>
> >>   How?  Compare the following from RFC 3028 [2.7.2].  Assuming the
> >>   implementation does not support CP-1252, I don't see how "MAKE
> >>   MONEY FAST" and "=?CP-1252?q?MAKE_MONEY_FAST?=" would match.
> >
> > oh, I assumed that an implementation would decode quoted-printable and
> > base64, but mark the string as "unknown charset".  that seems to "do
> > what I want" more often.

> That approach would only work, for this example, if the unknown
> charset was ASCII compatible.  Of course, non-ASCII charset doesn't
> occur in practice, but I was talking about the case where the sender
> acts malicously to cause certain behaviour the user didn't think of.
> If picking a non-ASCII charset makes the client behave badly, the
> attacker will do so.

iso-2022-* charsets commonly occur in practice, and are not ASCII compatible
in this sense.

> But I agree that your draft isn't the place for these generic Sieve
> security considerations.

Exactly.

				Ned

To: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
From: Kjetil Torgrim Homme <[email-masked]>
Date: 20 Apr 2003 03:25:02 +0200
Lines: 32
Sender: [email-masked]

[Ned Freed]:
>
>   > all right, the original idea for adding SETDATE was to use it with
>   > FILEINTO so that you could make archives "dynamically".  also, Sieve
>   > is typically used by the delivery agent.  the case where a Sieve
>   > client uses IMAP or similar to access the message store after delivery
>   > has taken place, is an edge case.  furthermore, the spec says
>   
>   In this case using the Date: field would be an exceedingly bad
>   idea. You don't want to let people add stuff to old archives
>   simply by setting the Date: field to a value in the past.

absolutely, using Date is worse than useless.  I've seen quite a few
mail archives which do that on the web, though...

>   IMO the ideal value to use here is "date of insertion into the
>   archive". The current date is a reasonable thing to use for
>   that. The Date: field is not.

I (as a user) think the ideal value is "date of original delivery".
unfortunately, there is currently no standard way of obtaining that
value, you'll have to dig around in Received and apply some sanity
checking.

>   I think it should refer to the time the filtering action was
>   taken, regardless of whether that was in the context of delivery
>   or later filtering.

noted.

-- 
Kjetil T.

To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
From: Simon Josefsson <[email-masked]>
Date: Sat, 19 Apr 2003 22:35:32 +0200
Sender: [email-masked]

Kjetil Torgrim Homme <[email-masked]> writes:

>>   >>    For an example of a less general than expected test,
>>   >>    consider looking for Subject: containing "MAKE MONEY FAST"
>>   >>    to filter spam into a separate folder, and an incoming
>>   >>    message having a Subject: of "=?CP-1252?q?MAKE_MONEY_FAST?=.
>>   >
>>   > I believe that message should be filtered just fine.
>>   
>>   How?  Compare the following from RFC 3028 [2.7.2].  Assuming the
>>   implementation does not support CP-1252, I don't see how "MAKE
>>   MONEY FAST" and "=?CP-1252?q?MAKE_MONEY_FAST?=" would match.
>
> oh, I assumed that an implementation would decode quoted-printable and
> base64, but mark the string as "unknown charset".  that seems to "do
> what I want" more often.

That approach would only work, for this example, if the unknown
charset was ASCII compatible.  Of course, non-ASCII charset doesn't
occur in practice, but I was talking about the case where the sender
acts malicously to cause certain behaviour the user didn't think of.
If picking a non-ASCII charset makes the client behave badly, the
attacker will do so.

But I agree that your draft isn't the place for these generic Sieve
security considerations.

Date: Sat, 19 Apr 2003 11:37:20 -0700 (PDT)
From: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> >   > oh!  if you run the Sieve script in batch, long after the
> >   > delivery was made, the current date is completely useless.
> >   > SETDATE should be changed to initialise the variables to the
> >   > time of delivery, not current time.
> >
> >   Um, no, it may well be that it is the value in the Date: field
> >   that is completely useless. It is all a question of what you're
> >   trying to achieve. [...]

> all right, the original idea for adding SETDATE was to use it with
> FILEINTO so that you could make archives "dynamically".  also, Sieve
> is typically used by the delivery agent.  the case where a Sieve
> client uses IMAP or similar to access the message store after delivery
> has taken place, is an edge case.  furthermore, the spec says

In this case using the Date: field would be an exceedingly bad idea. You don't
want to let people add stuff to old archives simply by setting the Date: field
to a value in the past.

IMO the ideal value to use here is "date of insertion into the archive". The
current date is a reasonable thing to use for that. The Date: field is not.

> |  These variables SHOULD reference the time when execution of the
> |  Sieve script reaches the statement.

> so such a client is allowed to use Received headers or whatever it
> likes to find the date the user wants for SETDATE.  still, the intent
> is that it references the time of delivery.  for the typical use, the
> MDA, it doesn't make any difference.  for the standalone MFA (mail
> filtering agent), it does make a difference, and I think we should be
> explicit about what we want the MFA to do.

I think it should refer to the time the filtering action was taken,
regardless of whether that was in the context of delivery or later filtering.

				Ned

Date: Sat, 19 Apr 2003 11:29:05 -0700 (PDT)
From: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
To: Simon Josefsson <[email-masked]>
Cc: [email-masked], [email-masked]
Sender: [email-masked]

> > >    Filters relying on string matches in the raw body of an e-mail
> > >    message may be more general than intended.  Text matches are no
> > >    replacement for a virus or spam filtering system.

> > Of course they aren't. Have we really reached the point where we
> > have to belabor obvious points like this in security considerations sections?

> There are several solutions our there that claim to solve the email
> spam and virus problems with Sieve, encoding common spam and virus
> signatures in Sieve scripts (some are offering online access to
> updated Sieve scripts with new signatures).  People are being told,
> and believe, Sieve is the right tool for this.  Looking only at RFC
> 3028, I can't blame them.  It even contains examples on how to catch
> spam.

Specific examples of how to catch a specific sort of spam message do not
a general filtering system make.

Every month Bruce Schneier has a "doghouse" section in his Cryptogram column
detailing one product or another he considers to be "snake oil security". In
many cases these systems try and gain credibility by claiming that they employ
one security standard or another. Yet we don't try and document this sort of
possible misuse in the security standards we write. Instead we focus on what
the system is good for and what its technical limitations are. We don't try and
deflect marketing pitches. It isn't a game that's appropriate to play in the
"once written never changed" context of an RFC.

				Ned

To: Alexey Melnikov <[email-masked]>
Cc: [email-masked]
Subject: Re: Integer variables
From: Kjetil Torgrim Homme <[email-masked]>
Date: 19 Apr 2003 16:44:40 +0200
Lines: 48
Sender: [email-masked]

[Alexey Melnikov]:
>
>   Kjetil Torgrim Homme wrote:
>   
>   > the problem is rather that the variable can only be expanded
>   > inside a string, so it would lose its integer property.
>   
>   Which is fine, as long as this is documented.  I believe the
>   current document doesn't specify what types of variables are
>   allowed.  You have to either explicitly allow or prohibit this.

it is explicit already, if you look in the right place:

|   Syntax:   set [MODIFIER] [COMPARATOR] <name: string> <value: string>
                                                          =============

it doesn't say anything about variable references being usable outside
of string interpretation, I guess that could be more explicit, but the
overall Sieve grammar doesn't allow an unadorned variable reference as
a syntactic element.

(if a numeric variable was to be introduced, it seems to me that to
access it, changing the allowed values for QUANTIFIER to include a
variable-ref would be the way to go, i.e. 1${count}, ref. 1M.)

>   > do you have a use for integer variables?
>   
>   You already have the "length" function.

yes, it may be a bit silly.  a determined hacker can use it to convert
numbers in unary to decimal (I've had to do this during crash recovery
in singleuser mode on SunOS ;-), but the lack of a looping construct
will cramp his style.

>   I was thinking something along the lines of comparing
>   lengths/counting headers/scoring.  However this will probably
>   require some actions for simple arithmetic (+/-).

with regex, you can do:

    set "score" "${score}1";  # several times inside if-blocks

    if string :regex "${score}" "1{5,}" {
        # five or more hits ...
    }

-- 
Kjetil T.

To: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
From: Kjetil Torgrim Homme <[email-masked]>
Date: 19 Apr 2003 15:40:04 +0200
Lines: 31
Sender: [email-masked]

[Simon Josefsson]:
>
>   IMHO it is useful if all common pitfalls that lead to security
>   problems are discussed.

well, I don't think this is the place for it, it would fit better in a
revision of RFC 3028, or an informational RFC.

>   >>    For an example of a less general than expected test,
>   >>    consider looking for Subject: containing "MAKE MONEY FAST"
>   >>    to filter spam into a separate folder, and an incoming
>   >>    message having a Subject: of "=?CP-1252?q?MAKE_MONEY_FAST?=.
>   >
>   > I believe that message should be filtered just fine.
>   
>   How?  Compare the following from RFC 3028 [2.7.2].  Assuming the
>   implementation does not support CP-1252, I don't see how "MAKE
>   MONEY FAST" and "=?CP-1252?q?MAKE_MONEY_FAST?=" would match.

oh, I assumed that an implementation would decode quoted-printable and
base64, but mark the string as "unknown charset".  that seems to "do
what I want" more often.

>   The IDNA specification says that if IDNs are in IDN-unaware domain
>   name slots, it MUST be encoded as ASCII.  Since the Sieve
>   specification does not discuss IDN, all domain name slots in Sieve
>   scripts are IDN-unaware.

good to know, thanks.
-- 
Kjetil T.

To: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
From: Kjetil Torgrim Homme <[email-masked]>
Date: 19 Apr 2003 15:29:50 +0200
Lines: 35
Sender: [email-masked]

[Ned Freed]:
>
>   I really don't want to try and force this into the setdate
>   framework.  I'll see what I can do to write up the approach I have
>   in mind for this.

thanks.

>   > oh!  if you run the Sieve script in batch, long after the
>   > delivery was made, the current date is completely useless.
>   > SETDATE should be changed to initialise the variables to the
>   > time of delivery, not current time.
>   
>   Um, no, it may well be that it is the value in the Date: field
>   that is completely useless. It is all a question of what you're
>   trying to achieve. [...]

all right, the original idea for adding SETDATE was to use it with
FILEINTO so that you could make archives "dynamically".  also, Sieve
is typically used by the delivery agent.  the case where a Sieve
client uses IMAP or similar to access the message store after delivery
has taken place, is an edge case.  furthermore, the spec says

|  These variables SHOULD reference the time when execution of the
|  Sieve script reaches the statement.

so such a client is allowed to use Received headers or whatever it
likes to find the date the user wants for SETDATE.  still, the intent
is that it references the time of delivery.  for the typical use, the
MDA, it doesn't make any difference.  for the standalone MFA (mail
filtering agent), it does make a difference, and I think we should be
explicit about what we want the MFA to do.

-- 
Kjetil T.

To: [email-masked]
Cc: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
From: Simon Josefsson <[email-masked]>
Date: Sat, 19 Apr 2003 14:30:39 +0200
Sender: [email-masked]

[email-masked] writes:

> A date test is also useful, but it is no replacement for the ability
> to test the current date.

Agreed, I want both.

> Additionally, if you are testing date information in the message header,
> while it may be useful to test the Date: field, there are actually quite
> a few other header fields that can contain date information that is even
> more useful to test.

Agreed, I want it the command to take a string that may be a variable,
so you can extract it from, e.g., Received headers.

>>    Filters relying on string matches in the raw body of an e-mail
>>    message may be more general than intended.  Text matches are no
>>    replacement for a virus or spam filtering system.
>
> Of course they aren't. Have we really reached the point where we 
> have to belabor obvious points like this in security considerations sections?

There are several solutions our there that claim to solve the email
spam and virus problems with Sieve, encoding common spam and virus
signatures in Sieve scripts (some are offering online access to
updated Sieve scripts with new signatures).  People are being told,
and believe, Sieve is the right tool for this.  Looking only at RFC
3028, I can't blame them.  It even contains examples on how to catch
spam.

Date: Sat, 19 Apr 2003 04:54:09 -0700 (PDT)
From: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft (draft-homme-sieve-variables-00.txt))
To: Alexey Melnikov <[email-masked]>
Cc: Jutta Degener <[email-masked]>, [email-masked]
Sender: [email-masked]

> Alexey Melnikov wrote:

> > Jutta Degener wrote:
> >
> > > On Sun, Apr 13, 2003 at 05:53:40PM +0200, Kjetil Torgrim Homme wrote:
> > > > [Alexey Melnikov]:
> > > > >
> > > > >   In order to move imapflags extension forward I need support for
> > > > >   set/list variables.
> > >
> > > I think we might be able to do without this.  What if you allow
> > > (and ignore) empty strings in a [...] list?
> > >
> > > That way, you could set
> > >
> > >         set "aflag" "aflag"
> > >
> > >         ["${aflag}", "${bflag}", "${cflag}"]
> > >
> > > and have that come out as
> > >
> > >         ["aflag" "" ""]
> > >
> > > if bflag and cflag are unset.
> > >
> > > There are still things that you can do with a list algebra
> > > that you can't do with this approach -- infinitely many
> > > flags based on the header and body contents of a message --
> > > but I don't think we want to do those things badly enough
> > > to warrant adding three new commands and a variable data type.
> >
> > Surely three new actions shouldn't scare you :-).
> > But I understand the complexity of multiple data types.
> >
> > Ok, I can live with this.
> > It seems the only thing required to be said is that empty strings are
> > ignored in a list that specifies flags to be set.
> > I should also mention that each list member defines a separate flag and
> > spaces in flag names are not allowed (due to IMAP restriction).

> After I rewrote my example in "imapflags" I've realised how ugly this will
> look, because
> 1). The script author has to remember all flags that were set on the
> message and specify them all.
> 2). setflags has to be replaced with multiple "set"s as we have to clear
> all flags.

> So, I am thinking now about using a single string parameter (instead of a
> string list) that contains space delimited flags. Adding flags (old
> "addflags") to the list would be simpler, e.g.

> set "flags" "${flags} \\Seen"

I was wondering if we'd eventually get to this. I'm not delighted by it, but
I think it probably is the best solution to the problem.

> "removeflags" would be trickier to implement, but "string" test with
> :matches can be used to test if a flag was set, e.g.

> if string :matches "${flags}" "*\\Draft*" {
>     set "flags" "${1}${2}"
> }

Very cute. How to folks who precompile all this stuff feel about allowing
this sort of variable pattern?

				Ned

Date: Sat, 19 Apr 2003 04:44:04 -0700 (PDT)
From: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> [Simon Josefsson]:
> >
> >   * The setdate command is useful, but wouldn't it be even more useful
> >     if there was a command that extracts comparable time/date
> >     variables from Date: headers?  To handled obs-zone's timezones.
> >     E.g., consider if I want to sort messages sent (Date:) between
> >     01 am and 04 am (in the senders timezone) into a folder
> >     INBOX.rants.

Cute. I hadn't thought of using this to get a likely time zone for the
originator.

> like
>   SETDATE :header "Date";
> vs. just
>   SETDATE;
> to access the current time.

> Ned, you had some ideas for more date related tests, what do you
> think?

I really don't want to try and force this into the setdate framework.
I'll see what I can do to write up the approach I have in mind for this.

> it seems to me that the only interesting data to be found in Date: is
> the local time and time zone of the sender (I feel SETDATE should
> normalise the timezone to offset format if it recognises it).  the
> date itself should be no more than a few minutes earlier than current
> time.  if it isn't, there is a misconfiguration or an outage going on.

> oh!  if you run the Sieve script in batch, long after the delivery was
> made, the current date is completely useless.  SETDATE should be
> changed to initialise the variables to the time of delivery, not
> current time.

Um, no, it may well be that it is the value in the Date: field that is
completely useless. It is all a question of what you're trying to achieve. If I
want a likely time zone for the originator I use Date:. If I want to guess at
when the message was actually sent use the oldest Received: field. If I want a
good estimate of when the message reached me use the newest Received: field.
(Actually, it may be necessary to  skip down a few to get the real scoop. This
is one of the reasons why this sort of test tends to be a bit context
sensitive.) If I want to know if the message has expired according to the
originator use one of the various expired fields. And if I want to alter
processing based on my current situation, use the current date.

There's a reason why there isn't a single grand unified time stamp on all
messages, and why we eventually want the ability to perform flexible
tests in this area.

> >   * I feel variable variable names (e.g., ${foo-${bar}-baz}) would be
> >     useful, but I can't come up with a good example why it is really
> >     required so I'm just mentioning it if someone else can come up
> >     with a illustrative example.

> it could be used as a poor man's associative arrays.  there'd be no
> function to list all keys in the "array", though.  if we do this, we
> need a way of escaping the dollar character other than the ${dollar}
> hack.  I don't think it is worth it.  if we want to support
> associative arrays, let's do it explicitly.

I completely agree.

				Ned

Date: Sat, 19 Apr 2003 04:29:53 -0700 (PDT)
From: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
To: Simon Josefsson <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> * The setdate command is useful, but wouldn't it be even more useful
>   if there was a command that extracts comparable time/date variables
>   from Date: headers?  To handled obs-zone's timezones.  E.g.,
>   consider if I want to sort messages sent (Date:) between 01 am and
>   04 am (in the senders timezone) into a folder INBOX.rants.

A date test is also useful, but it is no replacement for the ability
to test the current date. Like it or not, the current date is a value
that may be reflected nowhere in the message, and may be the information
you want to use to decide on an action (e.g., I'm in a meeting and unable
to answer right away).

Additionally, if you are testing date information in the message header,
while it may be useful to test the Date: field, there are actually quite
a few other header fields that can contain date information that is even
more useful to test. For example, tests on Received: fields can be
very useful in determining if a message made it to a given point by 
a given time. Tests on the various expiry fields are another example.
All tests on the Date: field tell you is the time the originator's UA or
the originator's submission elected to attach to the message.

The problem with these sorts of tests is that they tend to be somewhat more
dependent on context  than we'd like (e.g., can you trust Received: fields or
not) and they introduce a substantial amount of additional complexity. For
exmaple, you really need a way to select a specific occurrance of a field  to
make Received: field tests worthwhile. As such, I beleve they should be cast 
as a separate operation and extension, not something we try and attach to
this draft.

>   This would also make it easier for script writers to do more robust
>   time-based filtering based on Date:, since the server could also
>   contain functions for handling non-conforming but easily guessable
>   times, if they want to support that.

Agreed. But this is not the place for it IMO. I'm trying to find the time
to write up a separate date test that accomplishes this.

>   Looking only at the posts to this list shows people are still using
>   obs-zone, and if people on this list uses such MUAs, chances are
>   rather high that many people in the real world also does.

Sure, this is an issue that has to be accomodated in such tests.

> * A security consideration is that people should be aware that RFC
>   2047 encoded-word, IDNA etc potentially encode information that the
>   script wants to trigger on.  This should have been in RFC 3028, but
>   as variables makes it even more likely that people will try to use
>   sieve scripts to filter for virus etc it might be useful to mention
>   it.  Compare the sieve-body draft:

And the converse is also true: I may want to test for a specific sort of
encoded word (e.g., anyone sending a message to me with a subject in the gb2312
charset is probably sending spam) and that canont be done reliably at present.

>    Filters relying on string matches in the raw body of an e-mail
>    message may be more general than intended.  Text matches are no
>    replacement for a virus or spam filtering system.

Of course they aren't. Have we really reached the point where we 
have to belabor obvious points like this in security considerations sections?

> * The examples in Section 3.1 and 4.1.1 should be terminated with
>   semi-colons to be complete Sieve commands.

> * I feel variable variable names (e.g., ${foo-${bar}-baz}) would be
>   useful, but I can't come up with a good example why it is really
>   required so I'm just mentioning it if someone else can come up with
>   a illustrative example.

They may be useful but they add substantial complexity to some implementations.
Absent a very compelling use case I don't think this is something we want
to support.

				Ned

To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
From: Simon Josefsson <[email-masked]>
Date: Sat, 19 Apr 2003 12:49:52 +0200
Sender: [email-masked]

Kjetil Torgrim Homme <[email-masked]> writes:

> [Simon Josefsson]:
>>
>>   Kjetil Torgrim Homme <[email-masked]> writes:
>>   
>>   > the date itself should be no more than a few minutes earlier
>>   > than current time.  if it isn't, there is a misconfiguration or
>>   > an outage going on.
>>   
>>   The time in Date: are in general not the same as delivery time.
>>   Differences of several hours and days are typical.
>
> you should get a better email provider :-)
>
> huge mailing lists may introduce a delay of half an hour.  several
> hours is simply not an acceptable delay, and certainly not if it is
> typical.

Moderated lists are common, and if the moderator is out of town for a
week, the Date: will be a week late.

Offline clients are also common, and the typically put the current
time of hitting the "Send" button as the Date: value (as suggested by
RFC 2822).

>>   What is the difference between delivery time and current time?
>>   
>>   Consider the batch example again, what would SETDATE be
>>   initialized to in this case?  The delivery time is in general not
>>   available from a RFC 2822 message, so the implementation would
>>   probably simply pick current time.
>
> the latest Received header is a good bet.

Ah.  I think that should be mentioned, as one possible way to infer
the delivery time.

> all right, I'm not a native speaker, but how about
>
>    Sieve filtering should not be relied on as a security measure
>    against hostile e-mail messages.  Sieve is designed to do simple,
>    mostly static tests, and is not suitable for use as a spam or virus
>    checker, where the perpetrator has a motivation to vary the format
>    of the email in order to avoid filtering rules.

Very nice!

>>       For an example of a more general than expected test, consider
>>       looking for "xn--foo-bar" within a To: addr-spec in order to
>>       filter message addressed to a specific internationalized
>>       domain names into a separate folder, and an incoming message
>>       having an addr-spec of someone@(xn--foo-bar)example.org.
>
> if you use :address for matching, this won't be a problem.  if you use
> :header, there are more likely modes of failure.  e.g.,
>
>    if :header :matches [ "To", "Cc" ] "root@*.example.com"
>
> and a message with "To: [email-masked], [email-masked]"
>
> although this may be a common pitfall, I'm not sure warnings to "use
> the appropriate test" fits in here.

IMHO it is useful if all common pitfalls that lead to security
problems are discussed.

>>       For an example of a less general than expected test, consider
>>       looking for Subject: containing "MAKE MONEY FAST" to filter
>>       spam into a separate folder, and an incoming message having a
>>       Subject: of "=?CP-1252?q?MAKE_MONEY_FAST?=.
>
> I believe that message should be filtered just fine.

How?  Compare the following from RFC 3028.  Assuming the
implementation does not support CP-1252, I don't see how "MAKE MONEY
FAST" and "=?CP-1252?q?MAKE_MONEY_FAST?=" would match.  (The
assumption isn't a restriction, there will always be MUAs that
supports more charsets, or are less robust in their QP decoding, than
servers.)  Consider EBCDIC for a case where decoding the QP and only
using the ASCII characters would fail too.

,----
| 2.7.2.   Comparisons Across Character Sets
| 
|    All Sieve scripts are represented in UTF-8, but messages may involve
|    a number of character sets.  In order for comparisons to work across
|    character sets, implementations SHOULD implement the following
|    behavior:
| 
|       Implementations decode header charsets to UTF-8.  Two strings are
|       considered equal if their UTF-8 representations are identical.
|       Implementations should decode charsets represented in the forms
|       specified by [MIME] for both message headers and bodies.
|       Implementations must be capable of decoding US-ASCII, ISO-8859-1,
|       the ASCII subset of ISO-8859-* character sets, and UTF-8.
| 
|    If implementations fail to support the above behavior, they MUST
|    conform to the following:
| 
|       No two strings can be considered equal if one contains octets
|       greater than 127.
`----

>>   That reminds me, Sieve should support internationalized domain
>>   names by decoding them when they occur at the appropriate places
>>   (dot-atom's inside domain inside addr-spec, for instance).
>
> I think that is implied, really.  it does pose a problem for clients,
> they can't know whether the server supports it or not, so they need to
> duplicate their tests.  hmm, perhaps we do need an extension for it.

The IDNA specification says that if IDNs are in IDN-unaware domain
name slots, it MUST be encoded as ASCII.  Since the Sieve
specification does not discuss IDN, all domain name slots in Sieve
scripts are IDN-unaware.

Date: Sat, 19 Apr 2003 01:26:56 -0600
From: Alexey Melnikov <[email-masked]>
Organization: ACI WorldWide / MessagingDirect
To: Kjetil Torgrim Homme <[email-masked]>
CC: [email-masked]
Subject: Re: Integer variables
Sender: [email-masked]

Kjetil Torgrim Homme wrote:

> >   Am I allowed to do the following using "variables" extension:
> >
> >   set "NumVar" 100M;
>
> no.
>
> >   If the answer is yes, two more questions:
> >   1). How do we expand integer variables inside strings?
> >   2). Can a variable get a string value after it was assigned an integer
> >   value?
>
> the problem is rather that the variable can only be expanded inside a
> string, so it would lose its integer property.

Which is fine, as long as this is documented.
I believe the current document doesn't specify what types of variables are
allowed.
You have to either explicitly allow or prohibit this.

> do you have a use for integer variables?

You already have the "length" function. I was thinking something along the
lines of comparing lengths/counting headers/scoring.
However this will probably require some actions for simple arithmetic (+/-).

Cheers,
Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Watford, UK

Work Phone: +44 1923 81 2877
Home Page: http://orthanc.ab.ca/mel
IETF standard
related pages: http://orthanc.ab.ca/mel/devel/Links.html

I speak for myself only, not for my employer.
__________________________________________

Date: Sat, 19 Apr 2003 01:21:53 -0600
From: Alexey Melnikov <[email-masked]>
Organization: ACI WorldWide / MessagingDirect
To: Jutta Degener <[email-masked]>, [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft   (draft-homme-sieve-variables-00.txt))
Sender: [email-masked]

Alexey Melnikov wrote:

> Jutta Degener wrote:
>
> > On Sun, Apr 13, 2003 at 05:53:40PM +0200, Kjetil Torgrim Homme wrote:
> > > [Alexey Melnikov]:
> > > >
> > > >   In order to move imapflags extension forward I need support for
> > > >   set/list variables.
> >
> > I think we might be able to do without this.  What if you allow
> > (and ignore) empty strings in a [...] list?
> >
> > That way, you could set
> >
> >         set "aflag" "aflag"
> >
> >         ["${aflag}", "${bflag}", "${cflag}"]
> >
> > and have that come out as
> >
> >         ["aflag" "" ""]
> >
> > if bflag and cflag are unset.
> >
> > There are still things that you can do with a list algebra
> > that you can't do with this approach -- infinitely many
> > flags based on the header and body contents of a message --
> > but I don't think we want to do those things badly enough
> > to warrant adding three new commands and a variable data type.
>
> Surely three new actions shouldn't scare you :-).
> But I understand the complexity of multiple data types.
>
> Ok, I can live with this.
> It seems the only thing required to be said is that empty strings are
> ignored in a list that specifies flags to be set.
> I should also mention that each list member defines a separate flag and
> spaces in flag names are not allowed (due to IMAP restriction).

After I rewrote my example in "imapflags" I've realised how ugly this will
look, because
1). The script author has to remember all flags that were set on the
message and specify them all.
2). setflags has to be replaced with multiple "set"s as we have to clear
all flags.

So, I am thinking now about using a single string parameter (instead of a
string list) that contains space delimited flags. Adding flags (old
"addflags") to the list would be simpler, e.g.

set "flags" "${flags} \\Seen"

"removeflags" would be trickier to implement, but "string" test with
:matches can be used to test if a flag was set, e.g.

if string :matches "${flags}" "*\\Draft*" {
    set "flags" "${1}${2}"
}

Multiple spaces between flags must be treated as one.

Comments?

Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Watford, UK

Work Phone: +44 1923 81 2877
Home Page: http://orthanc.ab.ca/mel
IETF standard
related pages: http://orthanc.ab.ca/mel/devel/Links.html

I speak for myself only, not for my employer.
__________________________________________

To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
From: Philip Guenther <[email-masked]>
Subject: Re: Comments on draft-homme-sieve-variables-01.txt 
Date: Fri, 18 Apr 2003 20:57:58 -0700
Sender: [email-masked]

Kjetil Torgrim Homme <[email-masked]> writes:
>[Simon Josefsson]:
>>
>>   Kjetil Torgrim Homme <[email-masked]> writes:
>>   
>>   > the date itself should be no more than a few minutes earlier
>>   > than current time.  if it isn't, there is a misconfiguration or
>>   > an outage going on.
>>   
>>   The time in Date: are in general not the same as delivery time.
>>   Differences of several hours and days are typical.
>
>you should get a better email provider :-)

Not at all.  His provider has no control over the Date: header field as,
for the vast majority of messages, that header field was added by either
the sender's MUA or the MSA.  Desktop machines are often unsynchronized
and may have never been given the correct date, much less time.

Philip Guenther
<[email-masked]>

To: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
From: Kjetil Torgrim Homme <[email-masked]>
Date: 19 Apr 2003 04:14:00 +0200
Lines: 91
Sender: [email-masked]

[Simon Josefsson]:
>
>   Kjetil Torgrim Homme <[email-masked]> writes:
>   
>   > the date itself should be no more than a few minutes earlier
>   > than current time.  if it isn't, there is a misconfiguration or
>   > an outage going on.
>   
>   The time in Date: are in general not the same as delivery time.
>   Differences of several hours and days are typical.

you should get a better email provider :-)

huge mailing lists may introduce a delay of half an hour.  several
hours is simply not an acceptable delay, and certainly not if it is
typical.

>   > oh!  if you run the Sieve script in batch, long after the
>   > delivery was made, the current date is completely useless.
>   > SETDATE should be changed to initialise the variables to the
>   > time of delivery, not current time.
>   
>   What is the difference between delivery time and current time?
>   
>   Consider the batch example again, what would SETDATE be
>   initialized to in this case?  The delivery time is in general not
>   available from a RFC 2822 message, so the implementation would
>   probably simply pick current time.

the latest Received header is a good bet.  the final local delivery
may be held up, but should be very uncommon.  in the current mail
system of my University this can happen since the spool disk (my home
directory) is accessed through NFS.  these days, delivery to local
storage is becoming the typical mode of operation.

>   > I'd appreciate it if you could formulate a paragraph for me :-)
>   
>   Someone who knows english might be able to make the following
>   legible:
>   
>       Carelessly constructed tests may be both more general than
>       intended and also less general than intended.  This is a
>       generic problem with Sieve, but may become more important when
>       filtering decisions are made based on variables initialized
>       from data in message.  The moral of the story is that Sieve
>       tests are not a replacement for intelligent spam and virus
>       detection mechanisms, rather a solution that is intended to
>       work most of the time that can be circumvented by adaptive
>       senders.

all right, I'm not a native speaker, but how about

   Sieve filtering should not be relied on as a security measure
   against hostile e-mail messages.  Sieve is designed to do simple,
   mostly static tests, and is not suitable for use as a spam or virus
   checker, where the perpetrator has a motivation to vary the format
   of the email in order to avoid filtering rules.

>       For an example of a more general than expected test, consider
>       looking for "xn--foo-bar" within a To: addr-spec in order to
>       filter message addressed to a specific internationalized
>       domain names into a separate folder, and an incoming message
>       having an addr-spec of someone@(xn--foo-bar)example.org.

if you use :address for matching, this won't be a problem.  if you use
:header, there are more likely modes of failure.  e.g.,

   if :header :matches [ "To", "Cc" ] "root@*.example.com"

and a message with "To: [email-masked], [email-masked]"

although this may be a common pitfall, I'm not sure warnings to "use
the appropriate test" fits in here.

>       For an example of a less general than expected test, consider
>       looking for Subject: containing "MAKE MONEY FAST" to filter
>       spam into a separate folder, and an incoming message having a
>       Subject: of "=?CP-1252?q?MAKE_MONEY_FAST?=.

I believe that message should be filtered just fine.

>   That reminds me, Sieve should support internationalized domain
>   names by decoding them when they occur at the appropriate places
>   (dot-atom's inside domain inside addr-spec, for instance).

I think that is implied, really.  it does pose a problem for clients,
they can't know whether the server supports it or not, so they need to
duplicate their tests.  hmm, perhaps we do need an extension for it.

-- 
Kjetil T.

To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
From: Simon Josefsson <[email-masked]>
Date: Fri, 18 Apr 2003 18:57:39 +0200
Sender: [email-masked]

Kjetil Torgrim Homme <[email-masked]> writes:

> [Simon Josefsson]:
>>
>>   * The setdate command is useful, but wouldn't it be even more useful
>>     if there was a command that extracts comparable time/date
>>     variables from Date: headers?  To handled obs-zone's timezones.
>>     E.g., consider if I want to sort messages sent (Date:) between
>>     01 am and 04 am (in the senders timezone) into a folder
>>     INBOX.rants.
>
> like
>   SETDATE :header "Date";

Yes.  The string must be allowed to be a variable too, so you can
extract times from Received:, etc.

> it seems to me that the only interesting data to be found in Date: is
> the local time and time zone of the sender (I feel SETDATE should
> normalise the timezone to offset format if it recognises it).  the
> date itself should be no more than a few minutes earlier than current
> time.  if it isn't, there is a misconfiguration or an outage going on.

The time in Date: are in general not the same as delivery time.
Differences of several hours and days are typical.

> oh!  if you run the Sieve script in batch, long after the delivery was
> made, the current date is completely useless.  SETDATE should be
> changed to initialise the variables to the time of delivery, not
> current time.

What is the difference between delivery time and current time?

Consider the batch example again, what would SETDATE be initialized to
in this case?  The delivery time is in general not available from a
RFC 2822 message, so the implementation would probably simply pick
current time.  A delivery agent invoked by the MTA would also pick
current time for this, since current time is delivery time in a
delivery agent.  I'm probably just dense, but I don't see a
practically useful distinction between delivery and current time.

>>   * A security consideration is that people should be aware that RFC
>>     2047 encoded-word, IDNA etc potentially encode information that the
>>     script wants to trigger on.  This should have been in RFC 3028, but
>>     as variables makes it even more likely that people will try to use
>>     sieve scripts to filter for virus etc it might be useful to mention
>>     it.  Compare the sieve-body draft:
>>   
>>      Filters relying on string matches in the raw body of an e-mail
>>      message may be more general than intended.  Text matches are no
>>      replacement for a virus or spam filtering system.
>
> I'd appreciate it if you could formulate a paragraph for me :-)

Someone who knows english might be able to make the following legible:

    Carelessly constructed tests may be both more general than
    intended and also less general than intended.  This is a generic
    problem with Sieve, but may become more important when filtering
    decisions are made based on variables initialized from data in
    message.  The moral of the story is that Sieve tests are not a
    replacement for intelligent spam and virus detection mechanisms,
    rather a solution that is intended to work most of the time that
    can be circumvented by adaptive senders.

    For an example of a more general than expected test, consider
    looking for "xn--foo-bar" within a To: addr-spec in order to
    filter message addressed to a specific internationalized domain
    names into a separate folder, and an incoming message having an
    addr-spec of someone@(xn--foo-bar)example.org.  For an example of
    a less general than expected test, consider looking for Subject:
    containing "MAKE MONEY FAST" to filter spam into a separate
    folder, and an incoming message having a Subject: of
    "=?CP-1252?q?MAKE_MONEY_FAST?=.

That reminds me, Sieve should support internationalized domain names
by decoding them when they occur at the appropriate places (dot-atom's
inside domain inside addr-spec, for instance).

Date: Fri, 18 Apr 2003 12:45:40 -0400
From: Cyrus Daboo <[email-masked]>
To: [email-masked], [email-masked]
Subject: Re: Mailing list last call for draft-daboo-sieve-spamtest-03.txt
Sender: [email-masked]

Hi Ned,

--On Friday, April 11, 2003 8:12 AM -0700 [email-masked] wrote:

| (1) The document lacks the required IPR boilerplate. The IESG has recently
|     started pushing back on this.
|
| (2) The change history section needs to be marked "to be removed prior
|     to publication as an RFC".
|
| (3) The abstract should refer to the "sieve mail filtering language"
| rather     than just "sieve", in order to better put the document in
| context.
|
| (4) The conventions section should be moved so it appears after the
|     introduction and overview.
|
| (5) The abstract should not be numbered.

OK, all the above changes have been made in my working copy.

--On Friday, April 11, 2003 6:22 PM -0700 [email-masked] wrote:

|
|> I do have a few of draft nits that need to be addressed with a revised
|> version:
|
|> ...
|
| Just noticed another problem with the draft as it stands. It contains an
| example:
|
|         if spamtest :value "ge" :comparator "i;ascii-numeric" "3"
|         {
|             fileinto "INBOX.spam-trap";
|         }
|         elsif spamtest :is "NIL"
|         {
|             fileinto "INBOX.unclassified";
|         }
|
| This turns out not to work. The problem is that the "i;ascii-numeric"
| comparator is defined to rank all strings that don't begin with a digit
| after any string that does. So if the spamtest value is NIL the first
| if succeeds and the second one is never reached.
|
| This is easily corrected by reversing the clauses, of course. The fact
| that NILL will rank higher probably should be noted somewhere as well.

Examples have been fixed. I added a note to the General Considerations 
section that describes this issue with the numeric comparator and explains 
how to handle it. The fixed examples also have notes that point out the new 
ordering of the tests, referring back to the General Considerations section.

-- 
Cyrus Daboo

From: "Wolfgang Segmuller" <[email-masked]>
To: <[email-masked]>
Subject: Re: new version of the variables draft
Date: Fri, 18 Apr 2003 10:14:18 -0400
Sender: [email-masked]

From: "Kjetil Torgrim Homme" <[email-masked]>
>
> thanks.  how about:
>
> |  The default comparator is "i;ascii-casemap"
> +  The comparator only affects the result when certain modifiers are
> +  used.
>

This is good.

>
> >   I think that all elements of a syntax should be described where
> >   the element was introduced.  I was looking for section 4.1.2
> >   comparators, and didn't find it.
>
> well, the draft assumes familiarity with the base Sieve RFC.  I could
> stick in a "see [SIEVE] for more details on comparators", but it ought
> to be implied.  actually, even the default comparator could have been
> left out since it is specified in RFC 3028, but I thought I'd just
> make it clear since the text in the RFC is so centred on matching.
>

I wasn't refering to what comparators are in general.  I was refering to
what comparators do in this action.  The only place comparators were
mentioned was buried in the modifiers section of the action.  The addition
you proposed certainly covers my concerns.

Thanks,
Wolfgang

To: [email-masked]
Subject: Re: Comments on draft-homme-sieve-variables-01.txt
From: Kjetil Torgrim Homme <[email-masked]>
Date: 18 Apr 2003 16:11:28 +0200
Lines: 60
Sender: [email-masked]

[Simon Josefsson]:
>
>   * The setdate command is useful, but wouldn't it be even more useful
>     if there was a command that extracts comparable time/date
>     variables from Date: headers?  To handled obs-zone's timezones.
>     E.g., consider if I want to sort messages sent (Date:) between
>     01 am and 04 am (in the senders timezone) into a folder
>     INBOX.rants.

like
  SETDATE :header "Date";
vs. just
  SETDATE;
to access the current time.

Ned, you had some ideas for more date related tests, what do you
think?

it seems to me that the only interesting data to be found in Date: is
the local time and time zone of the sender (I feel SETDATE should
normalise the timezone to offset format if it recognises it).  the
date itself should be no more than a few minutes earlier than current
time.  if it isn't, there is a misconfiguration or an outage going on.

oh!  if you run the Sieve script in batch, long after the delivery was
made, the current date is completely useless.  SETDATE should be
changed to initialise the variables to the time of delivery, not
current time.

>   * A security consideration is that people should be aware that RFC
>     2047 encoded-word, IDNA etc potentially encode information that the
>     script wants to trigger on.  This should have been in RFC 3028, but
>     as variables makes it even more likely that people will try to use
>     sieve scripts to filter for virus etc it might be useful to mention
>     it.  Compare the sieve-body draft:
>   
>      Filters relying on string matches in the raw body of an e-mail
>      message may be more general than intended.  Text matches are no
>      replacement for a virus or spam filtering system.

I'd appreciate it if you could formulate a paragraph for me :-)

>   * The examples in Section 3.1 and 4.1.1 should be terminated with
>     semi-colons to be complete Sieve commands.

thanks.

>   * I feel variable variable names (e.g., ${foo-${bar}-baz}) would be
>     useful, but I can't come up with a good example why it is really
>     required so I'm just mentioning it if someone else can come up
>     with a illustrative example.

it could be used as a poor man's associative arrays.  there'd be no
function to list all keys in the "array", though.  if we do this, we
need a way of escaping the dollar character other than the ${dollar}
hack.  I don't think it is worth it.  if we want to support
associative arrays, let's do it explicitly.

-- 
Kjetil T.

To: [email-masked]
Subject: Comments on draft-homme-sieve-variables-01.txt
From: Simon Josefsson <[email-masked]>
Date: Fri, 18 Apr 2003 15:16:50 +0200
Sender: [email-masked]

* The setdate command is useful, but wouldn't it be even more useful
  if there was a command that extracts comparable time/date variables
  from Date: headers?  To handled obs-zone's timezones.  E.g.,
  consider if I want to sort messages sent (Date:) between 01 am and
  04 am (in the senders timezone) into a folder INBOX.rants.

  This would also make it easier for script writers to do more robust
  time-based filtering based on Date:, since the server could also
  contain functions for handling non-conforming but easily guessable
  times, if they want to support that.

  Looking only at the posts to this list shows people are still using
  obs-zone, and if people on this list uses such MUAs, chances are
  rather high that many people in the real world also does.

* A security consideration is that people should be aware that RFC
  2047 encoded-word, IDNA etc potentially encode information that the
  script wants to trigger on.  This should have been in RFC 3028, but
  as variables makes it even more likely that people will try to use
  sieve scripts to filter for virus etc it might be useful to mention
  it.  Compare the sieve-body draft:

   Filters relying on string matches in the raw body of an e-mail
   message may be more general than intended.  Text matches are no
   replacement for a virus or spam filtering system.

* The examples in Section 3.1 and 4.1.1 should be terminated with
  semi-colons to be complete Sieve commands.

* I feel variable variable names (e.g., ${foo-${bar}-baz}) would be
  useful, but I can't come up with a good example why it is really
  required so I'm just mentioning it if someone else can come up with
  a illustrative example.

To: <[email-masked]>
Subject: Re: new version of the variables draft
From: Kjetil Torgrim Homme <[email-masked]>
Date: 18 Apr 2003 00:59:25 +0200
Lines: 39
Sender: [email-masked]

[Wolfgang Segmuller]:
>
>   I think changing the paragraph that identifies the default comparator to:
>   
>       Comparators are used by the some modifiers to identify the
>       locale for case mapping.  See section "4.1.1.2. Case
>       modifiers" for how the comparator is used.  The default
>       comparator is "i;ascii-casemap".
>   
>   will make it clear what comparators are used for, instead of
>   having it buried in the modifiers section.  If you don't like the
>   forward reference, you can always move some of the discussion in
>   4.1.1.2 to this paragraph.

thanks.  how about:

|  The default comparator is "i;ascii-casemap"
+  The comparator only affects the result when certain modifiers are
+  used.

future extension might add new modifiers which aren't case modifiers.
for instance if a list variable type is introduced, a useful modifier
will be ":sort".

I think it is good to make clear that a SET without any modifiers can
ignore the comparator, anyway.

>   I think that all elements of a syntax should be described where
>   the element was introduced.  I was looking for section 4.1.2
>   comparators, and didn't find it.

well, the draft assumes familiarity with the base Sieve RFC.  I could
stick in a "see [SIEVE] for more details on comparators", but it ought
to be implied.  actually, even the default comparator could have been
left out since it is specified in RFC 3028, but I thought I'd just
make it clear since the text in the RFC is so centred on matching.

-- 
Kjetil T.

From: "Wolfgang Segmuller" <[email-masked]>
To: <[email-masked]>
Subject: Re: new version of the variables draft
Date: Thu, 17 Apr 2003 17:46:23 -0400
Sender: [email-masked]

----- Original Message -----
From: "Kjetil Torgrim Homme" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, April 17, 2003 1:34 PM
Subject: Re: new version of the variables draft

>
> [Wolfgang Segmuller]:
> >
> >   Did I miss something, in the Set action there is a comparator in
> >   the syntax, and a mention of a default value for it.  What do you
> >   need a comparator for in the Set action?
>
> | 4.1.1.2.  Case modifiers
> |
> |    These modifiers change the letters of the text from upper to
> |    lower case or vice versa.  The implementation MUST support
> |    US-ASCII, but is not required to handle the entire Unicode
> |    repertoire.  The comparator specified SHOULD be consulted to
> |    establish which locale to use.
>
> this isn't very useful until someone registers new comparators (which
> must be REQUIREd in the script before use), but it leaves the door
> open.
>
> (wording changes to make things more clear are always welcome.)
>

Thanks, I missed that in the text.

I think changing the paragraph that identifies the default comparator to:

    Comparators are used by the some modifiers to identify the locale for
    case mapping.  See section "4.1.1.2. Case modifiers" for how the
    comparator is used.  The default comparator is "i;ascii-casemap".

will make it clear what comparators are used for, instead of having it
buried in the modifiers section.  If you don't like the forward reference,
you can always move some of the discussion in 4.1.1.2 to this paragraph.

I think that all elements of a syntax should be described where the element
was introduced.  I was looking for section 4.1.2 comparators, and didn't
find it.

Wolfgang

Date: Thu, 17 Apr 2003 14:16:39 -0700 (PDT)
From: [email-masked]
Subject: Re: new version of the variables draft
To: Wolfgang Segmuller <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> Did I miss something, in the Set action there is a comparator in the syntax,
> and a mention of a default value for it.  What do you need a comparator for
> in the Set action?

It specifies how :upper, :lower and so on work.

				Ned

Date: Wed, 16 Apr 2003 16:36:03 -0700 (PDT)
From: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft (draft-homme-sieve-variables-00.txt))
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> [Ned Freed]:
> >
> >   Folks, I think we have reached a point where a revised I-D for the
> >   variables document is in order. I'm starting to lose track of
> >   where we are on some of these changes...

> I fully agree, but I'd like some feedback on a very important issue
> first, the syntax vs. semantics issue.

> semantics seems the easier bolt-on, but syntax is the smoothest change
> IMO.  in particular, the backslash handling feels more natural.
> consider "\${foo}".  if we change syntax, the backslash will quote the
> dollar so that it isn't a variable reference.  if we change semantics
> of strings, the backslash has no effect.

I'm personally in the semantics camp. Smooth changes are good.

				Ned

To: <[email-masked]>
Subject: Re: new version of the variables draft
From: Kjetil Torgrim Homme <[email-masked]>
Date: 17 Apr 2003 19:34:59 +0200
Lines: 22
Sender: [email-masked]

[Wolfgang Segmuller]:
>
>   Did I miss something, in the Set action there is a comparator in
>   the syntax, and a mention of a default value for it.  What do you
>   need a comparator for in the Set action?

| 4.1.1.2.  Case modifiers
| 
|    These modifiers change the letters of the text from upper to
|    lower case or vice versa.  The implementation MUST support
|    US-ASCII, but is not required to handle the entire Unicode
|    repertoire.  The comparator specified SHOULD be consulted to
|    establish which locale to use.

this isn't very useful until someone registers new comparators (which
must be REQUIREd in the script before use), but it leaves the door
open.

(wording changes to make things more clear are always welcome.)

-- 
Kjetil T.

Date: Thu, 17 Apr 2003 09:57:34 -0600
From: Alexey Melnikov <[email-masked]>
Organization: ACI WorldWide / MessagingDirect
To: Kjetil Torgrim Homme <[email-masked]>
CC: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft  (draft-homme-sieve-variables-00.txt))
Sender: [email-masked]

Jutta Degener wrote:

> On Thu, Apr 17, 2003 at 12:44:57AM +0200, Kjetil Torgrim Homme wrote:
> > [Ned Freed]:
> > >
> > >   Folks, I think we have reached a point where a revised I-D for the
> > >   variables document is in order. I'm starting to lose track of
> > >   where we are on some of these changes...
> >
> > I fully agree, but I'd like some feedback on a very important issue
> > first, the syntax vs. semantics issue.
> >
> > semantics seems the easier bolt-on, but syntax is the smoothest change
> > IMO.  in particular, the backslash handling feels more natural.
> > consider "\${foo}".  if we change syntax, the backslash will quote the
> > dollar so that it isn't a variable reference.  if we change semantics
> > of strings, the backslash has no effect.
>
> The gut reaction of a shell programmer will probably differ,
> but I'd rather not change the syntax.  To me, string scanning
> and variable extension are different stages and must not
> affect each other.

I fully agree with this.

Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Watford, UK

Work Phone: +44 1923 81 2877
Home Page: http://orthanc.ab.ca/mel
IETF standard
related pages: http://orthanc.ab.ca/mel/devel/Links.html

I speak for myself only, not for my employer.
__________________________________________

From: "Wolfgang Segmuller" <[email-masked]>
To: <[email-masked]>
Subject: Re: new version of the variables draft
Date: Thu, 17 Apr 2003 09:11:40 -0400
Sender: [email-masked]

Did I miss something, in the Set action there is a comparator in the syntax,
and a mention of a default value for it.  What do you need a comparator for
in the Set action?

Wolfgang

To: [email-masked]
Subject: new version of the variables draft
From: Kjetil Torgrim Homme <[email-masked]>
Date: 17 Apr 2003 07:26:18 +0200
Lines: 8
Sender: [email-masked]

--=-=-=

I just submitted a new version of the draft to IETF.  I include it
here for convenience.

--=-=-=
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: attachment;
  filename=draft-homme-sieve-variables-01.txt
Content-Transfer-Encoding: quoted-printable
Content-Description: variables-01

Network Working Group                                        K. T. Homme
Document: draft-homme-sieve-variables-01.txt          University of Oslo
Expires October 17, 2003                                     17 Apr 2003

                      Sieve -- Variables Extension

Status of this Memo

   This document is an Internet-Draft and is subject to all provisions
   of Section 10 of RFC2026.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference mate=AD
   rial or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt

   To view the list Internet-Draft Shadow Directories, see
   http://www.ietf.org/shadow.html.

   Distribution of this memo is unlimited.

Abstract

   In advanced filtering rule sets, it is useful to keep state or con=AD
   figuration details across rules.  This extension adds an action to
   store data in variables, an action to retrieve the current time,
   changes the interpolation of strings, and supplies a new test so that
   the value of a string can be examined.

0.  Meta-information on this draft

   This information is intended to facilitate discussion.  It will be
   removed when this document leaves the Internet-Draft stage.

0.1.  Discussion

   This draft is intended to be an extension to the Sieve mail filtering
   language, available from the RFC repository as

Homme                                                           [Page 1]

Internet Draft        Sieve -- Variables Extension           17 Apr 2003

   <ftp://ftp.ietf.org/rfc/rfc3028.txt>.

   This draft and the Sieve language itself are being discussed on the
   MTA Filters mailing list at <[email-masked]>.  Subscription
   requests can be sent to <[email-masked]> (send an
   email message with the word "subscribe" in the body).  More informa=AD
   tion on the mailing list along with a WWW archive of back messages is
   available at <http://www.imc.org/ietf-mta-filters/>.

0.2.  Noted Changes

0.2.1.  Changes since -00

a)   allow generic time zone names, without requiring implementations to
     support it.  added a "${timezone}" variable so that the user can
     check if the implementation does support the time zone name he
     wants.  the default time zone was changed to localtime again.

b)   allow back references from :matches as well as :regex.

c)   added a section on implementation limits.

d)   clarified global scope so that it spans include.

e)   clarified that this draft only affects scripts which require "vari=AD
     ables".

f)   changed modifiers into being tagged arguments for SET, added prece=AD
     dence table.

g)   added optional COMPARATOR to SET to solve the internationalisation
     problem with :lower etc.

h)   the name of the variable being SET is passed in a string to conform
     with overall Sieve grammar.  this string is explicitly disallowed
     from containing variable references.

0.3.  Open Issues

a)   should we include more predefined variables to access the time?
     (weekday, week number (US, EU and/or ISO?), name of month, name of
     weekday, ...)  could use strftime(3c) as a list of what to offer,
     but the names should be in English.

b)   this extension is particularily useful if fileinto creates new
     folders on demand.  [SIEVE] doesn't prohibit this, and currently
     some implementations will create new folders automatically, others
     won't.

c)   the NOTIFY draft has variables, too.  it would be nice if the syn=AD
     tax for the two extensions agreed.  a changed NOTIFY can be used on
     its own without the variables extension, the user simply won't be

Homme                                                           [Page 2]

Internet Draft        Sieve -- Variables Extension           17 Apr 2003

     able to configure the notification message to include different
     snippets from the message.

1.  Introduction

   This is an extension to the Sieve language defined by [SIEVE].  It
   adds support for storing and referencing data in string variables.
   The mechanisms detailed in this document will only apply to Sieve
   scripts which include a require clause for the "variables" extension.
   The require clauses themselves are not affected by this extension.

   Conventions for notations are as in [SIEVE] section 1.1, including
   use of [KEYWORDS].

2.  Capability Identifier

   The capability string associated with the extension defined in this
   document is "variables".

3.  Interpretation of strings

   This extension changes the semantics of quoted-string, multi-line-
   literal and multi-line-dotstuff found in [SIEVE] to enable the inclu=AD
   sion of the value of variables.  The syntax follows [ABNF].

      variable-ref        =3D  "${" variable-name "}"
      variable-name       =3D  num-variable / identifier
      num-variable        =3D  1*DIGIT

   When the string is evaluated, substrings matching variable-ref shall
   be replaced by the value of variable-name.  Only one pass through the
   string shall be done.  Variable names are case insensitive.  Unknown
   variables are replaced by the empty string.  As per the grammar,
   illegal variable names leaves the would-be variable-ref verbatim,
   since it doesn't match the variable-ref syntax.

   Examples:
      "&%${}!"     =3D> unchanged, as the empty string is an illegal
                      identifier
      "${doh!}"    =3D> unchanged, as "!" is illegal in identifiers

      The variable company holds the value "ACME".  No other variables
      are set.

         "${full}"    =3D> the empty string
         "${company}" =3D> "ACME"
         "${President, ${Company} Inc.}"
                      =3D> "${President, ACME Inc.}"

   The expanded string MUST use the variable values which are current
   when control reaches the statement the string is part of.

Homme                                                           [Page 3]

Internet Draft        Sieve -- Variables Extension           17 Apr 2003

3.1.  Quoting

   The semantics of quoting using backslash are not changed: backslash
   quoting is resolved before doing variable substitution.

   Examples:
      "${fo\o}"  =3D> ${foo}  =3D> the expansion of variable foo.
      "${fo\\o}" =3D> ${fo\o} =3D> illegal identifier =3D> left verbatim.
      "\${foo}"  =3D> ${foo}  =3D> the expansion of variable foo.
      "\\${foo}" =3D> \${foo} =3D> a backslash character followed by the
                               expansion of variable foo.

   If it is required to include a character sequence such as "${beep}"
   verbatim in a text literal, the user can define a variable to circum=AD
   vent expansion to the empty string.

   Example:
      set dollar "$"
      set text "regarding ${dollar}{beep}"

3.2.  Numeric variables

   The decimal value of the numeric variable name will index the list of
   matching strings from the most recently evaluated match of type
   ":matches" or ":regex".  The list is empty if the match was unsuc=AD
   cessful.

   For ":matches", the list will contain one string for each wildcard in
   the match pattern.  Each string holds what the corresponding wildcard
   expands to, possibly the empty string.  The wildcards expand greed=AD
   ily.

   For ":regex", the list will contain the strings corresponding to the
   group operators.  The groups are ordered by the position of the open=AD
   ing parenthesis, from left to right.

   The first string in the list has index 1.  If the index is out of
   range, the empty string will be substituted.  Index 0 returns the
   number of strings in the list.

   Example:
      require [ "fileinto", "regex", "variables" ];

      if header :regex "List-ID" "<(.*)@" {
          fileinto "lists.${1}"; stop;
      }

      # this is equivalent to the above:
      if header :matches "List-ID" "<*@" {
          fileinto "lists.${1}"; stop;
      }

      if header :matches [ "To", "Cc" ] "coyote@**.com" {

Homme                                                           [Page 4]

Internet Draft        Sieve -- Variables Extension           17 Apr 2003

          # ${0} is always "2", and ${2} is always the empty string.
          fileinto "business.${1}"; stop;
      } else {
          # ${0} is always "0"
          stop;
      }

4.  Action Commands

   This extension defines two actions, "set" and "setdate", both of
   which MUST be supported by an implementation of this extension.

4.1.  Action set

   Syntax:   set [MODIFIER] [COMPARATOR] <name: string> <value: string>

   The "set" action stores the specified value in the variable called
   name.  name MUST be a constant string without variable references.
   The contents of name MUST conform to the syntax of identifier.  An
   illegal name MUST cause a syntax error.

   The default comparator is "i;ascii-casemap".

   All variables have global scope: they are visible until processing
   stops.  Variable names are case insensitive.

   Example:
      set "honorific"  "Mr";
      set "first_name" "Wile";
      set "last_name"  "Coyote";
      set "vacation" text:
      Dear ${HONORIFIC} ${last_name},
      I'm out, please leave a message after the meep.
      .
      ;

   "set" does not affect the implicit keep.

4.1.1.  Modifiers

   Modifiers are applied on value before it is stored in the variable.
   Modifier names are case insensitive.  Unknown modifiers MUST yield a
   syntax error.  More than one modifier can be specified, in which case
   they are applied according to this precedence list, highest value
   first:

Homme                                                           [Page 5]

Internet Draft        Sieve -- Variables Extension           17 Apr 2003

                        Precedence     Modifier
                       -----------------------------
                            1          :length
                       -----------------------------
                            2          :lowerfirst
                                       :upperfirst
                       -----------------------------
                            3          :lower
                                       :upper

   If two or more modifiers of the same precedence are used, they can be
   applied in any order.

   Examples:
      set "var" "juMBlEd lETteRS"           =3D> "juMBlEd lETteRS"
      set :length "var" "${var}"            =3D> "15"
      set :lower "var" "${var}"             =3D> "jumbled letters"
      set :upperfirst "var" "${var}"        =3D> "JuMBlEd lETteRS"
      set :upperfirst :lower "var" "{$var}" =3D> "Jumbled letters"

4.1.1.1.  Modifier ":length"

   The value is the decimal number of letters in the expansion, con=AD
   verted to a string.

4.1.1.2.  Case modifiers

   These modifiers change the letters of the text from upper to lower
   case or vice versa.  The implementation MUST support US-ASCII, but is
   not required to handle the entire Unicode repertoire.  The comparator
   specified SHOULD be consulted to establish which locale to use.

4.1.1.2.1.  Modifier ":upper"

   All lower case letters are converted to their upper case counterpart.

4.1.1.2.2.  Modifier ":lower"

   All upper case letters are converted to their lower case counterpart.

4.1.1.2.3.  Modifier ":upperfirst"

   The first character of the string is converted to upper case if it is
   a letter and set in lower case.  The rest of the string is left
   unchanged.

Homme                                                           [Page 6]

Internet Draft        Sieve -- Variables Extension           17 Apr 2003

4.1.1.2.4.  Modifier ":lowerfirst"

   The first character of the string is converted to lower case if it is
   a letter and set in upper case.  The rest of the string is left
   unchanged.

4.2.  Action setdate

   Syntax: setdate [ <time-zone: string> ]

   The value of time-zone SHOULD be a well-known name, or an offset rel=AD
   ative to UTC.  All implementations MUST support the time-offset syn=AD
   tax

           time-offset  =3D  ( "+" / "-" ) 4DIGIT

   time-offset should be interpreted the same way as "zone" in [IMAIL].

     Note: There is currently no registry for time zones.  If IETF
     establishes one, its names SHOULD be used.  In the absence of
     such a registry, [TZ] is the most widespread collection of
     time zone definitions and its use as a reference is RECOM=AD
     MENDED.

   If the time-zone is left out or not recognised, the local time zone
   SHOULD be used.

   The action setdate initialises a few variables:

      ${year}     =3D> the current year, "0000" .. "9999"
      ${month}    =3D> the current month, "01" .. "12"
      ${day}      =3D> the current day, "01" .. "31"
      ${hour}     =3D> the current hour, "00" .. "23"
      ${minute}   =3D> the current hour, "00" .. "59"
      ${second}   =3D> the current second, "00" .. "59"
      ${timezone} =3D> the time zone in use.  If the user specified a
                     time zone which was recognised, ${timezone} will
                     contain the name given.  Otherwise, the value
                     MUST be the server's default time zone in offset
                     format.

   These variables SHOULD reference the time when execution of the Sieve
   script reaches the statement.  All calls to setdate MUST refer to the
   same point in time.

   "setdate" does not affect the implicit keep.

5.  Test string

   Syntax: string [MATCH-TYPE] [COMPARATOR]
           <source: string-list> <key-list: string-list>

Homme                                                           [Page 7]

Internet Draft        Sieve -- Variables Extension           17 Apr 2003

   The "string" test evaluates to true if any of the strings matches any
   key.  The type of match defaults to ":is".

6.  Implementation Limits

   An implementation of this draft MUST support at least 128 distinct
   variables.  The supported length of variable names MUST be at least
   32 characters.  Each variable MUST be able to hold at least 4000
   characters.  Attempts to set the variable to a value larger than what
   the implementation supports MUST be treated as an error.

   Numeric variables ${1} through ${9} MUST be supported.  Referencing
   higher indices than is supported is a syntax error which MUST be dis=AD
   covered at compile-time.  If the string matching a wildcard or a
   regex group operator exceeds the maximum variable size, the implemen=AD
   tation SHOULD truncate it and MUST NOT treat it as an error.

7.  Security Considerations

   When combined with the regex extension, strings can contain arbitrary
   values controlled by the sender of the e-mail if the author of the
   script isn't careful.

   The introduction of variables makes advanced decision making easier
   to write, but since no looping construct is provided, all Sieve
   scripts will terminate orderly.

8.  Acknowledgments

   Thanks to Jutta Degener, Ned Freed, Lawrence Greenfield, Peder Stray
   and Nigel Swinson for valuable feedback.

9.  Author's Address

   Kjetil T. Homme
   Frydens g 5B
   0564 Oslo, Norway

   Phone: +47 9366 0091
   E-mail: [email-masked]

Appendix A.  References

     [ABNF]     D. Crocker, Ed., "Augmented BNF for Syntax Specifica=AD
                tions: ABNF", Internet Mail Consortium, RFC 2234, Novem=AD
                ber 1997

Homme                                                           [Page 8]

Internet Draft        Sieve -- Variables Extension           17 Apr 2003

     [IMAIL]    P. Resnick, Ed., "Internet Message Format", QUALCOMM
                Incorporated, April 2001.

     [KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate
                Requirement Levels", Harvard University, RFC 2119, March
                1997.

     [SIEVE]    Showalter, T., "Sieve: A Mail Filtering Language", Mira=AD
                point, RFC 3028, January 2001.

     [TZ]       Olson, A.D., et al, Time zone code and data,
                ftp://elsie.nci.nih.gov/pub/, updated periodically.

Appendix B.  Full Copyright Statement

   Copyright (C) The Internet Society 2003. All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this doc=AD
   ument itself may not be modified in any way, such as by removing the
   copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of develop=AD
   ing Internet standards in which case the procedures for copyrights
   defined in the Internet Standards process must be followed, or as
   required to translate it into languages other than English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MER=AD
   CHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Homme                                                           [Page 9]

--=-=-=

-- 
Kjetil T.

--=-=-=--

To: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft (draft-homme-sieve-variables-00.txt))
From: Kjetil Torgrim Homme <[email-masked]>
Date: 17 Apr 2003 01:46:40 +0200
Lines: 25
Sender: [email-masked]

[Jutta Degener]:
>
>   On Thu, Apr 17, 2003 at 12:44:57AM +0200, Kjetil Torgrim Homme wrote:
>   > semantics seems the easier bolt-on, but syntax is the smoothest
>   > change IMO.  in particular, the backslash handling feels more
>   > natural.  consider "\${foo}".  if we change syntax, the
>   > backslash will quote the dollar so that it isn't a variable
>   > reference.  if we change semantics of strings, the backslash has
>   > no effect.
>   
>   The gut reaction of a shell programmer will probably differ, but
>   I'd rather not change the syntax.  To me, string scanning and
>   variable extension are different stages and must not affect each
>   other.

duly noted.

>   If you do change the syntax, where do you stop?  Why should \ be
>   special for variable syntax, but not for :regex and :matches
>   pattern syntax?  I don't want to have to answer that.

interesting point!  I'm not sure I want to explain that, either :-)

-- 
Kjetil T.

Date: Wed, 16 Apr 2003 16:25:55 -0700
From: Jutta Degener <[email-masked]>
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft (draft-homme-sieve-variables-00.txt))
Sender: [email-masked]

On Thu, Apr 17, 2003 at 12:44:57AM +0200, Kjetil Torgrim Homme wrote:
> [Ned Freed]:
> >
> >   Folks, I think we have reached a point where a revised I-D for the
> >   variables document is in order. I'm starting to lose track of
> >   where we are on some of these changes...
> 
> I fully agree, but I'd like some feedback on a very important issue
> first, the syntax vs. semantics issue.
> 
> semantics seems the easier bolt-on, but syntax is the smoothest change
> IMO.  in particular, the backslash handling feels more natural.
> consider "\${foo}".  if we change syntax, the backslash will quote the
> dollar so that it isn't a variable reference.  if we change semantics
> of strings, the backslash has no effect.

The gut reaction of a shell programmer will probably differ,
but I'd rather not change the syntax.  To me, string scanning
and variable extension are different stages and must not
affect each other.

If you do change the syntax, where do you stop?  Why should
\ be special for variable syntax, but not for :regex and
:matches pattern syntax?  I don't want to have to answer that.

Jutta

To: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft (draft-homme-sieve-variables-00.txt))
From: Kjetil Torgrim Homme <[email-masked]>
Date: 17 Apr 2003 00:44:57 +0200
Lines: 17
Sender: [email-masked]

[Ned Freed]:
>
>   Folks, I think we have reached a point where a revised I-D for the
>   variables document is in order. I'm starting to lose track of
>   where we are on some of these changes...

I fully agree, but I'd like some feedback on a very important issue
first, the syntax vs. semantics issue.

semantics seems the easier bolt-on, but syntax is the smoothest change
IMO.  in particular, the backslash handling feels more natural.
consider "\${foo}".  if we change syntax, the backslash will quote the
dollar so that it isn't a variable reference.  if we change semantics
of strings, the backslash has no effect.

-- 
Kjetil T.

Date: Wed, 16 Apr 2003 13:30:51 -0700 (PDT)
From: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft (draft-homme-sieve-variables-00.txt))
To: Alexey Melnikov <[email-masked]>
Cc: Jutta Degener <[email-masked]>, [email-masked]
Sender: [email-masked]

Folks, I think we have reached a point where a revised I-D for the
variables document is in order. I'm starting to lose track of where
we are on some of these changes...

				Ned

Date: Tue, 15 Apr 2003 15:42:03 -0700
From: Jutta Degener <[email-masked]>
To: Kjetil Torgrim Homme <[email-masked]>
Cc: Sieve Mailing List <[email-masked]>
Subject: Re: variables: dynamic match patterns
Sender: [email-masked]

On Mon, Apr 14, 2003 at 10:19:17PM +0200, Kjetil Torgrim Homme wrote:
> 
> [Jutta Degener]:
> >
> >   Hm.  That's a reasonable offer, Kjetil, but I'd rather eat the
> >   complexity as an implementor than to place it on the users and
> >   client writers by making this be an implementation-specific
> >   difference.
> 
> well, that is one side of it.  the other side is that of the server
> administrators.  if you must support multipass searches in body, this
> may be a performance hit for servers.  the administrator has few
> options: pray that people won't use it too often, buy more hardware
> (RAM!), or turn off the body extension altogether.

I strongly feel that performance should be addressed on a global
level, not on the level of individual features.

An ISP might want to restrict, and a vendor of tools might offer
a way to restrict, the amount of time and memory used by a sieve
script's execution (or by an IMAP search, for that matter).
That's a good and safe thing to do.

Disabling individual features is a stopgap measure in the absence
of better tools, but while desperate ISPs will do it, we shouldn't
do it at the specification level.

(Neither should we specify mechanisms that are needlessly wasteful,
but I don't think these are.)

Jutta

Date: Tue, 15 Apr 2003 12:02:18 -0600
From: Alexey Melnikov <[email-masked]>
Organization: ACI WorldWide / MessagingDirect
To: Cyrus Daboo <[email-masked]>
CC: Sieve Mailing List <[email-masked]>
Subject: Re: Draft for script 'include' capability
Sender: [email-masked]

Cyrus Daboo wrote:

> Hi Alexey,
>
> --On Monday, April 14, 2003 11:30 PM -0600 Alexey Melnikov
> <[email-masked]> wrote:
>
> |> From my own experience: I came across a C compiler that was treating
> |> missing
> | include files as empty. I was very surprised as a user. So, I am in favor
> | of being explicit and fail interpretation/compilation when a file doesn't
> | exist.
>
> Alternatively, we could allow a ':nofail' parameter to include so that a
> user could explicitly turn on silent failures for missing include files.
> Thus if a user really wanted to do something along the lines of what Rob
> proposed, they could do that, e.g.:
>
> include :nofail "my_optional_vacation_script";

I don't think you should be that flexible. Just pick one way.

Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Watford, UK

Work Phone: +44 1923 81 2877
Home Page: http://orthanc.ab.ca/mel
IETF standard
related pages: http://orthanc.ab.ca/mel/devel/Links.html

I speak for myself only, not for my employer.
__________________________________________

Date: Tue, 15 Apr 2003 13:41:03 -0400
From: Ken Murchison <[email-masked]>
Organization: Oceana Matrix Ltd.
To: Alexey Melnikov <[email-masked]>
CC: Kjetil Torgrim Homme <[email-masked]>, Sieve Mailing List <[email-masked]>
Subject: Re: Draft for script 'include' capability
Sender: [email-masked]

Alexey Melnikov wrote:
> 
> > >   > |     3   How should non-exist include scripts be handled?
> > >   >
> > >   > error at compile-time or run-time depending on the implementation.
> > >
> > >   I'd argue that these should be interpreted to be empty scripts,
> > >   since I suspect runtime errors could be more confusing to the end
> > >   user.  (Since generally users don't see explicit error notices
> > >   from sieve runs).
> > >
> > >   The advantage of interpreting it as an empty script is you can
> > >   have your main script include stuff like "my-vacation-script"
> > >   which then can just be deleted when you come back, as opposed to
> > >   having to modify your main script.
> >
> > heh.  I'd prefer to keep my vacation-script around, and just disable
> > it from the main script.  I see your point, though.
> >
> > >   I guess the issue is what does the user expect to happen, and I
> > >   don't really like causing one script to start failing just because
> > >   an included script dissapears.
> >
> > how about typos?  those will be hard to find.
> 
> >From my own experience: I came across a C compiler that was treating missing
> include files as empty. I was very surprised as a user. So, I am in favor of
> being explicit and fail interpretation/compilation when a file doesn't
> exist.

This is my feeling as well.

-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

Date: Tue, 15 Apr 2003 13:36:51 -0400
From: Cyrus Daboo <[email-masked]>
To: Alexey Melnikov <[email-masked]>, Kjetil Torgrim Homme <[email-masked]>
cc: Sieve Mailing List <[email-masked]>
Subject: Re: Draft for script 'include' capability
Sender: [email-masked]

Hi Alexey,

--On Monday, April 14, 2003 11:30 PM -0600 Alexey Melnikov 
<[email-masked]> wrote:

|> From my own experience: I came across a C compiler that was treating
|> missing
| include files as empty. I was very surprised as a user. So, I am in favor
| of being explicit and fail interpretation/compilation when a file doesn't
| exist.

Alternatively, we could allow a ':nofail' parameter to include so that a 
user could explicitly turn on silent failures for missing include files. 
Thus if a user really wanted to do something along the lines of what Rob 
proposed, they could do that, e.g.:

include :nofail "my_optional_vacation_script";

-- 
Cyrus Daboo

Date: Tue, 15 Apr 2003 09:49:05 -0700 (PDT)
From: [email-masked]
Subject: Re: variables: scoping
To: Kjetil Torgrim Homme <[email-masked]>
Cc: Sieve Mailing List <[email-masked]>
Sender: [email-masked]

> [Ned Freed]:
> >
> >   I strongly object to this proposal. It adds considerable
> >   implementation complexity yet achieves negligable benefits.

> okay.  my proposal demonstrates that the ability can be added later if
> need be, anyway.  (variables must have global scope (across includes)
> now to enable that extension later.)

Good point, and sufficient IMO to table this whole thing for now.

				Ned

Date: Mon, 14 Apr 2003 23:30:59 -0600
From: Alexey Melnikov <[email-masked]>
Organization: ACI WorldWide / MessagingDirect
To: Kjetil Torgrim Homme <[email-masked]>
CC: Sieve Mailing List <[email-masked]>
Subject: Re: Draft for script 'include' capability
Sender: [email-masked]

> >   > |     3   How should non-exist include scripts be handled?
> >   >
> >   > error at compile-time or run-time depending on the implementation.
> >
> >   I'd argue that these should be interpreted to be empty scripts,
> >   since I suspect runtime errors could be more confusing to the end
> >   user.  (Since generally users don't see explicit error notices
> >   from sieve runs).
> >
> >   The advantage of interpreting it as an empty script is you can
> >   have your main script include stuff like "my-vacation-script"
> >   which then can just be deleted when you come back, as opposed to
> >   having to modify your main script.
>
> heh.  I'd prefer to keep my vacation-script around, and just disable
> it from the main script.  I see your point, though.
>
> >   I guess the issue is what does the user expect to happen, and I
> >   don't really like causing one script to start failing just because
> >   an included script dissapears.
>
> how about typos?  those will be hard to find.

>From my own experience: I came across a C compiler that was treating missing
include files as empty. I was very surprised as a user. So, I am in favor of
being explicit and fail interpretation/compilation when a file doesn't
exist.

Cheers,
Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Watford, UK

Work Phone: +44 1923 81 2877
Home Page: http://orthanc.ab.ca/mel
IETF standard
related pages: http://orthanc.ab.ca/mel/devel/Links.html

I speak for myself only, not for my employer.
__________________________________________

To: Sieve Mailing List <[email-masked]>
Subject: Re: variables: scoping
From: Kjetil Torgrim Homme <[email-masked]>
Date: 15 Apr 2003 14:22:15 +0200
Lines: 11
Sender: [email-masked]

[Ned Freed]:
>
>   I strongly object to this proposal. It adds considerable
>   implementation complexity yet achieves negligable benefits.

okay.  my proposal demonstrates that the ability can be added later if
need be, anyway.  (variables must have global scope (across includes)
now to enable that extension later.)

-- 
Kjetil T.

To: [email-masked]
Subject: Re: Integer variables
From: Kjetil Torgrim Homme <[email-masked]>
Date: 15 Apr 2003 13:33:25 +0200
Lines: 25
Sender: [email-masked]

[Alexey Melnikov]:
>
>   I don't think this was discussed, excuse me if I've missed the
>   discussion.

it hasn't been discussed.

>   Am I allowed to do the following using "variables" extension:
>   
>   set "NumVar" 100M;

no.

>   If the answer is yes, two more questions:
>   1). How do we expand integer variables inside strings?
>   2). Can a variable get a string value after it was assigned an integer
>   value?

the problem is rather that the variable can only be expanded inside a
string, so it would lose its integer property.

do you have a use for integer variables?

-- 
Kjetil T.

Date: Mon, 14 Apr 2003 23:02:15 -0600
From: Alexey Melnikov <[email-masked]>
Organization: ACI WorldWide / MessagingDirect
To: [email-masked]
Subject: Integer variables
Sender: [email-masked]

I don't think this was discussed, excuse me if I've missed the
discussion.
Am I allowed to do the following using "variables" extension:

set "NumVar" 100M;

If the answer is yes, two more questions:
1). How do we expand integer variables inside strings?
2). Can a variable get a string value after it was assigned an integer
value?

Regards,
Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Watford, UK

Work Phone: +44 1923 81 2877
Home Page: http://orthanc.ab.ca/mel
IETF standard
related pages: http://orthanc.ab.ca/mel/devel/Links.html

I speak for myself only, not for my employer.
__________________________________________

Date: Mon, 14 Apr 2003 20:38:17 -0600
From: Alexey Melnikov <[email-masked]>
Organization: ACI WorldWide / MessagingDirect
To: Jutta Degener <[email-masked]>
CC: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft   (draft-homme-sieve-variables-00.txt))
Sender: [email-masked]

Jutta Degener wrote:

> On Sun, Apr 13, 2003 at 05:53:40PM +0200, Kjetil Torgrim Homme wrote:
> > [Alexey Melnikov]:
> > >
> > >   In order to move imapflags extension forward I need support for
> > >   set/list variables.
>
> I think we might be able to do without this.  What if you allow
> (and ignore) empty strings in a [...] list?
>
> That way, you could set
>
>         set "aflag" "aflag"
>
>         ["${aflag}", "${bflag}", "${cflag}"]
>
> and have that come out as
>
>         ["aflag" "" ""]
>
> if bflag and cflag are unset.
>
> There are still things that you can do with a list algebra
> that you can't do with this approach -- infinitely many
> flags based on the header and body contents of a message --
> but I don't think we want to do those things badly enough
> to warrant adding three new commands and a variable data type.

Surely three new actions shouldn't scare you :-).
But I understand the complexity of multiple data types.

Ok, I can live with this.
It seems the only thing required to be said is that empty strings are
ignored in a list that specifies flags to be set.
I should also mention that each list member defines a separate flag and
spaces in flag names are not allowed (due to IMAP restriction).

Cheers,
Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Watford, UK

Work Phone: +44 1923 81 2877
Home Page: http://orthanc.ab.ca/mel
IETF standard
related pages: http://orthanc.ab.ca/mel/devel/Links.html

I speak for myself only, not for my employer.
__________________________________________

Date: Mon, 14 Apr 2003 17:03:52 -0400
From: Cyrus Daboo <[email-masked]>
To: Rob Siemborski <[email-masked]>, Kjetil Torgrim Homme <[email-masked]>
cc: Sieve Mailing List <[email-masked]>
Subject: Re: Draft for script 'include' capability
Sender: [email-masked]

Hi Rob,

--On Monday, April 14, 2003 4:37 PM -0400 Rob Siemborski 
<[email-masked]> wrote:

|> I prefer
|>   include :global "spam-tests";
|> over
|>   include "/global/spam-tests";
|>
|> the default should be to look in the personal folder.
|
| I like this.

Seems OK to me too, and provides a little better extensibility -- see next 
comment.

|> | 4 Open Issues:
|> |
|> |     1   Should we allow URIs to point to scripts to include?
|>
|> the possibility of reliance on external resources should not be
|> offered.
|
| I'm assuming your argument against this is "lack of utility" which I
| suspect I can agree with.

I think we can skip this for now and if it ever becomes necessary we can 
simply define it as a new extension and use the 'include :uri "..."' syntax 
for it.

-- 
Cyrus Daboo

To: Sieve Mailing List <[email-masked]>
Subject: Re: Draft for script 'include' capability
From: Kjetil Torgrim Homme <[email-masked]>
Date: 14 Apr 2003 22:52:49 +0200
Lines: 47
Sender: [email-masked]

[Rob Siemborski]:
>
>   On Sun, 14 Apr 2003, Kjetil Torgrim Homme wrote:
>   
>   > |     1   Should we allow URIs to point to scripts to include?
>   >
>   > the possibility of reliance on external resources should not be
>   > offered.
>   
>   I'm assuming your argument against this is "lack of utility"

not really.  if scripts can be fetched by HTTP, you introduce a
reliance on a working name service both locally and at the remote
site.  you also need to punch huge holes in your firewall.
furthermore, the script must be downloaded for each invocation of the
include statement, which puts an additional strain on the server, and
slows down throughput (== more deliveries running simultaneously).

>   which I suspect I can agree with.

well, I don't see the great utility, either :-)

>   > |     3   How should non-exist include scripts be handled?
>   >
>   > error at compile-time or run-time depending on the implementation.
>   
>   I'd argue that these should be interpreted to be empty scripts,
>   since I suspect runtime errors could be more confusing to the end
>   user.  (Since generally users don't see explicit error notices
>   from sieve runs).
>   
>   The advantage of interpreting it as an empty script is you can
>   have your main script include stuff like "my-vacation-script"
>   which then can just be deleted when you come back, as opposed to
>   having to modify your main script.

heh.  I'd prefer to keep my vacation-script around, and just disable
it from the main script.  I see your point, though.

>   I guess the issue is what does the user expect to happen, and I
>   don't really like causing one script to start failing just because
>   an included script dissapears.

how about typos?  those will be hard to find.

-- 
Kjetil T.

Date: Mon, 14 Apr 2003 16:43:36 -0400
From: Cyrus Daboo <[email-masked]>
To: Kjetil Torgrim Homme <[email-masked]>, Sieve Mailing List <[email-masked]>
Subject: Re: variables: dynamic match patterns
Sender: [email-masked]

Hi Kjetil,

--On Monday, April 14, 2003 10:19 PM +0200 Kjetil Torgrim Homme 
<[email-masked]> wrote:

|>   Hm.  That's a reasonable offer, Kjetil, but I'd rather eat the
|>   complexity as an implementor than to place it on the users and
|>   client writers by making this be an implementation-specific
|>   difference.
|
| well, that is one side of it.  the other side is that of the server
| administrators.  if you must support multipass searches in body, this
| may be a performance hit for servers.  the administrator has few
| options: pray that people won't use it too often, buy more hardware
| (RAM!), or turn off the body extension altogether.

Sadly we have already seen multiple instances of ISPs disabling the IMAP 
SEARCH command because they feel that is too 'expensive' CPU-wise and 
adversely effects performance. I would guess the same philosophy will be 
applied to body searches in sieve.

-- 
Cyrus Daboo

Date: Mon, 14 Apr 2003 16:37:44 -0400 (EDT)
From: Rob Siemborski <[email-masked]>
To: Kjetil Torgrim Homme <[email-masked]>
cc: Sieve Mailing List <[email-masked]>
Subject: Re: Draft for script 'include' capability
Sender: [email-masked]

On Sun, 14 Apr 2003, Kjetil Torgrim Homme wrote:

> I prefer
>   include :global "spam-tests";
> over
>   include "/global/spam-tests";
>
> the default should be to look in the personal folder.

I like this.

> | 4 Open Issues:
> |
> |     1   Should we allow URIs to point to scripts to include?
>
> the possibility of reliance on external resources should not be
> offered.

I'm assuming your argument against this is "lack of utility" which I
suspect I can agree with.

> |     2   Should we allow string lists as argument to include?
>
> I don't see the usefulness of it, but I don't care either way.
>
> |     3   How should non-exist include scripts be handled?
>
> error at compile-time or run-time depending on the implementation.

I'd argue that these should be interpreted to be empty scripts, since I
suspect runtime errors could be more confusing to the end user.  (Since
generally users don't see explicit error notices from sieve runs).

The advantage of interpreting it as an empty script is you can have your
main script include stuff like "my-vacation-script" which then can just be
deleted when you come back, as opposed to having to modify your main
script.

I guess the issue is what does the user expect to happen, and I don't
really like causing one script to start failing just because an included
script dissapears.

-Rob

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rob Siemborski | Andrew Systems Group * Research Systems Programmer
PGP:0x5CE32FCC | Cyert Hall 207 * [email-masked] * 412.268.7456
-----BEGIN GEEK CODE BLOCK----
Version: 3.12
GCS/IT/CM/PA d- s+: a-- C++++$ ULS++++$ P+++$ L+++(++++) E W+ N o? K-
w O- M-- V-- PS+ PE++ Y+ PGP+ t+@ 5+++ R@ tv-@ b+ DI+++ G e h r- y?
------END GEEK CODE BLOCK-----

To: Sieve Mailing List <[email-masked]>
Subject: Re: variables: dynamic match patterns
From: Kjetil Torgrim Homme <[email-masked]>
Date: 14 Apr 2003 22:19:17 +0200
Lines: 15
Sender: [email-masked]

[Jutta Degener]:
>
>   Hm.  That's a reasonable offer, Kjetil, but I'd rather eat the
>   complexity as an implementor than to place it on the users and
>   client writers by making this be an implementation-specific
>   difference.

well, that is one side of it.  the other side is that of the server
administrators.  if you must support multipass searches in body, this
may be a performance hit for servers.  the administrator has few
options: pray that people won't use it too often, buy more hardware
(RAM!), or turn off the body extension altogether.

-- 
Kjetil T.

Date: Mon, 14 Apr 2003 13:04:54 -0700
From: Jutta Degener <[email-masked]>
To: Kjetil Torgrim Homme <[email-masked]>
Cc: Sieve Mailing List <[email-masked]>
Subject: Re: variables: dynamic match patterns
Sender: [email-masked]

On Mon, Apr 14, 2003 at 09:42:53PM +0200, Kjetil Torgrim Homme wrote:
> how about:
> 
> (somewhere at the start of the specification:)
>   A constant string is a string or multi-line value without variable
>   references.
> 
> (in a section on interactions with old and new mechanisms?)
>   Implementations MAY require match patterns to be constant strings
>   when used with some test types.  Such implementations MUST reject
>   the activation of scripts with disallowed match patterns.
> 
> is it too strong to require the error to be discovered at upload time?
> I don't feel good about allowing it to happen during run-time, but
> that might be a quality-of-implementation issue.

Hm.  That's a reasonable offer, Kjetil, but I'd rather eat
the complexity as an implementor than to place it on the users
and client writers by making this be an implementation-specific
difference.

Jutta

To: Sieve Mailing List <[email-masked]>
Subject: Re: variables: dynamic match patterns
From: Kjetil Torgrim Homme <[email-masked]>
Date: 14 Apr 2003 21:42:53 +0200
Lines: 31
Sender: [email-masked]

[Ned Freed]:
>
>   Fair enough, but the case that breaks the bank is body. You really
>   really really want to do all your body search operations in a
>   single passs. If you don't you can easily write scripts that have
>   serious performance problems.

agreed.

>   I don't especially care about the case of optimizing the header,
>   address, envelope, and string tests, but body is a serious
>   problem. And it seems fairly awkward to say that the match
>   parameter doesn't get expanded in body but does elsewhere.

how about:

(somewhere at the start of the specification:)
  A constant string is a string or multi-line value without variable
  references.

(in a section on interactions with old and new mechanisms?)
  Implementations MAY require match patterns to be constant strings
  when used with some test types.  Such implementations MUST reject
  the activation of scripts with disallowed match patterns.

is it too strong to require the error to be discovered at upload time?
I don't feel good about allowing it to happen during run-time, but
that might be a quality-of-implementation issue.

-- 
Kjetil T.

Date: Mon, 14 Apr 2003 12:04:32 -0700 (PDT)
From: [email-masked]
Subject: Re: variables: interaction with "require"
To: Kjetil Torgrim Homme <[email-masked]>
Cc: Sieve Mailing List <[email-masked]>
Sender: [email-masked]

> [Ned Freed]:
> >
> >   [Jutta]:
> >   > Now that the door has been opened to "strings that don't have
> >   > variables expanded in them", can we consider using the same kind
> >   > of strings as variable names in "set" commands and as match
> >   > patterns?
> >
> >   I've thought about this and I believe I like it. I assume you're
> >   talking about any match argument anywhere, not just when :matches
> >   or :regex are in use. (The issue with body isn't addressed unless
> >   you do this.)

> REQUIRE is a special case in that it is only allowed as the first
> action in a script.  it therefore makes sense that all REQUIRE are
> processed before any of them take effect.  (this is also a useful rule
> for resolving dependencies among extensions if that should occur in
> the future.)

> the parser/lexer will know which strings contain variable references,
> and can easily set a boolean for "constant/non-constant".  I suggest
> we use terminology like "<argument> must be a constant string without
> variable references".  this makes "${foo}" an error, not a verbatim
> value, in such a context.

Good point.

> >   This needs to apply to the match argument in the string test as
> >   well. It cannot apply to the source argument or the test becomes
> >   worthless.
> >
> >   > (So they can be precompiled and don't change contents
> >   > during program execution.)
> >
> >   Yep. Seems like a good idea to me.

> why can't you optimise it only if the string is static?  I can see
> some utility in being able to match against a previous result.

>   require [ "variables", "fileinto" ];
>   if header [ "List-ID" ] :matches "*<*@*>*" {
>      set "listaddr" "${2}@{3}";
>      set "listname" "${2}";
>      if address :is :all [ "to", "cc" ] "${list}" {
>         fileinto "INBOX.lists.${listname}";
>      } else {
>         fileinto "INBOX.possibly-spam";
>      }
>   }

Fair enough, but the case that breaks the bank is body. You really really
really want to do all your body search operations in a single passs. If you
don't you can easily write scripts that have serious performance problems.

I don't especially care about the case of optimizing the header, address,
envelope, and string tests, but body is a serious problem. And it seems fairly
awkward to say that the match parameter doesn't get expanded in body but
does elsewhere.

				Ned

To: Sieve Mailing List <[email-masked]>
Subject: Re: variables: interaction with "require"
From: Kjetil Torgrim Homme <[email-masked]>
Date: 14 Apr 2003 20:48:34 +0200
Lines: 50
Sender: [email-masked]

[Ned Freed]:
>
>   [Jutta]:
>   > Now that the door has been opened to "strings that don't have
>   > variables expanded in them", can we consider using the same kind
>   > of strings as variable names in "set" commands and as match
>   > patterns?
>   
>   I've thought about this and I believe I like it. I assume you're
>   talking about any match argument anywhere, not just when :matches
>   or :regex are in use. (The issue with body isn't addressed unless
>   you do this.)

REQUIRE is a special case in that it is only allowed as the first
action in a script.  it therefore makes sense that all REQUIRE are
processed before any of them take effect.  (this is also a useful rule
for resolving dependencies among extensions if that should occur in
the future.)

the parser/lexer will know which strings contain variable references,
and can easily set a boolean for "constant/non-constant".  I suggest
we use terminology like "<argument> must be a constant string without
variable references".  this makes "${foo}" an error, not a verbatim
value, in such a context.

>   This needs to apply to the match argument in the string test as
>   well. It cannot apply to the source argument or the test becomes
>   worthless.
>   
>   > (So they can be precompiled and don't change contents
>   > during program execution.)
>   
>   Yep. Seems like a good idea to me.

why can't you optimise it only if the string is static?  I can see
some utility in being able to match against a previous result.

  require [ "variables", "fileinto" ];
  if header [ "List-ID" ] :matches "*<*@*>*" {
     set "listaddr" "${2}@{3}";
     set "listname" "${2}";
     if address :is :all [ "to", "cc" ] "${list}" {
        fileinto "INBOX.lists.${listname}";
     } else {
        fileinto "INBOX.possibly-spam";
     }
  }

-- 
Kjetil T.

Date: Mon, 14 Apr 2003 10:16:07 -0700 (PDT)
From: [email-masked]
Subject: Re: variables: interaction with "require"
To: Jutta Degener <[email-masked]>
Cc: [email-masked], Kjetil Torgrim Homme <[email-masked]>, Sieve Mailing List <[email-masked]>
Sender: [email-masked]

> On Sun, Apr 13, 2003 at 10:20:56PM -0700, [email-masked] wrote:
> > [Kjetil]
> > > + The require clauses themselves are not affected by this extension.
> >
> > I agree with this proposed solution to the problem.

> Now that the door has been opened to "strings that don't
> have variables expanded in them", can we consider using
> the same kind of strings as variable names in "set"
> commands and as match patterns?

I've thought about this and I believe I like it. I assume you're talking
about any match argument anywhere, not just when :matches or :regex
are in use. (The issue with body isn't addressed unless you do this.)

This needs to apply to the match argument in the string test as well. It cannot
apply to the source argument or the test becomes worthless.

> (So they can be precompiled and don't change contents
> during program execution.)

Yep. Seems like a good idea to me.

				Ned

Date: Mon, 14 Apr 2003 10:15:23 -0700 (PDT)
From: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft (draft-homme-sieve-variables-00.txt))
To: Jutta Degener <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> On Sun, Apr 13, 2003 at 05:53:40PM +0200, Kjetil Torgrim Homme wrote:
> > [Alexey Melnikov]:
> > >
> > >   In order to move imapflags extension forward I need support for
> > >   set/list variables.

> I think we might be able to do without this.  What if you allow
> (and ignore) empty strings in a [...] list?

> That way, you could set

> 	set "aflag" "aflag"

> 	["${aflag}", "${bflag}", "${cflag}"]

> and have that come out as

> 	["aflag" "" ""]

> if bflag and cflag are unset.

> There are still things that you can do with a list algebra
> that you can't do with this approach -- infinitely many
> flags based on the header and body contents of a message --
> but I don't think we want to do those things badly enough
> to warrant adding three new commands and a variable data type.

I agree with this assessment. The added complexity isn't worth it.

				Ned

Date: Mon, 14 Apr 2003 09:22:31 -0700
From: Jutta Degener <[email-masked]>
To: [email-masked]
Cc: Kjetil Torgrim Homme <[email-masked]>, Sieve Mailing List <[email-masked]>
Subject: Re: variables: interaction with "require"
Sender: [email-masked]

On Sun, Apr 13, 2003 at 10:20:56PM -0700, [email-masked] wrote:
> [Kjetil] 
> > + The require clauses themselves are not affected by this extension.
> 
> I agree with this proposed solution to the problem.

Now that the door has been opened to "strings that don't
have variables expanded in them", can we consider using
the same kind of strings as variable names in "set"
commands and as match patterns?

(So they can be precompiled and don't change contents
during program execution.)

Jutta

Date: Mon, 14 Apr 2003 09:18:16 -0700
From: Jutta Degener <[email-masked]>
To: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft  (draft-homme-sieve-variables-00.txt))
Sender: [email-masked]

On Sun, Apr 13, 2003 at 05:53:40PM +0200, Kjetil Torgrim Homme wrote:
> [Alexey Melnikov]:
> >
> >   In order to move imapflags extension forward I need support for
> >   set/list variables.

I think we might be able to do without this.  What if you allow
(and ignore) empty strings in a [...] list?

That way, you could set

	set "aflag" "aflag"

	["${aflag}", "${bflag}", "${cflag}"]

and have that come out as

	["aflag" "" ""]

if bflag and cflag are unset.

There are still things that you can do with a list algebra
that you can't do with this approach -- infinitely many
flags based on the header and body contents of a message --
but I don't think we want to do those things badly enough
to warrant adding three new commands and a variable data type.

Jutta

Date: Sun, 13 Apr 2003 22:20:56 -0700 (PDT)
From: [email-masked]
Subject: Re: variables: interaction with "require"
To: Kjetil Torgrim Homme <[email-masked]>
Cc: Sieve Mailing List <[email-masked]>
Sender: [email-masked]

> this can happen:

>   require "variables";
>   require "file${foo}into";

> according to current spec, this should work, since ${foo} expands to
> the empty string.  how about

>   require [ "variables", "file${foo}into" ];

> should it work?  and how about

> == main script ==
>   require [ "include", "variables" ];
>   set "ext" "fileinto";
>   include "/personal/test";

> == /personal/test ==
>   require "variables";
>   require "${ext}";
>   fileinto "INBOX";

> this must not work, since each included script must be parsable on its
> own (according to the current include draft).  but if you change it
> into

> == /personal/test ==
>   require "variables";
>   require "file${ext}into";
>   fileinto "INBOX";

> it will work on its own, but bomb when included from the main script.

> I don't see how variable expansion in the arguments to require can
> ever be useful.  I suggest adding to the introduction:

>   The mechanisms detailed in this document will only apply to Sieve
>   scripts which include a require clause for the "variables" extension.
> + The require clauses themselves are not affected by this extension.

I agree with this proposed solution to the problem.

				Ned

To: [email-masked]
Subject: variables: redefining syntax or semantics?
From: Kjetil Torgrim Homme <[email-masked]>
Date: 14 Apr 2003 05:52:48 +0200
Lines: 20
Sender: [email-masked]

draft -00 changes the semantics of strings.  this has the advantage
that the original Sieve syntax is left unchanged.

in <[email-masked]> I outlined syntax changes to
accomplish the same.

it seems to me that it is acceptable to change syntax if the new
syntax is more restrictive than the original, that is, the set of
valid scripts in the new syntax is a subset of the valid scripts in
the old syntax.  this is true for the suggested syntax.  (I withdraw
single quoted strings.)

even so, the syntax does change, and thus the parser must change its
behaviour depending on the extensions which are pulled in.  expressing
variable references as syntax may seem esthetically pleasing, but the
implementation might not be.

(I haven't read through the complete list archive yet.)
-- 
Kjetil T.

To: Sieve Mailing List <[email-masked]>
Subject: Re: Draft for script 'include' capability
From: Kjetil Torgrim Homme <[email-masked]>
Date: 14 Apr 2003 05:20:27 +0200
Lines: 61
Sender: [email-masked]

[Cyrus Daboo]:
>
>   Below are details for a new draft that I just posted that
>   describes a script 'include' capability for including one script
>   inside another. I suspect this will be somewhat
>   controversial. Obviously this has relevance to the current
>   discussion on variables, in particular with regard to scoping. All
>   comments welcome...
>
>   A URL for this Internet-Draft is:
>   <http://www.ietf.org/internet-drafts/draft-daboo-sieve-include-00.txt>

thanks.  I think it looks good.  the only thing I don't like is
encoding private vs. global through the included filename.  (one of
the examples omits the directory prefix, btw.)

I prefer
  include :global "spam-tests";
over
  include "/global/spam-tests";

the default should be to look in the personal folder.

| 4 Open Issues:
|     
|     1   Should we allow URIs to point to scripts to include?

the possibility of reliance on external resources should not be
offered.

|     2   Should we allow string lists as argument to include?

I don't see the usefulness of it, but I don't care either way.

|     3   How should non-exist include scripts be handled?

error at compile-time or run-time depending on the implementation.

|     4   Interaction with variables?

global variables are visible.  numeric variables (match back
references) are kept across the include.  this enables the user to use
them for parameter passing if needed ...

    if string :matches "[email-masked]" "*" {
        include "am_i_rcpt";
    }

----

another issue is case-sensitivity for filenames.  this is glossed over
in fileinto as well, but I think it should be stated explicitly.
something like:

    The filename is case sensitive.  An implementation MAY refuse to
    allow two files whose names only differ in case.

actually, this should go into the Managesieve draft as well.

-- 
Kjetil T.

Date: Sun, 13 Apr 2003 19:54:34 -0700 (PDT)
From: [email-masked]
Subject: Re: variables: scoping
To: Kjetil Torgrim Homme <[email-masked]>
Cc: Sieve Mailing List <[email-masked]>
Sender: [email-masked]

> the discussion is getting unwieldy, so I'm trying to break it into
> more managable pieces.

> Lawrence Greenfield may be right, keeping all variables in one global
> scope may cause problems later.  but I don't want to make things very
> complicated, either, ie. mandatory declaration of variables before use
> seems unnecessary.

> therefore, I suggest a modifier :local to SET as a middle ground.  it
> will cause the named variable to have block local scope.  if used
> outside any blocks, it will have file local scope.  a SET _without_
> :local will either change the value of an existing variable if there
> is one in scope, or initialise a global variable.

>   require [ "variables", "include" ];
>   set "foo" "anna"; # a global variable
>   set "foo" :local "beatrice"; # this shadows the global variable
>   if ... {
>       set "foo" "charlize";
>       set "foo" :local "deborah"; # shadows the variable with file scope
>       # here, ${foo} is "deborah"
>   }
>   # here, ${foo} is "charlize"
>   include "/personal/spamtests";
>   # inside spamtests, ${foo} is the global variable with value "anna".
>   # spamtests can set new global variables which are visible after
>   # the script returns.

> this does mean that SET may be used to "declare" variables as well as
> "set" their values, but I don't think it is a problem to combine the
> two functions into one action.

I strongly object to this proposal. It adds considerable implementation
complexity yet achieves negligable benefits.

Variables give scripts capabilities they didn't have before and which cannot be
achieved with any existing mechanisms. The same cannot be said for local
variables. I fail to see the capability they provide for real world scripts
that cannot be achieved any other way.

				Ned

To: Sieve Mailing List <[email-masked]>
Subject: variables: interaction with "require"
From: Kjetil Torgrim Homme <[email-masked]>
Date: 14 Apr 2003 04:55:38 +0200
Lines: 42
Sender: [email-masked]

this can happen:

  require "variables";
  require "file${foo}into";

according to current spec, this should work, since ${foo} expands to
the empty string.  how about

  require [ "variables", "file${foo}into" ];

should it work?  and how about

== main script ==
  require [ "include", "variables" ];
  set "ext" "fileinto";
  include "/personal/test";

== /personal/test ==
  require "variables";
  require "${ext}";
  fileinto "INBOX";

this must not work, since each included script must be parsable on its
own (according to the current include draft).  but if you change it
into

== /personal/test ==
  require "variables";
  require "file${ext}into";
  fileinto "INBOX";

it will work on its own, but bomb when included from the main script.

I don't see how variable expansion in the arguments to require can
ever be useful.  I suggest adding to the introduction:

  The mechanisms detailed in this document will only apply to Sieve
  scripts which include a require clause for the "variables" extension.
+ The require clauses themselves are not affected by this extension.

-- 
Kjetil T.

To: Sieve Mailing List <[email-masked]>
Subject: variables: scoping
From: Kjetil Torgrim Homme <[email-masked]>
Date: 14 Apr 2003 04:31:20 +0200
Lines: 34
Sender: [email-masked]

the discussion is getting unwieldy, so I'm trying to break it into
more managable pieces.

Lawrence Greenfield may be right, keeping all variables in one global
scope may cause problems later.  but I don't want to make things very
complicated, either, ie. mandatory declaration of variables before use
seems unnecessary.

therefore, I suggest a modifier :local to SET as a middle ground.  it
will cause the named variable to have block local scope.  if used
outside any blocks, it will have file local scope.  a SET _without_
:local will either change the value of an existing variable if there
is one in scope, or initialise a global variable.

  require [ "variables", "include" ];
  set "foo" "anna"; # a global variable
  set "foo" :local "beatrice"; # this shadows the global variable
  if ... {
      set "foo" "charlize";
      set "foo" :local "deborah"; # shadows the variable with file scope
      # here, ${foo} is "deborah"
  }
  # here, ${foo} is "charlize"
  include "/personal/spamtests";
  # inside spamtests, ${foo} is the global variable with value "anna".
  # spamtests can set new global variables which are visible after
  # the script returns.

this does mean that SET may be used to "declare" variables as well as
"set" their values, but I don't think it is a problem to combine the
two functions into one action.

-- 
Kjetil T.

To: Alexey Melnikov <[email-masked]>
Cc: [email-masked]
Subject: Re: List variables in Sieve (Re: variables draft  (draft-homme-sieve-variables-00.txt))
From: Kjetil Torgrim Homme <[email-masked]>
Date: 13 Apr 2003 17:53:40 +0200
Lines: 64
Sender: [email-masked]

[Alexey Melnikov]:
>
>   In order to move imapflags extension forward I need support for
>   set/list variables.

I've read your draft, but I don't see why.  I'm currently reading the
complete archive for this list to get a better feel for the philosophy
of Sieve, but it takes some time :-)

>   I haven't thought too much how this is going to be implemented (so
>   don't blame me if I say something stupid ;-)), but here are some
>   preliminary thoughts and questions:
>   
>   1). Special syntax for list variables?
>   2). Can they be expanded inside strings? If yes, what does it mean?
>   3). Need new actions to add/remove values to the list:
>   
>   addhead <listvariable> <value(s)>
>   addtail <listvariable> <value(s)>
>   remove <listvariable> <value(s)>

the first two operate on a list, but remove operates on a set.

it has occured to me that

  SET "foo" ["hi", "there"];

seems a natural thing to write, which perhaps should be supported in
some way.  I'm not sure what it should be used for, though.

if we want to go for generality, it may be a good idea to offer a
associative array/hash/dictionary rather than an indexed list.  after
all, the hash can be used as if it was an indexed list, AWK does this.

  SET "foo" :index "bar" "zot";
  "${foo{bar}}" => "zot"

>   4). Need a way to convert a list variable to a string form
>   (conversion in other direction is easily achievable with existing
>   capabilities: set listvar ["${var1}", "${var2}", ...];)
>   
>   New command:
>    asstring <identifier> <listvariable> <delimeter_str>
>   
>   <delimeter_str> defines the delimiter that would be inserted
>   between values of the listvariable.

if the default delimiter is the empty string, the user can add
whatever delimiter he likes in the list.  in AWK, there is a magic
global variable OFS, output field separator, to control this
behaviour.

in my current draft, a variable can only be expanded inside a string.
clearly, this expansion can not result in a list of strings.  or can
it?

   SET rcpt [ "Alice", "Bob" ];
   "hello ${rcpt}, nice to see you" =>
        [ "hello ", "Alice", "Bob", ", nice to see you" ]

just some quick thoughts.

-- 
Kjetil T.

Date: Fri, 11 Apr 2003 18:22:40 -0700 (PDT)
From: [email-masked]
Subject: Re: Mailing list last call for draft-daboo-sieve-spamtest-03.txt
To: [email-masked]
Cc: [email-masked]
Sender: [email-masked]

> I do have a few of draft nits that need to be addressed with a revised
> version:

Just noticed another problem with the draft as it stands. It contains an
example:

This turns out not to work. The problem is that the "i;ascii-numeric"
comparator is defined to rank all strings that don't begin with a digit
after any string that does. So if the spamtest value is NIL the first
if succeeds and the second one is never reached.

This is easily corrected by reversing the clauses, of course. The fact that
NILL will rank higher probably should be noted somewhere as well.

				Ned

Date: Fri, 11 Apr 2003 16:02:46 -0600
From: Alexey Melnikov <[email-masked]>
Organization: ACI WorldWide / MessagingDirect
To: Kjetil Torgrim Homme <[email-masked]>
CC: [email-masked]
Subject: List variables in Sieve (Re: variables draft  (draft-homme-sieve-variables-00.txt))
Sender: [email-masked]

In order to move imapflags extension forward I need support for set/list variables.
I haven't thought too much how this is going to be implemented (so don't blame me if
I say something stupid ;-)), but here are some preliminary thoughts and questions:

1). Special syntax for list variables?
2). Can they be expanded inside strings? If yes, what does it mean?
3). Need new actions to add/remove values to the list:

addhead <listvariable> <value(s)>
addtail <listvariable> <value(s)>
remove <listvariable> <value(s)>

4). Need a way to convert a list variable to a string form (conversion in other
direction is easily achievable with existing capabilities: set listvar ["${var1}",
"${var2}", ...];)

New command:
 asstring <identifier> <listvariable> <delimeter_str>

<delimeter_str> defines the delimiter that would be inserted between values of the
listvariable.

Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Watford, UK

Work Phone: +44 1923 81 2877
Home Page: http://orthanc.ab.ca/mel

I speak for myself only, not for my employer.
__________________________________________

Date: Fri, 11 Apr 2003 12:22:38 -0400
From: Cyrus Daboo <[email-masked]>
To: Sieve Mailing List <[email-masked]>
Subject: Draft for script 'include' capability
Sender: [email-masked]

Below are details for a new draft that I just posted that describes a 
script 'include' capability for including one script inside another. I 
suspect this will be somewhat controversial. Obviously this has relevance 
to the current discussion on variables, in particular with regard to 
scoping. All comments welcome...

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.

	Title		: SIEVE Include Extension
	Author(s)	: C. Daboo
	Filename	: draft-daboo-sieve-include-00.txt
	Pages		: 8
	Date		: 2003-4-10
	
The SIEVE [SIEVE] 'include' extension permits users to include one
SIEVE script inside another.  This can make managing large scripts
or multiple sets of scripts much easier, as well as supporting
common 'libraries' of scripts.  Users are able to include their own
personal scripts or site-wide scripts provided by the local SIEVE
implementation.

A URL for this Internet-Draft is:
<http://www.ietf.org/internet-drafts/draft-daboo-sieve-include-00.txt>

-- 
Cyrus Daboo

Date: Fri, 11 Apr 2003 08:12:44 -0700 (PDT)
From: [email-masked]
Subject: Mailing list last call for draft-daboo-sieve-spamtest-03.txt
To: [email-masked]
Sender: [email-masked]

A revised version of the spamtest document was just published (thanks Cyrus)
and it appears to address the issues raised at the sieve
lunch in SF. Accordingly, I'd like to begin a two week "mailing list last
call" for this document.

I do have a few of draft nits that need to be addressed with a revised
version:

(1) The document lacks the required IPR boilerplate. The IESG has recently
    started pushing back on this.

(2) The change history section needs to be marked "to be removed prior 
    to publication as an RFC".

(3) The abstract should refer to the "sieve mail filtering language" rather
    than just "sieve", in order to better put the document in context.

(4) The conventions section should be moved so it appears after the
    introduction and overview.

(5) The abstract should not be numbered.

That's it for now.

				Ned

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 11 Apr 2003 00:50:38 +0200
Lines: 19
Sender: [email-masked]

[Marc Mutz]:
>
>   [Kjetil Torgrim Homme]:
>   >   the slightly nasty consequence of this is that the string
>   >   specifying the variable itself can contain variable
>   >   references.  it is impossible to know at compile time whether
>   >   the resulting variable name is valid.
>   
>   Suppress/disallow variable expansion in the first arg of SET?

suppress makes the parser quite hairy unless we add a single quoted
string or similar.  disallow could work, but we still need to handle
the same syntax errors.  we only remove the ability to do indirect
setting of variables.  this isn't a very useful ability, since there
is no corresponding indirect lookup of variables, but I'm sure it can
be exploited somehow...

-- 
Kjetil T.

Date: Thu, 10 Apr 2003 13:36:18 -0700
From: Jutta Degener <[email-masked]>
To: Marc Mutz <[email-masked]>
Cc: [email-masked]
Subject: Re: regex <-> variables interaction (was: Re: variables draft (draft-homme-sieve-variables-00.txt))
Sender: [email-masked]

On Thu, Apr 10, 2003 at 09:06:24PM +0200, Marc Mutz wrote:
Content-Description: signed data
> On Tuesday 08 April 2003 19:27, [email-masked] wrote:
> <snip>
> > > header :regex "Foo" "((a|b))*"?
> >
> > That IMO is an issue for the regex draft. As for how it should be
> > handled there,
> <snip>
> 
> On a related note, I think the regex extension should include 
> non-capturing parentheses: "make (?:money|dollars)"

Why not just omit capturing if the corresponding variable isn't used?

Jutta

From: Marc Mutz <[email-masked]>
Organization: "Old Europe" - and proud
To: [email-masked]
Subject: regex <-> variables interaction (was: Re: variables draft (draft-homme-sieve-variables-00.txt))
Date: Thu, 10 Apr 2003 21:06:24 +0200
Sender: [email-masked]

--Boundary-02=_7Ccl+OausuJIP12
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Description: signed data
Content-Disposition: inline

On Tuesday 08 April 2003 19:27, [email-masked] wrote:
<snip>
> > header :regex "Foo" "((a|b))*"?
>
> That IMO is an issue for the regex draft. As for how it should be
> handled there,
<snip>

On a related note, I think the regex extension should include=20
non-capturing parentheses: "make (?:money|dollars)"

Esp. in the light of the variables extension, which makes formerly=20
non-capturing () capturing now. As everyone here will know, capturing=20
in regexes imposes a non-negligible performance penalty on regex use,=20
which is a critical component even without capturing.

Of course, this may mean that we can't use the posix regex spec as=20
reference anymore. How about the ecmascript one? With libpcre being=20
available under a very liberal license, I don't see a bigger=20
implementation burden than with posix regexes...

Marc

=2D-=20
"You're hackers, aren't you," the barman said, eyeing us. No one said
a thing. The darkness of the Eurotunnel rolled by. Apparently we'd
given ourselves away by talking too enthusiastically about IPv6. He
looked around conspiratorially, lowered his voice. "Can you get me
some credit card numbers?"
      -- James J. King "What's the shortest way to hack a Linux box?"
         Telepolis 2001/08/11 (#9293)

--Boundary-02=_7Ccl+OausuJIP12
Content-Type: application/pgp-signature
Content-Description: signature

--Boundary-02=_7Ccl+OausuJIP12--

From: Marc Mutz <[email-masked]>
Organization: "Old Europe" - and proud
To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Date: Thu, 10 Apr 2003 20:24:21 +0200
Sender: [email-masked]

--Boundary-02=_nbbl+YJVI1igHOW
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Description: signed data
Content-Disposition: inline

On Tuesday 08 April 2003 21:10, Kjetil Torgrim Homme wrote:
<snip>
>      the slightly nasty consequence of this is that the string
>      specifying the variable itself can contain variable references.
>      it is impossible to know at compile time whether the resulting
>      variable name is valid.
<snip>

Suppress/disallow variable expansion in the first arg of SET?

Marc

=2D-=20
The first casualty of war is the truth.

--Boundary-02=_nbbl+YJVI1igHOW
Content-Type: application/pgp-signature
Content-Description: signature

--Boundary-02=_nbbl+YJVI1igHOW--

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 10 Apr 2003 00:38:16 +0200
Lines: 106
Sender: [email-masked]

[Lawrence Greenfield]:
>
>   Formal operational semantics and careful thought on how to make
>   various features orthogonal would go a long way so we don't have
>   every specification referencing every other specification and
>   subtly altering their meanings.

no disagreement in general.  however, variables are usually a
first-class member of a language, so when we add this after the fact,
it is to be expected that most specifications have their functionality
altered (hopefully enhanced).

in my draft, this is done by changing the semantics of the basic type
string.  the alternative seems to be to make variable references a
construct only available when explicitly stated in the grammar for the
action, which in turn requires new actions and tests to be defined
whereever variables might be useful.  I obviously favour the first
approach.  it may be more painful now, but I believe it will pay off
in the long term.

now, how to do it?  in my first attempt at a draft, I changed the
grammar of quoted-string, multi-line-literal and multi-line-dotstuff.
this does seem more invasive, but it may also seem more honest.

basically, it was done like this:

       quoted-string  =  DQUOTE *(CHAR / variable-ref) DQUOTE
        variable-ref  =  "${" variable-name "}"

which is bogus, of course.  doing it right is actually quite hard (at
least for me), I don't see how to support the current syntax in the
draft without a _lot_ of grammar rules.  actually, I don't see how to
do it at all :-)

here's an attempt at a slightly simplified syntax:

  quoted-string = DQUOTE
                  *(qcontent / quoted-pair / variable-ref /
                    verbatim-dollar / "{")
                  *"$"
                  DQUOTE

        qcontent  =  %x01-21 / %x23 / %x25-5b / %x5d-%x7a / %x7c-1fffff
                ; all characters except NUL, double-quote, dollar,
                ; backslash and opening brace
     quoted-pair  =  "\" %x01-1fffff
    variable-ref  =  "${" variable-name "}"
   variable-name  =  num-variable / identifier
    num-variable  =  1*DIGIT
 verbatim-dollar  =  1*"$" (qcontent / quoted-pair / variable-ref)

the verbatim-dollar makes sure that "$${foo}" and "$\"bar" are allowed
and work as expected.  since there has to be a non-dollar character in
the verbatim-dollar expansion, strings ending in one or more dollar
characters are handled by an explicit *"$" just before the closing
quote.

using this syntax, "${!}" gives a parsing error rather than being left
verbatim.  backslash are processed differently than in my draft, a
backslash will now actually escape the variable reference, which I
think is an improvement.  "\${foo}" will parse as a quoted-pair ("\$")
followed by a "{" and "foo}".

the above syntax can be simplified further by requiring all dollars
outside variable references to be escaped using backslash.

  quoted-string = DQUOTE
                  *(qcontent / quoted-pair / variable-ref)
                  DQUOTE
        qcontent  =  %x01-21 / %x23 / %x25-5b / %x5d-1fffff
                ; all characters except NUL, double-quote, dollar and
                ; backslash

other expansions are the same as above.  strings like "$$$" and
"\\.(.*)$" now yield errors.  most users will use Sieve generators
that probably escape every dollar _anyway_ to keep the implementation
simple, so being non-intrusive in general texts doesn't seem
important.  the regexp gotcha may be the worst.

it might be useful to change string as well:

          string  =  quoted-string / squoted-string / multi-line
  squoted-string  =  "'" *(sqcontent / quoted-pair) "'"
       sqcontent  =  %x01-26 / %x28-5b / %x5d-1fffff
                ; all characters except NUL, single quote and backslash

that way the body extension can mandate the use of squoted-string for
specifying the match pattern.  yes, dependencies are tricky here.

...

btw, it seems this needs fixing in a Sieve revision:

   quoted-string  =  DQUOTE *CHAR DQUOTE
            CHAR  =  %x01-7F ; from [ABNF]
similarily:
    CHAR-NOT-DOT  =  (%x01-09 / %x0b-0c / %x0e-2d / %x2f-ff)
           ;; no dots, no CRLFs
and others doesn't include the complete Unicode repertoire.

also, CHAR includes the double quote, so "foo" "bar" could be parsed
as one quoted-string with contents ``foo" "bar''.

-- 
Kjetil T.

Date: Wed, 09 Apr 2003 14:30:19 -0700 (PDT)
From: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
To: Lawrence Greenfield <[email-masked]>
Cc: [email-masked], [email-masked], Kjetil Torgrim Homme <[email-masked]>
Sender: [email-masked]

>    Date: Tue, 08 Apr 2003 10:27:45 -0700 (PDT)
>    From: [email-masked]

>    Agreed, but IMO the benefits far outweigh the disadvantages. Like
>    it or not, there is a large class of operations sieve currently
>    cannot do and which people really really really want to be able to
>    do. I have to tell customers "no, you cannot do that at present
>    with sieve" at least a couple of times every month, and that they
>    have to use procmail or something similar instead.  This really
>    isn't an acceptable state of affairs IMO.

> Whatever the benefits may be, they don't let us adapt a random-ass
> approach to language design.

Nor was I suggesting any such thing be done.

> Formal operational semantics and careful thought on how to make
> various features orthogonal would go a long way so we don't have every
> specification referencing every other specification and subtly
> altering their meanings.

As is always the case in the IETF, willingness to do the work counts for a lot.
I have no problem with someone doing a formal analysis here; in fact I would
welcome it. What I object to is making such analysis a requirement to
proceed.

As for careful thought, well, isn't that why we're discussing the various
details of this extension on the list right now?

				Ned

Date: Wed, 9 Apr 2003 14:47:17 -0400
From: Lawrence Greenfield <[email-masked]>
To: [email-masked]
Cc: [email-masked], Kjetil Torgrim Homme <[email-masked]>, [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Sender: [email-masked]

   Date: Tue, 08 Apr 2003 10:27:45 -0700 (PDT)
   From: [email-masked]

   Agreed, but IMO the benefits far outweigh the disadvantages. Like
   it or not, there is a large class of operations sieve currently
   cannot do and which people really really really want to be able to
   do. I have to tell customers "no, you cannot do that at present
   with sieve" at least a couple of times every month, and that they
   have to use procmail or something similar instead.  This really
   isn't an acceptable state of affairs IMO.

Whatever the benefits may be, they don't let us adapt a random-ass
approach to language design.

Formal operational semantics and careful thought on how to make
various features orthogonal would go a long way so we don't have every
specification referencing every other specification and subtly
altering their meanings.

Larry

Date: Wed, 09 Apr 2003 09:48:49 -0700 (PDT)
From: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> [Arnt Gulbrandsen]:
> >
> >   Kjetil Torgrim Homme writes:
> >   > [Tim Showalter]:
> >   >>    If I had done minimal-matching right-to-left, would the result
> >   >> have been greedy? (This would resolve my objection.)
> >   >
> >   > yes.
> >
> >   No. Consider the match for a*a in ababa: A minimal match takes aba
> >   no matter whether it's right-to-left or left-to-right, a greedy
> >   one takes ababa.

> doh!  I assumed anchored matching, sorry!

We're discussing sieve here, and sieve uses anchored matches for :matches.
While RFC 3028 doesn't have an explicit statement to the effect that :matches
is anchored, the only discussion of substring matches is specifically in the
context of :contains, and there are a couple of examples of the the form

    if header :matches "subject" "*make*money*fast*" ...

that don't make much sense if :matches is unanchored.

I also note that turning an anchored match into an unanchored match is
easy. (The opposite is not true -- another reason why sieve  matches need to be
anchored.)

We probably want to add an explicit statement when RFC 3028 is revised.

				Ned

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 09 Apr 2003 14:21:58 +0200
Lines: 17
Sender: [email-masked]

[Arnt Gulbrandsen]:
>
>   Kjetil Torgrim Homme writes:
>   > [Tim Showalter]:
>   >>    If I had done minimal-matching right-to-left, would the result
>   >> have been greedy? (This would resolve my objection.)
>   >
>   > yes.
>   
>   No. Consider the match for a*a in ababa: A minimal match takes aba
>   no matter whether it's right-to-left or left-to-right, a greedy
>   one takes ababa.

doh!  I assumed anchored matching, sorry!

-- 
Kjetil T.

From: Arnt Gulbrandsen <[email-masked]>
To: Kjetil Torgrim Homme <[email-masked]>
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Cc: [email-masked]
Date: Wed, 9 Apr 2003 12:34:17 +0200
Sender: [email-masked]

Kjetil Torgrim Homme writes:
> [Tim Showalter]:
>
>>    I implemented a mostly-linear time glob algorithm by implementing 
>>    minimal matching left-to-right. I am opposed to any semantic that 
>>    would result in pattern matching being fairly expensive 
>>    (specifically, any algorithm that results in * being recursive is 
>>    bad).
>>
>>    If I had done minimal-matching right-to-left, would the result 
>>    have been greedy? (This would resolve my objection.)
>
> yes.

No. Consider the match for a*a in ababa: A minimal match takes aba no 
matter whether it's right-to-left or left-to-right, a greedy one takes 
ababa.

--Arnt

Date: Tue, 08 Apr 2003 17:38:05 -0700 (PDT)
From: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> [Tim Showalter]:
> >
> >   I implemented a mostly-linear time glob algorithm by implementing
> >   minimal matching left-to-right.  I am opposed to any semantic that
> >   would result in pattern matching being fairly expensive
> >   (specifically, any algorithm that results in * being recursive is
> >   bad).
> >
> >   If I had done minimal-matching right-to-left, would the result
> >   have been greedy?  (This would resolve my objection.)

> yes.  just reverse both strings to see this.  here's an example:

> "ababbab" ~ "*a*b?*" => [ "ab", "b", "a", "b" ]  (greedy)
> "babbaba" ~ "*?b*a*" => [ "b", "a", "b", "ba" ]  (minimal)

> or the other pair:
> "babbaba" ~ "*?b*a*" => [ "babb", "a", "", "" ]  (greedy)
> "ababbab" ~ "*a*b?*" => [ "", "", "a", "bbab" ]  (minimal)

Yep, you're right. My mistake. Sorry.

				Ned

Date: Tue, 08 Apr 2003 14:56:17 -0700 (PDT)
From: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
To: Tim Showalter <[email-masked]>
Cc: [email-masked], Lawrence Greenfield <[email-masked]>, Kjetil Torgrim Homme <[email-masked]>, [email-masked]
Sender: [email-masked]

> > Good point, but it is an ambiguity that is easily resolved simply by saying
> > glob patterns have to implement greedy matching when variables are used.

> I implemented a mostly-linear time glob algorithm by implementing
> minimal matching left-to-right.  I am opposed to any semantic that would
> result in pattern matching being fairly expensive (specifically, any
> algorithm that results in * being recursive is bad).

I'm fairly sure that the greediness or non-greediness of the match doesn't
have to affect the efficiency of the operation. I've written both greedy
and non-greedy pattern matchers, and I believe all of them exhibit the
same sort of mostly-linear never-exponential behavior you describe.

(The trick I used in the greedy case, FWIW, is to scan the remainder of the
pattern and back off the initial match so it doesn't cover material needed to
satisfy the rest of the pattern.)

> If I had done minimal-matching right-to-left, would the result have been
> greedy?  (This would resolve my objection.)

I don't think so. I think you have to tweak your approach.

> Let me know if this doesn't make sense; I'm not an expert on this.

The reason I prefer a greedy match is that it seems to be what most people have
come to expect. Capturing globs and regexps tend to be greedy by default.

				Ned

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 09 Apr 2003 01:32:06 +0200
Lines: 23
Sender: [email-masked]

[Tim Showalter]:
>
>   I implemented a mostly-linear time glob algorithm by implementing
>   minimal matching left-to-right.  I am opposed to any semantic that
>   would result in pattern matching being fairly expensive
>   (specifically, any algorithm that results in * being recursive is
>   bad).
>   
>   If I had done minimal-matching right-to-left, would the result
>   have been greedy?  (This would resolve my objection.)

yes.  just reverse both strings to see this.  here's an example:

"ababbab" ~ "*a*b?*" => [ "ab", "b", "a", "b" ]  (greedy)
"babbaba" ~ "*?b*a*" => [ "b", "a", "b", "ba" ]  (minimal)

or the other pair:
"babbaba" ~ "*?b*a*" => [ "babb", "a", "", "" ]  (greedy)
"ababbab" ~ "*a*b?*" => [ "", "", "a", "bbab" ]  (minimal)

-- 
Kjetil T.			|  read and make up your own mind
				|  http://www.cactus48.com/truth.html

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 09 Apr 2003 01:00:00 +0200
Lines: 143
Sender: [email-masked]

[Ned Freed]:
>
>   Well, it isn't clear to me that we want to encourage storing
>   massive texts in variables. I think the preferred approach is to
>   use variables to store smallish substitutions into larger texts.
>   
>   Philosophy aside, I'm more concerned about limits on the all-digit
>   variables since they come into being automatically than I am on
>   the limits on explicitly specified variables. I could tolerate
>   having a large limit on variables in general as long as a smaller
>   limit could apply to all-digit variables. Although come to think
>   of it, the base specification allows considerable leeway on
>   implementation limits, so I guess I could consider limits on
>   :matches as an implementation limit allowed by the base
>   specification.

I added this section to the draft:

6.  Implementation Limits

An implementation of this draft MUST support at least 128 distinct
variables.  The supported length of variable names MUST be at least 32
characters.  The supported size of a variable's content MUST be at
least 4095 octets.  Attempts to set the variable to a value larger
than the implementation supports MUST be treated as an error.

Numeric variables ${1} through ${9} MUST be supported.  Referencing
higher indices than is supported is a syntax error which MUST be
discovered at compile-time.  If the string matching a wildcard or a
regex group operator exceeds the maximum variable size, the
implementation SHOULD truncate it and MUST NOT treat it as an error.
=== ends ===

I hope this addresses your concerns.

>   > not sure what you want here.  either a clarification in the
>   > introduction like:
>   
>   >    This is an extension to the Sieve language defined by [SIEVE].  It
>   >    adds support for storing and referencing data in string variables.
>   > +  The mechanisms detailed in this document will only apply to Sieve
>   > +  scripts which include a require clause for the "variables"
>   > +  extension.
>   
>   This is what I meant.

added, thanks.

>   > interesting.  do you know where I can get a copy?  I wonder how to
>   > cram this into the modifier syntax, though.  perhaps the current
>   > approach is completely wrong.  rather than stick modifiers inside the
>   > strings, we could make them modify the SET action.  it seems a better
>   > fit to fit other elements of Sieve (both syntax and semantics).
>   
>   A copy was posted to the imapext list on 26-Feb. Hopefully Chris will
>   be able to post an updated version to the I-D directory soon.

thanks, it's at http://article.gmane.org/gmane.ietf.imapext/1436

>   >     SET :upper :comparator "i;ascii-casemap" name "${1}"
>   
>   I like this a lot better than the present modifier syntax.  You do
>   need to specify the combining rules for :upper / :lower /
>   :upperfirst / :lowerfirst.  I think the rule should be that :upper
>   and :lower are incompatible with each and so are :upperfirst and
>   :lowerfirst.  And if :Xfirst is specified along with :Y, :Y is
>   done prior to :Xfirst.

so tags in Sieve MUST be commutative?

>   > what would it take to get it changed?  it seems to me they could
>   > just take (a subset of) the Olson database and decree it as
>   > official.
>   
>   The problem is that the Olson database is constantly being changed
>   and updated, which means any snapshot you take has a good chance
>   of being at odds with reality in fairly short order. (A political
>   rather than technical base tends to do this... I understand that
>   there are 1-2 updates every month or so.) So absent the
>   wherewithall to basically have IANA act as a handler for the Olson
>   effort or something similar, I see serious problems here.

ok.  my current wording:

  Note: There is currently no registry for time zones.  If IETF
  establishes one, its names SHOULD be used.  In the absence of such a
  registry, [TZ] is the most widespread collection of time zone
  definitions and its use as a reference is RECOMMENDED.

(where [TZ] refers to Olson et al. of course)

>   
>   > >       I suggest that the correct approach to take is the one RFC
>   > >       2445 uses. I would also like to allow a time offset as an
>   > >       argument to setdate, but zone support is what's needed.
>   
>   > interesting, thanks for the reference.  do you mean to include the
>   > whole vocabulary to define a time zone?  that seems very complex to
>   > me.
>   
>   You can simply refer to it. No need to repeat it.

oh, I was worried about the implementation :-).  also, now the
responsibility for keeping the time zone definition up-to-date rests
on the Sieve client, not the server.  also, the time zone definition
could be implemented by the client using a bunch of IFs and a couple
of calls on SETDATE...

>   > actually, with ${timezone} available, the fallback can be implemented
>   > by the user.  we simply need to mandate that the time offset syntax is
>   > supported as a valid "time zone".
>   >
>   >     setdate "US-Eastern";
>   >     if not string "${timezone}" "US-Eastern" {
>   >         setdate "-0500";
>   >     }
>   
>   Interesting. I could go with this.

great :-)

>   Then by all means make the zone one that's local to the user
>   rather than to the server. I really don't think having a default
>   of UTC is the right answer here.

I'm with you, and these changes in SETDATE makes it easier to bear.

>   Date would test date values in headers. There are all sorts of
>   those, and there is considerable value in being able to test them.

ah...  yes, this is useful functionality, especially for filtering
email archives.  perhaps we could generalise SETDATE?

   SETDATE :now "+0200";	# old behaviour
   SETDATE :header "Date";
   SETDATE :header "Date" "+0000";

the default time zone for :header should be the one specified in the
header.

(what to do if there is no such header, or it can't be parsed?)
-- 
Kjetil T.

Date: Tue, 08 Apr 2003 14:38:40 -0700 (PDT)
From: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> [Lawrence Greenfield]:
> >
> >   From RFC 3028, section 8.2:
> >
> >      command = identifier arguments ( ";" / block )
> >
> >      argument = string-list / number / tag
> >
> >      arguments = *argument [test / test-list]
> >
> >   Your "set" action is implicitly extending 'argument' to allow for
> >   something that is lexically identical to an 'identifier'. This
> >   extension needs to be made explicit.

> oh dear.  I've missed that entirely.

> (it's not lexically identical, ${_foo} is not allowed, though that
> should be changed for internal consistency.)

> >   You then have to resolve the parsing ambiguity, since
> >
> >   set variable "string";
> >
> >   can be produced by
> >
> >   command -> identifier arguments ;
> >           -> identifier *argument ;
> >           -> identifier variable *argument ;

> so your grammar change here is

> -   argument = string-list / number / tag
> +   argument = variable / string-list / number / tag

> ?

> >           [...]
> >           -> identifier variable string ;
> >
> >   OR
> >
> >   command -> identifier arguments ;
> >           -> identifier *argument test ;
> >           -> identifier test ;
> >           -> identifier identifier arguments ;
> >           -> identifier identifier *argument ;
> >           -> identifier identifier string-list *argument ;
> >           -> identifier identifier string *argument ;
> >           -> identifier identifier string ;
> >
> >   which are obviously two different parse trees.

> sorry, I don't follow this expansion.  does this assume a different
> grammar change?

> so, we have (at least) three options.

>   a) change SET into taking two strings.

>          SET "from" "${1}";

>      the slightly nasty consequence of this is that the string
>      specifying the variable itself can contain variable references.
>      it is impossible to know at compile time whether the resulting
>      variable name is valid.

It isn't like there aren't all sorts of error conditions that can arise in
sieve scripts already. I have no problem with creating one more.

>   b) change SET into using a tag for the variable name.

>          SET :from "${1}";

>      this looks funny, and also creates a namespace problem if we add
>      modifiers such as :upper.

Bad idea IMO.

>   c) change the base grammar of Sieve.  my suggestion is

>        - command = identifier arguments ( ";" / block )
>        + command = 1*identifier arguments ( ";" / block )

>      as far as I can tell, this does not introduce any ambiguity.

While it isn't a matter of consequence to my own implementation, I really
dislike making such a change at this point.

I think (a) is the way to go.

> >   >  does require carry over?  I'd say "no".  variables shouldn't either.
> >
> >   It's not clear to me. Nor is it clear that sites won't want to
> >   have variables cascade.

> isn't this an issue that should be dealt with in an "include"
> extension or something?

Exactly. There is a big difference between having multiple sieve scripts
and building up a single script from subscripts. Variables should not
cross from one to the other in the former case, they should in the latter
since it is purely a construction technique for producing a single
sieve script.

				Ned

Date: Tue, 08 Apr 2003 14:21:34 -0700 (PDT)
From: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
To: Jutta Degener <[email-masked]>
Cc: [email-masked], Kjetil Torgrim Homme <[email-masked]>, [email-masked]
Sender: [email-masked]

> On Tue, Apr 08, 2003 at 10:23:11AM -0700, [email-masked] wrote:
> > > the match order for [ a, b ] [ A, B ] should be aA, bA, aB, bB.  this
> > > means that messages sent to both addresses will be forwarded to
> > > <[email-masked]>, i.e. the first match string has precedence.
> > > in this example, what the wildcard matches is irrelevant.
> >
> > Cute. I can live with it.

> I'm not happy.  Before this, I could stop matching when any combination
> matched.  Now I have to either keep reading to the end just in case a
> variable assignment changes, or figure out in advance whether any of
> the strings following use any variables and keep reading to the end only
> if that is true.

Er, I never said that expressions shouldn't short circuit. I think they
should. But this issue, it seems to me, is independent of short circuiting.

The point here is that the saved non-wildcarded parts of the pattern can
be useful. Not that expressions must be fully evaluated. On the contrary,
if they are fully evaluated the non-wildcarded parts aren't nearly as useful.

> By the way, coupling variable assignments and matches _really_ makes
> life interesting for anyone implementing streaming matches such as "body".

Coupling variable assignmens and matches doesn't change the problem in 
any material way. How about:

   set foo "bar"
   if header :contains "to" "foo"  {set foo "bletch"}
   if body :contains "${foo}"

So as I noted previously, the addition of variables and their use in body
effectively eliminates streaming matches.

> Without them, it's possible to at least predict a finite number of
> possible variable values and match those in parallel in one pass.

Yep. I plan to either preclude the use of variables and body or else
disallow variables in body arguments because of this.

> These are extreme examples that don't affect the ability to parallelize
> the more common fixed choices, but I'm not looking forward to the
> extra complexity, and I don't think it's justified by functional
> benefits.

The functional benefits of variables are enormous -- I receive many more
requests that can be satisfied with variables than I do for the ability
to search bodies.

				Ned

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 08 Apr 2003 23:08:27 +0200
Lines: 61
Sender: [email-masked]

[Jutta Degener]:
>
>   On Tue, Apr 08, 2003 at 10:23:11AM -0700, [email-masked] wrote:
>   > > the match order for [ a, b ] [ A, B ] should be aA, bA, aB,
>   > > bB.  this means that messages sent to both addresses will be
>   > > forwarded to <[email-masked]>, i.e. the first match
>   > > string has precedence.  in this example, what the wildcard
>   > > matches is irrelevant.
>   > 
>   > Cute. I can live with it.
>   
>   I'm not happy.  Before this, I could stop matching when any
>   combination matched.
>
>   Now I have to either keep reading to the end just in case a
>   variable assignment changes, or figure out in advance whether any
>   of the strings following use any variables and keep reading to the
>   end only if that is true.

okay, I see your problem.  so which match is returned should be
undefined?  that's fine with me.  if the user needs a specific
ordering, he can split the expression.

>   By the way, coupling variable assignments and matches _really_
>   makes life interesting for anyone implementing streaming matches
>   such as "body".
>
>   Without them, it's possible to at least predict a finite number of
>   possible variable values and match those in parallel in one pass.

neat!

>   With variables, you may not be able to predict what string a later
>   match will match against, because the match pattern itself may contain
>   variables that are set as the result of previous match patterns.
>   
>   	if body :matches "*call(*,*)*",
>   	{
>   		if body :matches "*response(${3},${2})*"
>   		{
>   			...
>   		}
>   	}
>   
>   These are extreme examples that don't affect the ability to
>   parallelize the more common fixed choices, but I'm not looking
>   forward to the extra complexity, and I don't think it's justified
>   by functional benefits.

one sledgehammer is to declare that no variable expansion is performed
on match patterns.  it may seem a little arbitrary in the spec, and
indeed it can't be expressed in the grammar without _large_ changes to
it, but efficiency of implementation may trump expressiveness here.

since body isn't out as an RFC yet, an alternative approach is to
change _that_.  for instance, implementations can be allowed to refuse
searches with non-constant matching patterns.  (this can be determined
at script upload time, right?)

-- 
Kjetil T.

Date: Tue, 08 Apr 2003 14:05:56 -0700
From: Tim Showalter <[email-masked]>
To: [email-masked]
CC: Lawrence Greenfield <[email-masked]>, Kjetil Torgrim Homme <[email-masked]>, [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Sender: [email-masked]

[email-masked] wrote:

>>   (1) The ${0}, ${1} all-digit variables should be set and modified by the
>>       glob-style :matches mechanism in addition to :regex. It really should
>>       not be necessary to implement regex in order to get the ability to
>>       set variables based on message inputs. For example:
>>    
>>
>>This leads to ambiguity, however.
>>    
>>
>Good point, but it is an ambiguity that is easily resolved simply by saying
>glob patterns have to implement greedy matching when variables are used.
>  
>
I implemented a mostly-linear time glob algorithm by implementing 
minimal matching left-to-right.  I am opposed to any semantic that would 
result in pattern matching being fairly expensive (specifically, any 
algorithm that results in * being recursive is bad).

If I had done minimal-matching right-to-left, would the result have been 
greedy?  (This would resolve my objection.)

Let me know if this doesn't make sense; I'm not an expert on this.

Tim

Date: Tue, 08 Apr 2003 16:11:55 -0400
From: Tony Hansen <[email-masked]>
CC: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Sender: [email-masked]

Kjetil Torgrim Homme wrote:
>>  I think this is fine for features that only enable certain forms
>>  of syntax (since they basically dissapear at parsing time), but is
>>  somewhat less good for things that change global state of the
>>  interpreter.
>>  
>>  Implicit keep is another "global state" issue that jumps to mind.
>>  
>>  I think I'm currently of the opinion that all global state
>>  (including variables, implicit keep, etc) should be global for the
>>  entire execution.  However, the effects of require which only
>>  affect parsing should be limited to the current script only.
> 
> if script one require variables, and set variable foo to bar, and
> script two doesn't require variables, and contain the string "${foo}",
> what should happen?  it seems to me you're saying that the string
> should be left alone.  also, if script two does require variables, the
> value of foo will become available, and the string will be expanded to
> "bar".

I'm of the other mind, though. If script one sets ${foo}, I would NOT 
expect script two to see the value of ${foo}. I'd expect the variable 
state to be reset between scripts.

	Tony Hansen
	[email-masked]

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 08 Apr 2003 21:47:58 +0200
Lines: 47
Sender: [email-masked]

[Tony Hansen]:
>
>   Kjetil Torgrim Homme wrote:
>   >>  Other languages have benefitted from namespaces. It might be
>   >>  worthwhile exploring that concept, particularly if there are
>   >>  preset variables. For example, instead of the preset variable
>   >>  name ${year}, you'd instead have ${time.year}. Thoughts?
>   >
>   > how should the namespace namespace be governed?  a registry?
>   > only available to extensions specified in RFCs?
>   
>   If setdate is comparable to a "require", then defining such an
>   addition should define the namespace that it places its data into.
>   Perhaps it should be ${setdate.year}, ${setdate.month}, etc.

this would work.  (there need not be a one-to-one relationship between
the name of the action/extension and the namespace, "date.year" would
work just as well.)

essentially, this is "only available to extensions specified in RFCs".
the question is if it's needed, the variable names themselves will be
carefully controlled and collisions can be avoided relatively easily.
the main benefit is that system variables look syntactically different
from user variables, and we could also make them read-only if we like.

it seems to me that namespaces are more useful if the user are allowed
to use them.  however, the user can do that, simply by imposing his
own rules for variable naming.  e.g., prefix all variables with "kj_".

>   More complex packages might want to use more fully qualified
>   names:
>   
>   	require "example";
>   	setfoo ...;
>   	setbar ...;
>   
>   	${example.foo.handle}
>   	${example.bar.contenttype}
>   
>   to make certain that they don't conflict with the "foo" and "bar"
>   namespaces of other "require" constructs.

nice, but I think this is over-engineering, and most of the effect can
be had by substituting an underscore for the period.

-- 
Kjetil T.

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 08 Apr 2003 21:28:33 +0200
Lines: 30
Sender: [email-masked]

[Rob Siemborski]:
>
>   Currently Cyrus's include draft has require being scoped to the
>   current script.

ah, I haven't seen that.  perhaps you could put it up at
http://www.cyrusoft.com/sieve/#documents ?

>   I think this is fine for features that only enable certain forms
>   of syntax (since they basically dissapear at parsing time), but is
>   somewhat less good for things that change global state of the
>   interpreter.
>   
>   Implicit keep is another "global state" issue that jumps to mind.
>   
>   I think I'm currently of the opinion that all global state
>   (including variables, implicit keep, etc) should be global for the
>   entire execution.  However, the effects of require which only
>   affect parsing should be limited to the current script only.

if script one require variables, and set variable foo to bar, and
script two doesn't require variables, and contain the string "${foo}",
what should happen?  it seems to me you're saying that the string
should be left alone.  also, if script two does require variables, the
value of foo will become available, and the string will be expanded to
"bar".

this seems reasonable to me.
-- 
Kjetil T.

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 08 Apr 2003 21:10:43 +0200
Lines: 92
Sender: [email-masked]

[Lawrence Greenfield]:
>
>   From RFC 3028, section 8.2:
>   
>      command = identifier arguments ( ";" / block )
>   
>      argument = string-list / number / tag
>   
>      arguments = *argument [test / test-list]
>   
>   Your "set" action is implicitly extending 'argument' to allow for
>   something that is lexically identical to an 'identifier'. This
>   extension needs to be made explicit.

oh dear.  I've missed that entirely.

(it's not lexically identical, ${_foo} is not allowed, though that
should be changed for internal consistency.)

>   You then have to resolve the parsing ambiguity, since
>   
>   set variable "string";
>   
>   can be produced by 
>   
>   command -> identifier arguments ; 
>           -> identifier *argument ;
>           -> identifier variable *argument ;

so your grammar change here is

-   argument = string-list / number / tag
+   argument = variable / string-list / number / tag

?

>           [...]
>           -> identifier variable string ;
>   
>   OR
>   
>   command -> identifier arguments ;
>           -> identifier *argument test ;
>           -> identifier test ;
>           -> identifier identifier arguments ;
>           -> identifier identifier *argument ;
>           -> identifier identifier string-list *argument ;
>           -> identifier identifier string *argument ;
>           -> identifier identifier string ;
>   
>   which are obviously two different parse trees.

sorry, I don't follow this expansion.  does this assume a different
grammar change?

so, we have (at least) three options.

  a) change SET into taking two strings.

         SET "from" "${1}";

     the slightly nasty consequence of this is that the string
     specifying the variable itself can contain variable references.
     it is impossible to know at compile time whether the resulting
     variable name is valid.

  b) change SET into using a tag for the variable name.

         SET :from "${1}";

     this looks funny, and also creates a namespace problem if we add
     modifiers such as :upper.

  c) change the base grammar of Sieve.  my suggestion is

       - command = identifier arguments ( ";" / block )
       + command = 1*identifier arguments ( ";" / block )

     as far as I can tell, this does not introduce any ambiguity.

>   >  does require carry over?  I'd say "no".  variables shouldn't either.
>   
>   It's not clear to me. Nor is it clear that sites won't want to
>   have variables cascade.

isn't this an issue that should be dealt with in an "include"
extension or something?

thank you for your feedback!

-- 
Kjetil T.

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 08 Apr 2003 20:32:43 +0200
Lines: 22
Sender: [email-masked]

[Ned Freed]:
>
>   > while this is easy to explain and understand, my original
>   > suggestion was
>   >
>   >    ${1} - String before the last a
>   >    ${2} - "a"
>   >    ${3} - String after the last a.
>   >
>   > which I now realise may have merit when matching two lists
>   > against eachother or when using the anyof test.
>   
>   Hmm. OK, I can see some utility here. Although I have to say this
>   is getting awfully tricky and I'd rather see such stuff done with
>   two separate tests.

you're right, the added expressiveness is not worth the complication.
if N tests is deemed unacceptable by the user, he will probably find
that :regex is available in most implementations anyway.

-- 
Kjetil T.

Date: Tue, 8 Apr 2003 11:22:51 -0700
From: Jutta Degener <[email-masked]>
To: [email-masked]
Cc: Kjetil Torgrim Homme <[email-masked]>, [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Sender: [email-masked]

On Tue, Apr 08, 2003 at 10:23:11AM -0700, [email-masked] wrote:
> > the match order for [ a, b ] [ A, B ] should be aA, bA, aB, bB.  this
> > means that messages sent to both addresses will be forwarded to
> > <[email-masked]>, i.e. the first match string has precedence.
> > in this example, what the wildcard matches is irrelevant.
> 
> Cute. I can live with it.

I'm not happy.  Before this, I could stop matching when any combination
matched.  Now I have to either keep reading to the end just in case a
variable assignment changes, or figure out in advance whether any of
the strings following use any variables and keep reading to the end only
if that is true.

By the way, coupling variable assignments and matches _really_ makes
life interesting for anyone implementing streaming matches such as "body".

Without them, it's possible to at least predict a finite number of
possible variable values and match those in parallel in one pass.

With variables, you may not be able to predict what string a later
match will match against, because the match pattern itself may contain
variables that are set as the result of previous match patterns.

	if body :matches "*call(*,*)*",
	{
		if body :matches "*response(${3},${2})*"
		{
			...
		}
	}

These are extreme examples that don't affect the ability to parallelize
the more common fixed choices, but I'm not looking forward to the
extra complexity, and I don't think it's justified by functional
benefits.

Jutta

Date: Tue, 8 Apr 2003 13:40:55 -0400 (EDT)
From: Rob Siemborski <[email-masked]>
To: Lawrence Greenfield <[email-masked]>
cc: [email-masked], Kjetil Torgrim Homme <[email-masked]>
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Sender: [email-masked]

On Tue, 8 Apr 2003, Lawrence Greenfield wrote:

>    does require carry over?  I'd say "no".  variables shouldn't either.
>
> It's not clear to me. Nor is it clear that sites won't want to have
> variables cascade.

Currently Cyrus's include draft has require being scoped to the current
script.  I think this is fine for features that only enable certain forms
of syntax (since they basically dissapear at parsing time), but is
somewhat less good for things that change global state of the interpreter.

Implicit keep is another "global state" issue that jumps to mind.

I think I'm currently of the opinion that all global state
(including variables, implicit keep, etc) should be global for the entire
execution.  However, the effects of require which only affect parsing
should be limited to the current script only.

I do think Larry is correct that there are many cases that will be hard to
understand without formal syntax.

-Rob

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rob Siemborski | Andrew Systems Group * Research Systems Programmer
PGP:0x5CE32FCC | Cyert Hall 207 * [email-masked] * 412.268.7456
-----BEGIN GEEK CODE BLOCK----
Version: 3.12
GCS/IT/CM/PA d- s+: a-- C++++$ ULS++++$ P+++$ L+++(++++) E W+ N o? K-
w O- M-- V-- PS+ PE++ Y+ PGP+ t+@ 5+++ R@ tv-@ b+ DI+++ G e h r- y?
------END GEEK CODE BLOCK-----

Date: Tue, 08 Apr 2003 10:27:45 -0700 (PDT)
From: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
To: Lawrence Greenfield <[email-masked]>
Cc: [email-masked], Kjetil Torgrim Homme <[email-masked]>, [email-masked]
Sender: [email-masked]

> More problems:

> * Semantics

> >    Strings SHOULD be evaluated every time control reaches the statement
> >    it is a part of, to make sure the expanded variable values are up-to-
> >    date.

> This is central to the semantics of the language; this isn't a SHOULD.

Agreed. This has to be a MUST. I will also point out that this has some
interesting implications when it comes to having a body test, implications that
may cause me not to support the use of string substitutions into body tests.
(Basically I want to be able to do a single scan of the message that does all
the body checks at  the same time.)

> It should also be made clear that variables are expanded once, not
> repeatedly.

Yep. Thought of that one but forgot to mention it.

> * Syntactic structure

> The "set" action doesn't fit into the Sieve grammar, as something that is
> identical to an "identifier" is not a valid argument.

I guess that means we have to quote it. Yuck, but we do what we have to do...

> * Scope

> --On Monday, April 07, 2003 2:39 PM -0700 [email-masked] wrote:

> > As for scope, I think global scope is the right, and indeed the only
> > realistic, choice.

> Global scope is a wonderful choice that years of programming language
> theory has shown to be an extremely bad thing.

And as any Pascal programmer such as myself can tell you, the complexity
associated with scoped variables has been shown to be a bad then when it isn't
necessary.

> When Sieve scripts are run in serial (as many implementations now allow) do
> variables carry over from one to another? Why or why not?

I don't think they should carry over. As for why, it is because it makes
all sorts of unpredictable behavior very likely.

> If and when people start thinking about includes and functions, scope
> becomes even more important.

> * Numeric variables

> When does the side effect of tests have it's effect on numeric variables?
> After the test? Only inside the if?

I would say after.

> Does the ${1} in the second test refer to the variable set in the first
> test? Or does it refer to the previously set variable?

Cute. My implementation currently does the former, but I have no strong opinion
here.

> if (allof (header :regex "Foo" "${1}(.*)", header :regex "Bar" "${1}(.*)"))
> {
> }

> * Numeric variables

> What does nested grouping do?

> header :regex "Foo" "((a|b))*"?

That IMO is an issue for the regex draft. As for how it should be handled
there, I think that we should find some set of consistent capture semantics
from some regular expression system we like and follow it. Does the
Posix regexp spec cover capture?

> * Numeric variables

> Does a failed matching clear all numeric variables?

My personal preference would be "no".

> * Program analysis

> I guess some of what's bothering me is that there are several invasive
> language changes with this draft that make it significantly more difficult
> to analyze the language to make sure it isn't mutually contradictory, and
> more difficult to analyze a piece of a program without global analysis.

> . Tests now alter global state (thus the short-circuit problem)

> . Variable expansion can drastically change patterns to match against,
> preventing certain pre-compilation strategies.

Agreed, but IMO the benefits far outweigh the disadvantages. Like it or
not, there is a large class of operations sieve currently cannot do and which
people really really really want to be able to do. I have to tell customers
"no, you cannot do that at present with sieve" at least a couple of times
every month, and that they have to use procmail or something similar instead.
This really isn't an acceptable state of affairs IMO.

				Ned

Date: Tue, 08 Apr 2003 10:23:11 -0700 (PDT)
From: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> >   > or how about "*a*"?
> >
> >   ${1} - String before the last a
> >   ${2} - String after the last a.

> while this is easy to explain and understand, my original suggestion
> was

>    ${1} - String before the last a
>    ${2} - "a"
>    ${3} - String after the last a.

> which I now realise may have merit when matching two lists against
> eachother or when using the anyof test.

Hmm. OK, I can see some utility here. Although I have to say this is getting
awfully tricky and I'd rather see such stuff done with two separate tests.

>    if header :matches [ "To", "Cc" ] [ "foo@*.no", "bar@*.com" ] {
>         redirect "kjetilho+${1}ifi.uio.no";
>    }

> the match order for [ a, b ] [ A, B ] should be aA, bA, aB, bB.  this
> means that messages sent to both addresses will be forwarded to
> <[email-masked]>, i.e. the first match string has precedence.
> in this example, what the wildcard matches is irrelevant.

Cute. I can live with it.

				Ned

Date: Mon, 07 Apr 2003 19:23:02 -0700 (PDT)
From: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

> >   (1) The ${0}, ${1} all-digit variables should be set and modified by the
> >       glob-style :matches mechanism in addition to :regex. It really should
> >       not be necessary to implement regex in order to get the ability to
> >       set variables based on message inputs. For example:
> >
> >       require ["variables", "envelope", "subaddress"];
> >       if allof(envelope :all :is "from" "a@b",
> >                envelope :detail :matches "to" "*")
> >         redirect "d+${1}@e"
> >
> >       Of course glob style patterns don't have the ability to
> >       specify which wildcard characters capture and which do not,
> >       but I really don't this this will be a problem in practice.

> your example shows that it is possible to do useful things with it, at
> least.

> it is possible to add, though.  one method is to split the match
> string on the meta characters.  consider the string "*@*.com" -- we
> split this in four, "*", "@", "*" and ".com".  ${2} and ${4} will
> always be "@" and ".com" (if there's a match), but ${1} and ${3} will
> contain the matching characters.

> does this sound too complicated for too little gain?

I really don't see the point of storing the static parts of the pattern. It
will also confuse people familiar with capture systems for patterns, since
AFAIK none of them work this way.

So yes, I think this is too complex for too little gain.

> isn't it likely
> that those who implement variables will also implement regex?

Well, I for one intend to provide both, but regex will be disabled by default
and given some of the security risks I expect it will have I doubt if many
users of ours will be willing to enable it.

> >       I suggest minimum maximums of 64 variables that can each hold
> >       998 characters.

> while there is a tradition for 998 characters as a maximum line
> length, I think it is very low for this application.  remember that
> some people may want to put longish vacation messages inside
> variables.  I suggest 30000 characters (not octets) and an even
> hundred variables as minimum.

Well, it isn't clear to me that we want to encourage storing massive texts in
variables. I think the preferred approach is to use variables to store smallish
substitutions into larger texts.

Philosophy aside, I'm more concerned about limits on the all-digit variables
since they come into being automatically than I am on the limits on explicitly
specified variables. I could tolerate having a large limit on variables in
general as long as a smaller limit could apply to all-digit variables. Although
come to think of it, the base specification allows considerable leeway on
implementation limits, so I guess I could consider limits on :matches as an
implementation limit allowed by the base specification.

> >   (3) The draft needs to make it clear that ${} constructs are not
> >       interpreted in a special way inside of strings unless the
> >       "variables" extension is listed in a require clause.

> not sure what you want here.  either a clarification in the
> introduction like:

>    This is an extension to the Sieve language defined by [SIEVE].  It
>    adds support for storing and referencing data in string variables.
> +  The mechanisms detailed in this document will only apply to Sieve
> +  scripts which include a require clause for the "variables"
> +  extension.

This is what I meant.

> or, do you want to outlaw making a different extension which is
> mutually incompatible with "variables"?  is that even possible to do
> without updating the base specification?

No, nothing like that. I suppose it is possible for two extensions to
be incompatible in some way, but that's a bridge we can cross if we ever
come to it.

> >   (5) Other than we decide on something and stick with it, I have no
> >       preference for modifier ordering.

> let's stick to prefixing (function call like), then.

WFM, although there have been some other objections here...

> >   (6) The selection of specific lowercasing or uppercasing rules for
> >       lower: and upper: needs to be done by specifying a
> >       comparator. Comparators have implement case conversion
> >       rules. Chris Newman has a new draft that cleans up the
> >       situation surrounding the comparator registry but it isn't out
> >       as an I-D yet.

> interesting.  do you know where I can get a copy?  I wonder how to
> cram this into the modifier syntax, though.  perhaps the current
> approach is completely wrong.  rather than stick modifiers inside the
> strings, we could make them modify the SET action.  it seems a better
> fit to fit other elements of Sieve (both syntax and semantics).

A copy was posted to the imapext list on 26-Feb. Hopefully Chris will
be able to post an updated version to the I-D directory soon.

>     SET :upper :comparator "i;ascii-casemap" name "${1}"

I like this a lot better than the present modifier syntax. You do need to
specify the combining rules for :upper/:lower/:upperfirst/:lowerfirst. I think
the rule should be that :upper and :lower are incompatiblei with each and so
are :upperfirst and :lowerfirst. And if :Xfirst is specified along with :Y, :Y
is done prior to :Xfirst.

> "i;ascii-casemap" would be the default comparator for SET.  I'm not
> sure what the meaning of using "i;ascii-numeric" or "i;octet" with SET
> should be.  they may make more sense if other modifiers are added in
> the future.

They would represent an identity case mapping I guess. I believe Chris plans to
deal with this issue in his document.

> >   (7) The setdate operator accept a "time zone" argument. And this is
> >       exactly what it should take. However, what's currently
> >       specified is a time offset, not a time zone -- the former is
> >       something like -0800 while the latter is something like
> >       "US/Pacific". Unfortunately the IETF does not presently have a
> >       time zone rules registry. This has been a problem for some
> >       time and I don't see it changing any time soon.

> what would it take to get it changed?  it seems to me they could just
> take (a subset of) the Olson database and decree it as official.

The problem is that the Olson database is constantly being changed and updated,
which means any snapshot you take has a good chance of being at odds with
reality in fairly short order. (A political rather than technical base tends to
do this... I understand that there are 1-2 updates every month or so.) So
absent the wherewithall to basically have IANA act as a handler for the Olson
effort or something similar, I see serious problems here.

> >       I suggest that the correct approach to take is the one RFC
> >       2445 uses. I would also like to allow a time offset as an
> >       argument to setdate, but zone support is what's needed.

> interesting, thanks for the reference.  do you mean to include the
> whole vocabulary to define a time zone?  that seems very complex to
> me.

You can simply refer to it. No need to repeat it.

> one pragmatic approach is to allow "well-known" time zones with a
> fallback offset value supplied by the user:

>   setdate "US-Eastern" "-0500"

> to allow the user to discover that the time zone was unknown, a
> variable called "timezone" would be set to the value actually used.
> there should be a note that if IETF establishes a registry for time
> zones, the values in it SHOULD be used.  if no fallback value is
> specified, use the server's default.

> actually, with ${timezone} available, the fallback can be implemented
> by the user.  we simply need to mandate that the time offset syntax is
> supported as a valid "time zone".

>     setdate "US-Eastern";
>     if not string "${timezone}" "US-Eastern" {
>         setdate "-0500";
>     }

Interesting. I could go with this.

> >   (8) The default zone for setdate should probably be the zone local
> >       to the server. I think this makes a lot more sense than GMT.

> the objection to that was that a Sieve script should behave the same
> way even if it was moved to a server in a different time zone.  e.g.,
> imagine a local ISP in the UK being swallowed up by a pan-European ISP
> which centralises all email servers in Brussels.  that must lead to
> breakage for customers.

Then by all means make the zone one that's local to the user rather than to the
server. I really don't think having a default of UTC is the right answer here.

> >   (9) The specification of setdate needs to state that every setdate
> >       in a given script operates on a single, consistent date/time
> >       value that does not change throughout the execution of the
> >       script.

> agreed.  how about this?

>     These variables SHOULD reference the time when execution of the
>     Sieve script reaches the statement.
> +   The result of all calls to setdate MUST refer to the same point in
> +   time.

Works for me.

> >   (10) I had been planning to write up a specification for currentdate
> >        and date tests. The former would allow testing of current
> >        date information while the latter would be similar to the
> >        address test except it would operate on fields containing
> >        date information.
> >    [...]
> >    setdate "+0200"                     if currentdate :year :is "2003"
> >    if string :is "${year}" "2003"        ...
> >      ...

> the currentdate syntax is obviously easier to read in tests.

Yes, but harder to deal with in actions. I don't feel comfortable trying to
predict whether actions are going to be more common than tests.

> >        I'm inclined to go with setdate at this point, mostly because
> >        the setdate syntax seems simpler to use overall.

> it allows general use without an IF and SET for every value needed,
> yeah.

Exactly.

> >        My one remaining concern is that setdate doesn't match up
> >        well with the obvious syntax the date test needs to have.

> what date tests are needed?  Sieve is quite expressive already.  an
> example:

>   require [ "variables", "vacation", "relational" ];
>   setdate "+0200";
>   if string :value "le" "${year}-${month}-${day}" "2003-09-18" {
>         vacation "I'm on my holidays, I'll be back on Sept. 19th";
>   }

Date would test date values in headers. There are all sorts of those, and
there is considerable value in being able to test them.

				Ned

Date: Tue, 8 Apr 2003 13:16:01 -0400
From: Lawrence Greenfield <[email-masked]>
To: [email-masked], Kjetil Torgrim Homme <[email-masked]>
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Sender: [email-masked]

   From: Kjetil Torgrim Homme <[email-masked]>
   Date: 08 Apr 2003 06:27:05 +0200

   >   * Syntactic structure
   >   
   >   The "set" action doesn't fit into the Sieve grammar, as something
   >   that is identical to an "identifier" is not a valid argument.

   I don't understand what you mean here.

>From RFC 3028, section 8.2:

   command = identifier arguments ( ";" / block )

   argument = string-list / number / tag

   arguments = *argument [test / test-list]

Your "set" action is implicitly extending 'argument' to allow for
something that is lexically identical to an 'identifier'. This
extension needs to be made explicit.

You then have to resolve the parsing ambiguity, since

set variable "string";

can be produced by 

command -> identifier arguments ; 
        -> identifier *argument ;
        -> identifier variable *argument ;
        -> identifier variable string-list *argument ;
        -> identifier variable string *argument ;
        -> identifier variable string ;

OR

command -> identifier arguments ;
        -> identifier *argument test ;
        -> identifier test ;
        -> identifier identifier arguments ;
        -> identifier identifier *argument ;
        -> identifier identifier string-list *argument ;
        -> identifier identifier string *argument ;
        -> identifier identifier string ;

which are obviously two different parse trees.

   >   Global scope is a wonderful choice that years of programming
   >   language theory has shown to be an extremely bad thing.
   >   
   >   When Sieve scripts are run in serial (as many implementations now
   >   allow) do variables carry over from one to another? Why or why
   >   not?

   does require carry over?  I'd say "no".  variables shouldn't either.

It's not clear to me. Nor is it clear that sites won't want to have
variables cascade.

[ ... explanations elided ... ]

I'm not convinced that Sieve-with-variables is a simple enough
language to explain without the use of formal semantics. I will
attempt to find a simple reference to post to the list.

Larry

Date: Tue, 08 Apr 2003 13:02:42 -0400
From: Tony Hansen <[email-masked]>
CC: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Sender: [email-masked]

Kjetil Torgrim Homme wrote:
>>  Question:
>>  
>>  Should the date variables ALWAYS be preset without executing the
>>  setdate command?
> 
> no.  you may consider the setdate action a different kind of
> "require".  the intent is that other actions can be added later to set
> variables, without breaking compatibility since the user has to call
> the action(s) explicitly.  (if setdate was an extension, we would have
> no way of specifying timezone, so there is good reason to make it an
> action.)
> 
>>  Other languages have benefitted from namespaces. It might be
>>  worthwhile exploring that concept, particularly if there are
>>  preset variables. For example, instead of the preset variable name
>>  ${year}, you'd instead have ${time.year}. Thoughts?
> 
> how should the namespace namespace be governed?  a registry?  only
> available to extensions specified in RFCs?

If setdate is comparable to a "require", then defining such an addition 
should define the namespace that it places its data into. Perhaps it 
should  be ${setdate.year}, ${setdate.month}, etc. More complex packages 
  might want to use more fully qualified names:

	require "example";
	setfoo ...;
	setbar ...;

	${example.foo.handle}
	${example.bar.contenttype}

to make certain that they don't conflict with the "foo" and "bar" 
namespaces of other "require" constructs.

Whoever defines a "require" extension that sets variables somehow would 
be responsible for defining the corresponding namespace used by its 
variables' names.

	Tony Hansen
	[email-masked]

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 08 Apr 2003 18:47:41 +0200
Lines: 29
Sender: [email-masked]

[Ned Freed]:
>
>   > or how about "*a*"?
>   
>   ${1} - String before the last a
>   ${2} - String after the last a.

while this is easy to explain and understand, my original suggestion
was

   ${1} - String before the last a
   ${2} - "a"
   ${3} - String after the last a.

which I now realise may have merit when matching two lists against
eachother or when using the anyof test.

   if header :matches [ "To", "Cc" ] [ "foo@*.no", "bar@*.com" ] {
        redirect "kjetilho+${1}ifi.uio.no";
   }

the match order for [ a, b ] [ A, B ] should be aA, bA, aB, bB.  this
means that messages sent to both addresses will be forwarded to
<[email-masked]>, i.e. the first match string has precedence.
in this example, what the wildcard matches is irrelevant.

-- 
Kjetil T.			|  read and make up your own mind
				|  http://www.cactus48.com/truth.html

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 08 Apr 2003 18:29:10 +0200
Lines: 47
Sender: [email-masked]

[Tony Hansen]:
>
>   Kjetil Torgrim Homme wrote:
>   >     setdate "US-Eastern";
>   >     if not string "${timezone}" "US-Eastern" {
>   >         setdate "-0500";
>   >     }
>   
>   Isn't "X/Y", as in "US/Eastern", the accepted format for compound
>   timezone names?

yes, that is the name used in Unix.  however, in the iCalendar
standard (2445) examples they use a dash.  reading more closely, they
do say

|      Note: This document does not define a naming convention for
|      time zone identifiers. Implementers may want to use the naming
|      conventions defined in existing time zone specifications such
|      as the public-domain Olson database [TZ]. The specification of
|      globally unique time zone identifiers is not addressed by this
|      document and is left for future study.

so going with the slash is probably better.  thanks.

>   Question:
>   
>   Should the date variables ALWAYS be preset without executing the
>   setdate command?

no.  you may consider the setdate action a different kind of
"require".  the intent is that other actions can be added later to set
variables, without breaking compatibility since the user has to call
the action(s) explicitly.  (if setdate was an extension, we would have
no way of specifying timezone, so there is good reason to make it an
action.)

>   Other languages have benefitted from namespaces. It might be
>   worthwhile exploring that concept, particularly if there are
>   preset variables. For example, instead of the preset variable name
>   ${year}, you'd instead have ${time.year}. Thoughts?

how should the namespace namespace be governed?  a registry?  only
available to extensions specified in RFCs?

-- 
Kjetil T.			|  read and make up your own mind
				|  http://www.cactus48.com/truth.html

Date: Tue, 08 Apr 2003 10:01:06 -0400
From: Tony Hansen <[email-masked]>
To: Kjetil Torgrim Homme <[email-masked]>
CC: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Sender: [email-masked]

Tony Hansen wrote:
> 
> Question:
> 
> Should the date variables ALWAYS be preset without executing the setdate 
> command?

Let me expand on this a bit. The idea was that the purpose of setdate 
changes to simply resetting the values to a different timezone. If you 
don't execute the setdate command, then the variables get preset to a 
value based on UTC.

     Tony Hansen
     [email-masked]

Date: Tue, 08 Apr 2003 09:37:21 -0400
From: Tony Hansen <[email-masked]>
To: Kjetil Torgrim Homme <[email-masked]>
CC: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Sender: [email-masked]

Kjetil Torgrim Homme wrote:
> [[email-masked]]:
> 
> actually, with ${timezone} available, the fallback can be implemented
> by the user.  we simply need to mandate that the time offset syntax is
> supported as a valid "time zone".
> 
>     setdate "US-Eastern";
>     if not string "${timezone}" "US-Eastern" {
>         setdate "-0500";
>     }

Isn't "X/Y", as in "US/Eastern", the accepted format for compound 
timezone names?

Question:

Should the date variables ALWAYS be preset without executing the setdate 
command?

Other languages have benefitted from namespaces. It might be worthwhile 
exploring that concept, particularly if there are preset variables. For 
example, instead of the preset variable name ${year}, you'd instead have 
${time.year}. Thoughts?

	Tony Hansen
	[email-masked]

Date: 8 Apr 2003 09:07:01 -0000
From: [email-masked]
To: [email-masked]
Subject: Re: Matching NUL characters
Sender: [email-masked]

> >   o MIME decoding may not be implemented and everything is (legally)
> >     treated as literal, although implementing it is a strong SHOULD.
> >     If not implemented, comparison works unless 8-bit characters are
> >     encountered.
>
> no, MIME decoding is required.

It is not, because decoding etc. in section 2.7.2 is only a SHOULD and
followed by:

   If implementations fail to support the above behavior, they MUST
   conform to the following:

      No two strings can be considered equal if one contains octets
      greater than 127.

So it is not *required*, but it's not clear what is required.  That's
subject to interpretation.

> >   o  Broken words are treated as literal strings (MUAs either do that or
> >      decode them to junk, when their parser fails)
>
> words that doesn't match the grammer are treated as literals.  how to
> treat words that broken for other reasons is specified in RFC 2047
> section 6.

I see the following in section 6:

   A mail reader need not attempt to display the text associated with an
   'encoded-word' that is incorrectly formed.  However, a mail reader
   MUST NOT prevent the display or handling of a message because an
   'encoded-word' is incorrectly formed.

So what is sieve supposed to do with incorrect words and where is that
defined?

   If the mail reader does not support the character set used, it may
   (a) display the 'encoded-word' as ordinary text (i.e., as it appears
   in the header), (b) make a "best effort" to display using such
   characters as are available, or (c) substitute an appropriate message
   indicating that the decoded text could not be displayed.

That's fine for a human interface, but an automated filter should
have a determined behaviour.

> >   o  Correct words with unknown character sets are treated as literal
> >      strings.  The assumption that all unknown character sets are
> >      one-byte codes and identical to US-ASCII in their lower 128
> >      octets is not sound.
>
> remember that you can only compare against literal UTF-8 strings
> (well, at least until we have a variables extension), so the
> alternative is to make _all_ matches against strings in an unknown
> character set fail.  that is not very useful.

The alternative is not to decode and convert what can't be decoded
and converted.  If the word is broken, or the character set is unknown,
then don't decode and convert it.

> >   Rationale: I would like the following test to be true:
> >   
> >      Subject: abc =?iso-8859-1?q?=c3abc?= =?unknown?q?def?=
> >   
> >      header : contains ["Subject"] ["abc"]
> >   
> >   The header can not be decoded entirely, so Sieve scripts should
> >   view it as the UTF-8 character for capital A with diaresis,
> >   followed by "abc" and "=?unknown?q??=".
> >   
> >   RFC 3028 would let the test fail, because the _whole_ header could
> >   not be converted and there is an 8-bit character.
>
> actually, this isn't clear in the RFC.  the string "abc" doesn't
> contain 8-bit characters, and neither does the matching substring
> "abc"...  I think the RFC can be read either way.  I favour that the
> test is allowed to fail, though.

I favour well determined behaviour.

Concerning my original point of NUL characters, I read RFC 2047 again:

   Only printable and white space character data should be encoded using
   this scheme.  However, since these encoding schemes allow the
   encoding of arbitrary octet values, mail readers that implement this
   decoding should also ensure that display of the decoded data on the
   recipient's terminal will not cause unwanted side-effects.

First, the requirement of printable and white space character data is
a SHOULD.  Second, an embedded NUL causing a string to be truncated,
is an "unwanted side-effect" to me, but I have to accept it's only a
SHOULD, too.

This can probably be interpreted in sieve implementations failing to
match the substring "def" in "=?iso-8859-1?q?abc=00def?=" to be correct.
Amazing, isn't it?

Again, I favour well determined behaviour.  All those SHOULDs make it
very hard to implement Sieve, which is not helpful.  Converting some to
MUSTs would make is much easier.

Michael

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 08 Apr 2003 06:27:05 +0200
Lines: 148
Sender: [email-masked]

[Lawrence Greenfield]:
>
>   More problems:
>   
>   * Semantics
>   
>   >    Strings SHOULD be evaluated every time control reaches the
>   >    statement it is a part of, to make sure the expanded variable
>   >    values are up-to-date.
>   
>   This is central to the semantics of the language; this isn't a
>   SHOULD.

the wording isn't good, I welcome help.  the intent was to allow
static analysis to optimise variable references away.  perhaps an
"as-if" rule is understood, so changing the SHOULD into a MUST is a
non-problem.

>   It should also be made clear that variables are expanded once, not
>   repeatedly.

good point.

    When the string is evaluated, substrings matching variable-ref shall
    be replaced by the value of variable-name.
+   Only one pass through the string shall be done.

one of the examples ("${dollar}{beep}") demonstrates this.

>   * Syntactic structure
>   
>   The "set" action doesn't fit into the Sieve grammar, as something
>   that is identical to an "identifier" is not a valid argument.

I don't understand what you mean here.

>   Global scope is a wonderful choice that years of programming
>   language theory has shown to be an extremely bad thing.
>   
>   When Sieve scripts are run in serial (as many implementations now
>   allow) do variables carry over from one to another? Why or why
>   not?

does require carry over?  I'd say "no".  variables shouldn't either.

>   If and when people start thinking about includes and functions,
>   scope becomes even more important.

let's address that when the need arises.  for now, consider SET to
implicitly declare the variable to have file scope.  add LOCAL or a
generic DECLARE action if you want them.  I think they are overkill
for Sieve, but we'll see.

>   * Numeric variables
>   
>   When does the side effect of tests have it's effect on numeric
>   variables? After the test? Only inside the if?

after the test.

as it happens, I just rewrote that part of the spec to cater for
:matches as well as :regex.  here's the new text:

3.2 Numeric variables

   The decimal value of the numeric variable name will index the list of
   matching strings from the most recently evaluated match of type
   ":matches" or ":regex".  The list is empty if the match was
   unsuccessful.

   For ":matches", the list will contain one string for each wildcard in
   the match pattern.  Each string holds what the corresponding wildcard
   expands to, possibly the empty string.  The wildcards expand
   greedily.

   For ":regex", the list will contain the strings corresponding to
   the group operators.  The groups are ordered by the position of the
   opening parenthesis, from left to right.

   The first string in the list has index 1.  If the index is out of
   range, the empty string will be substituted.  Index 0 returns the
   number of strings in the list.

   Example:
        require [ "fileinto", "regex", "variables" ];

        if header :regex "List-ID" "<(.*)@" {
             fileinto "lists.${1}"; stop;
        }

        # this is equivalent to the above:
        if header :matches "List-ID" "<*@" {
             fileinto "lists.${1}"; stop;
        }

        if header :matches [ "To", "Cc" ] "coyote@**.com" {
             # ${0} is always "2", and ${2} is always the empty string.
             fileinto "business.${1}"; stop;
        } else {
             # ${0} is always "0"
             stop;
        }

=== excerpt ends ===

>   Does the ${1} in the second test refer to the variable set in the
>   first test? Or does it refer to the previously set variable?
>   
>   if (allof (header :regex "Foo" "${1}(.*)", header :regex "Bar"
>   "${1}(.*)")) {
>   }

it refers to the variable set in the first test.

>   * Numeric variables
>   
>   What does nested grouping do?
>   
>   header :regex "Foo" "((a|b))*"?

the traditional thing, see above.

>   * Numeric variables
>   
>   Does a failed matching clear all numeric variables?

yes.

>   * Program analysis
>   
>   I guess some of what's bothering me is that there are several
>   invasive language changes with this draft that make it
>   significantly more difficult to analyze the language to make sure
>   it isn't mutually contradictory, and more difficult to analyze a
>   piece of a program without global analysis.
>   
>   . Tests now alter global state (thus the short-circuit problem)
>   
>   . Variable expansion can drastically change patterns to match
>   against, preventing certain pre-compilation strategies.

there is no doubt optimisation becomes harder, but in the end system
efficiency could improve since some long Sieve scripts now can be
expressed much more compactly.

-- 
Kjetil T.			|  read and make up your own mind
				|  http://www.cactus48.com/truth.html

Date: Mon, 07 Apr 2003 23:24:50 -0400
From: Lawrence Greenfield <[email-masked]>
To: [email-masked]
cc: Kjetil Torgrim Homme <[email-masked]>, [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Sender: [email-masked]

More problems:

* Semantics

>    Strings SHOULD be evaluated every time control reaches the statement
>    it is a part of, to make sure the expanded variable values are up-to-
>    date.

This is central to the semantics of the language; this isn't a SHOULD.

It should also be made clear that variables are expanded once, not 
repeatedly.

* Syntactic structure

The "set" action doesn't fit into the Sieve grammar, as something that is 
identical to an "identifier" is not a valid argument.

* Scope

--On Monday, April 07, 2003 2:39 PM -0700 [email-masked] wrote:

> As for scope, I think global scope is the right, and indeed the only
> realistic, choice.

Global scope is a wonderful choice that years of programming language 
theory has shown to be an extremely bad thing.

When Sieve scripts are run in serial (as many implementations now allow) do 
variables carry over from one to another? Why or why not?

If and when people start thinking about includes and functions, scope 
becomes even more important.

* Numeric variables

When does the side effect of tests have it's effect on numeric variables? 
After the test? Only inside the if?

Does the ${1} in the second test refer to the variable set in the first 
test? Or does it refer to the previously set variable?

if (allof (header :regex "Foo" "${1}(.*)", header :regex "Bar" "${1}(.*)")) 
{
}

* Numeric variables

What does nested grouping do?

header :regex "Foo" "((a|b))*"?

* Numeric variables

Does a failed matching clear all numeric variables?

* Program analysis

I guess some of what's bothering me is that there are several invasive 
language changes with this draft that make it significantly more difficult 
to analyze the language to make sure it isn't mutually contradictory, and 
more difficult to analyze a piece of a program without global analysis.

. Tests now alter global state (thus the short-circuit problem)

. Variable expansion can drastically change patterns to match against, 
preventing certain pre-compilation strategies.

Larry

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 08 Apr 2003 04:18:10 +0200
Lines: 57
Sender: [email-masked]

[Ned Freed]:
>
>   [Lawrence Greenfield]:
>   > can no longer short circut due to:
>   >
>   > "The decimal value of the numeric variable name will index the list of
>   > matching strings from the each of the group operators in the latest
>   > regular expression match."
>   
>   I don't think that was the intent, and if it was, I think it
>   should be changed. I read "latest" as meaning "the latest
>   operation that was performed.

yes.  I've changed it to "most recently evaluated match".

>   Big mistake IMO. Short circuit rules should still apply. The base
>   specification recommends short circuit evaluation of lists. This
>   should be changed to a requirement when variables are in use.

short circuit is fine, but:

    if header :matches [ "To", "Cc" ] [ "coyote@*.com", "*@*.com" ] {
         ...
    }

which tests are done first?  if we care about effiency, it is best to
do all tests against the same match expression first.

   "To" :matches "coyote@*.com"
   "Cc" :matches "coyote@*.com"
   "To" :matches "*@*.com"
   "Cc" :matches "*@*.com"

this seems intuitively correct, since the first list contains
"synonomous" headers for the purpose of the match.  it also gives
natural precedence to the order of the match strings (most important
first).

>   > Modifiers should be omitted from this specification. These are
>   > functions; if we're going to define functions, fine. If not, fine.
>   
>   I have no problem with this approach either.

since folder names are case sensitive, a method for normalising input
into all lower case or similar is highly desirable.

>   Given that variable names are explicitly limited to ASCII
>   alphanumeric I fail to see an issue on this point. As for scope, I
>   think global scope is the right, and indeed the only realistic,
>   choice.

if the need ever arises, we can define a action (say, "LOCAL") to set
variables with block scope.  I don't intend to turn Sieve into a
general purpose programming language, so I'll leave it out for now :-)

-- 
Kjetil T.

To: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
From: Kjetil Torgrim Homme <[email-masked]>
Date: 08 Apr 2003 02:07:18 +0200
Lines: 201
Sender: [email-masked]

[[email-masked]]:
>
>   I have just finished implementing this draft. Nice work -- It was
>   considerably easier to do than I expected.

thank you.

>   (1) The ${0}, ${1} all-digit variables should be set and modified by the
>       glob-style :matches mechanism in addition to :regex. It really should
>       not be necessary to implement regex in order to get the ability to
>       set variables based on message inputs. For example:
>   
>       require ["variables", "envelope", "subaddress"];
>       if allof(envelope :all :is "from" "a@b",
>                envelope :detail :matches "to" "*")
>         redirect "d+${1}@e"
>   
>       Of course glob style patterns don't have the ability to
>       specify which wildcard characters capture and which do not,
>       but I really don't this this will be a problem in practice.

your example shows that it is possible to do useful things with it, at
least.

it is possible to add, though.  one method is to split the match
string on the meta characters.  consider the string "*@*.com" -- we
split this in four, "*", "@", "*" and ".com".  ${2} and ${4} will
always be "@" and ".com" (if there's a match), but ${1} and ${3} will
contain the matching characters.

does this sound too complicated for too little gain?  isn't it likely
that those who implement variables will also implement regex?

>       The presence of "variables" in the require list should be
>       sufficient to enable setting of the all-digit variables by
>       :matches.

I agree.

>   (2) Implementations should be able to impose limits on the total
>       number of variables as well as the size of any particular
>       variable.

good catch!

>       I suggest minimum maximums of 64 variables that can each hold
>       998 characters.

while there is a tradition for 998 characters as a maximum line
length, I think it is very low for this application.  remember that
some people may want to put longish vacation messages inside
variables.  I suggest 30000 characters (not octets) and an even
hundred variables as minimum.

>   (3) The draft needs to make it clear that ${} constructs are not
>       interpreted in a special way inside of strings unless the
>       "variables" extension is listed in a require clause.

not sure what you want here.  either a clarification in the
introduction like:

   This is an extension to the Sieve language defined by [SIEVE].  It
   adds support for storing and referencing data in string variables.
+  The mechanisms detailed in this document will only apply to Sieve
+  scripts which include a require clause for the "variables"
+  extension.

or, do you want to outlaw making a different extension which is
mutually incompatible with "variables"?  is that even possible to do
without updating the base specification?

>   (4) There's a comment to the effect that fileinto needs to be
>       extended to create folders if they don't already exist. As far
>       as I can tell the specification of fileinto in RFC 3028 is
>       silent on the folder creation issue. Our implementation
>       certainly allows folder creation by fileinto; I suspect others
>       do as well. But regardless, I think this is a matter that
>       needs to be clarified in the base sieve specification; I don't
>       think it calls for a separate extension.

okay.  clearly independent of "variables", anyhow.

>   (5) Other than we decide on something and stick with it, I have no
>       preference for modifier ordering.

let's stick to prefixing (function call like), then.

>   (6) The selection of specific lowercasing or uppercasing rules for
>       lower: and upper: needs to be done by specifying a
>       comparator. Comparators have implement case conversion
>       rules. Chris Newman has a new draft that cleans up the
>       situation surrounding the comparator registry but it isn't out
>       as an I-D yet.

interesting.  do you know where I can get a copy?  I wonder how to
cram this into the modifier syntax, though.  perhaps the current
approach is completely wrong.  rather than stick modifiers inside the
strings, we could make them modify the SET action.  it seems a better
fit to fit other elements of Sieve (both syntax and semantics).

    SET :upper :comparator "i;ascii-casemap" name "${1}"

"i;ascii-casemap" would be the default comparator for SET.  I'm not
sure what the meaning of using "i;ascii-numeric" or "i;octet" with SET
should be.  they may make more sense if other modifiers are added in
the future.

sorry, I should have thought of that approach earlier.

>   (7) The setdate operator accept a "time zone" argument. And this is
>       exactly what it should take. However, what's currently
>       specified is a time offset, not a time zone -- the former is
>       something like -0800 while the latter is something like
>       "US/Pacific". Unfortunately the IETF does not presently have a
>       time zone rules registry. This has been a problem for some
>       time and I don't see it changing any time soon.

what would it take to get it changed?  it seems to me they could just
take (a subset of) the Olson database and decree it as official.

>       I suggest that the correct approach to take is the one RFC
>       2445 uses. I would also like to allow a time offset as an
>       argument to setdate, but zone support is what's needed.

interesting, thanks for the reference.  do you mean to include the
whole vocabulary to define a time zone?  that seems very complex to
me.

one pragmatic approach is to allow "well-known" time zones with a
fallback offset value supplied by the user:

  setdate "US-Eastern" "-0500"

to allow the user to discover that the time zone was unknown, a
variable called "timezone" would be set to the value actually used.
there should be a note that if IETF establishes a registry for time
zones, the values in it SHOULD be used.  if no fallback value is
specified, use the server's default.

actually, with ${timezone} available, the fallback can be implemented
by the user.  we simply need to mandate that the time offset syntax is
supported as a valid "time zone".

    setdate "US-Eastern";
    if not string "${timezone}" "US-Eastern" {
        setdate "-0500";
    }

>   (8) The default zone for setdate should probably be the zone local
>       to the server. I think this makes a lot more sense than GMT.

the objection to that was that a Sieve script should behave the same
way even if it was moved to a server in a different time zone.  e.g.,
imagine a local ISP in the UK being swallowed up by a pan-European ISP
which centralises all email servers in Brussels.  that must lead to
breakage for customers.

>   (9) The specification of setdate needs to state that every setdate
>       in a given script operates on a single, consistent date/time
>       value that does not change throughout the execution of the
>       script.

agreed.  how about this?

    These variables SHOULD reference the time when execution of the
    Sieve script reaches the statement.
+   The result of all calls to setdate MUST refer to the same point in
+   time.

>   (10) I had been planning to write up a specification for currentdate
>        and date tests. The former would allow testing of current
>        date information while the latter would be similar to the
>        address test except it would operate on fields containing
>        date information.
>    [...]
>    setdate "+0200"                     if currentdate :year :is "2003"
>    if string :is "${year}" "2003"        ...
>      ...

the currentdate syntax is obviously easier to read in tests.

>        I'm inclined to go with setdate at this point, mostly because
>        the setdate syntax seems simpler to use overall.

it allows general use without an IF and SET for every value needed,
yeah.

>        My one remaining concern is that setdate doesn't match up
>        well with the obvious syntax the date test needs to have.

what date tests are needed?  Sieve is quite expressive already.  an
example:

  require [ "variables", "vacation", "relational" ];
  setdate "+0200";
  if string :value "le" "${year}-${month}-${day}" "2003-09-18" {
        vacation "I'm on my holidays, I'll be back on Sept. 19th";
  }

-- 
Kjetil T.

Date: Mon, 07 Apr 2003 14:39:06 -0700 (PDT)
From: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
To: Lawrence Greenfield <[email-masked]>
Cc: Kjetil Torgrim Homme <[email-masked]>, [email-masked], [email-masked]
Sender: [email-masked]

>    (1) The ${0}, ${1} all-digit variables should be set and modified by the
>        glob-style :matches mechanism in addition to :regex. It really should
>        not be necessary to implement regex in order to get the ability to
>        set variables based on message inputs. For example:

> This leads to ambiguity, however.

Good point, but it is an ambiguity that is easily resolved simply by saying
glob patterns have to implement greedy matching when variables are used.

> What does:

> envelope :detail :matches "to" "**"

${1} - full detail field
${2} - empty string

> or how about "*a*"?

${1} - String before the last a
${2} - String after the last a.

> do? Is it greedy?

AFAIK 3028 didn't say, so the variables document should say that greedy matching
is to be employed.

> Also, this draft might be a little surprising to implementors since
> something like:

>            if header :regex "List-ID" ["<alpha(.*)@", "(.*)beta@"] {
>              fileinto "lists.${1}"; stop;
>            }

> can no longer short circut due to:

> "The decimal value of the numeric variable name will index the list of
> matching strings from the each of the group operators in the latest
> regular expression match."

I don't think that was the intent, and if it was, I think it should be
changed. I read "latest" as meaning "the latest operation that was performed.
So if you have

	    if header :matches "subject" "*a*" ...
	    if header :matches "subject" "*b*" ...

where the subject contains both an "a" and a "b" the values of ${0}, ${1}, ...
would be set by the "*b*" pattern.

> So _all_ regular expressions have to be tried and the last of the
> matches causes the binding.

Big mistake IMO. Short circuit rules should still apply. The base specification
recommends short circuit evaluation of lists. This should be changed to a
requirement when variables are in use. The same is also true of anyof. (Allof
doesn't matter as far as I can tell.)

>    (5) Other than we decide on something and stick with it, I have no
>        preference for modifier ordering.

> Modifiers should be omitted from this specification. These are
> functions; if we're going to define functions, fine. If not, fine.

I have no problem with this approach either.

> There are many other problems with this draft, ranging from i18n
> concerns: "Variable names are case insensitive." to ones that will
> potentially significant problems later on ("All variables have global
> scope.").

Given that variable names are explicitly limited to ASCII alphanumeric I fail
to see an issue on this point. As for scope, I think global scope is the right,
and indeed the only realistic, choice.

				Ned

Date: Mon, 7 Apr 2003 17:08:53 -0400
From: Lawrence Greenfield <[email-masked]>
To: Kjetil Torgrim Homme <[email-masked]>, [email-masked]
Cc: [email-masked], [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
Sender: [email-masked]

   Date: Sun, 06 Apr 2003 07:09:40 -0700 (PDT)
   From: [email-masked]

   (1) The ${0}, ${1} all-digit variables should be set and modified by the
       glob-style :matches mechanism in addition to :regex. It really should
       not be necessary to implement regex in order to get the ability to
       set variables based on message inputs. For example:

This leads to ambiguity, however.

What does:

envelope :detail :matches "to" "**"
or how about "*a*"?

do? Is it greedy?

Also, this draft might be a little surprising to implementors since
something like:

           if header :regex "List-ID" ["<alpha(.*)@", "(.*)beta@"] {
             fileinto "lists.${1}"; stop;
           }

can no longer short circut due to:

"The decimal value of the numeric variable name will index the list of
matching strings from the each of the group operators in the latest
regular expression match."

So _all_ regular expressions have to be tried and the last of the
matches causes the binding.

   (5) Other than we decide on something and stick with it, I have no
       preference for modifier ordering.

Modifiers should be omitted from this specification. These are
functions; if we're going to define functions, fine. If not, fine.

There are many other problems with this draft, ranging from i18n
concerns: "Variable names are case insensitive." to ones that will
potentially significant problems later on ("All variables have global
scope.").

Larry

Date: Sun, 06 Apr 2003 07:09:40 -0700 (PDT)
From: [email-masked]
Subject: Re: variables draft (draft-homme-sieve-variables-00.txt)
To: Kjetil Torgrim Homme <[email-masked]>
Cc: [email-masked], [email-masked]
Sender: [email-masked]

I have just finished implementing this draft. Nice work -- It was considerably
easier to do than I expected.

Of course I now have a number of comments:

(1) The ${0}, ${1} all-digit variables should be set and modified by the
    glob-style :matches mechanism in addition to :regex. It really should
    not be necessary to implement regex in order to get the ability to
    set variables based on message inputs. For example:

    require ["variables", "envelope", "subaddress"];
    if allof(envelope :all :is "from" "a@b",
             envelope :detail :matches "to" "*")
      redirect "d+${1}@e"

    Of course glob style patterns don't have the ability to specify
    which wildcard characters capture and which do not, but I really don't
    this this will be a problem in practice.

    The presence of "variables" in the require list should be sufficient
    to enable setting of the all-digit variables by :matches.

(2) Implementations should be able to impose limits on the total number of
    variables as well as the size of any particular variable. With such
    limits it is easy to write scripts that consume an unreasonable amount
    of space:

    require "variables";
    set a "aaaaaaaaaa";
    set a "${a}${a}${a}${a}${a}${a}${a}${a}${a}${a}";
    set a "${a}${a}${a}${a}${a}${a}${a}${a}${a}${a}";
    set a "${a}${a}${a}${a}${a}${a}${a}${a}${a}${a}";
    set a "${a}${a}${a}${a}${a}${a}${a}${a}${a}${a}";
    ...

    That's already 100000 characters, with no end in sight.

    I suggest minimum maximums of 64 variables that can each hold 998
    characters.

(3) The draft needs to make it clear that ${} constructs are not interpreted
    in a special way inside of strings unless the "variables" extension is
    listed in a require clause.

(4) There's a comment to the effect that fileinto needs to be extended to
    create folders if they don't already exist. As far as I can tell the
    specification of fileinto in RFC 3028 is silent on the folder creation
    issue. Our implementation certainly allows folder creation by fileinto;
    I suspect others do as well. But regardless, I think this is a matter
    that needs to be clarified in the base sieve specification; I don't think
    it calls for a separate extension.

(5) Other than we decide on something and stick with it, I have no preference
    for modifier ordering.

(6) The selection of specific lowercasing or uppercasing rules for lower: and
    upper: needs to be done by specifying a comparator. Comparators have
    implement case conversion rules. Chris Newman has a new draft that
    cleans up the situation surrounding the comparator registry but it isn't
    out as an I-D yet.

(7) The setdate operator accept a "time zone" argument. And this is exactly
    what it should take. However, what's currently specified is a time offset,
    not a time zone -- the former is something like -0800 while the latter is
    something like "US/Pacific". Unfortunately the IETF does not presently have
    a time zone rules registry. This has been a problem for some time and
    I don't see it changing any time soon. I suggest that the correct
    approach to take is the one RFC 2445 uses. I would also like to allow
    a time offset as an argument to setdate, but zone support is what's needed.

(8) The default zone for setdate should probably be the zone local to the
    server. I think this makes a lot more sense than GMT.

(9) The specification of setdate needs to state that every setdate in a
    given script operates on a single, consistent date/time value that does not
    change throughout the execution of the script. If you don't do this you
    can get some unpleasant boundary cases. Note that it is entirely
    reasonable to use setdate multiple times in a single script, either
    because of automated script construction or else because someone
    wants the current date in different time offsets.

(10) I had been planning to write up a specification for currentdate and date
     tests. The former would allow testing of current date information while
     the latter would be similar to the address test except it would operate on
     fields containing date information.

     Setdate and currentdate provide equivalent functionality: Setdate combined
     with the string test give you the ability to test current date information
     while currentdate combined with :matches and the set action give you the
     ability to get date information into the variable of your choice. Of course
     each one is better syntax-wise at doing what it is directly designed to
     do:

    setdate "+0200"                     if currentdate :year :matches "*"
    fileinto "${year}-${month}"           set year "${1}"
                                        if currentdate :month :matches "*"
                                          set month "${1}"
                                        fileinto "${year}-${month}"

    setdate "+0200"                     if currentdate :year :is "2003"
    if string :is "${year}" "2003"        ...
      ...

     I'm inclined to go with setdate at this point, mostly because the
     setdate syntax seems simpler to use overall. My one remaining concern
     is that setdate doesn't match up well with the obvious syntax the
     date test needs to have. So I'd appreciate feedback from others on this
     point.

That's enough for now. As I said at the beginning, I think this is very good
document and I hope we can advance it sooner rather than later.

				Ned

From: Marc Mutz <[email-masked]>
Organization: "Old Europe" - and proud
To: [email-masked]
Subject: Re: Proposed MANAGESIEVE changes
Date: Mon, 7 Apr 2003 16:23:57 +0200
Sender: [email-masked]

--Boundary-02=_/nYk+JxIcTkQPQO
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Description: signed data
Content-Disposition: inline

On Sunday 06 April 2003 15:42, Ken Murchison wrote:
<snip>
> No, we _want_ AUTHID.  AUTHID is the authentication identifier, NOT
> and authentication mechanism name.
<snip>

You mean authid like in what some sasl mechnisms support beside the=20
userid? Hmm, is there another URL scheme that uses ;AUTHID=3D for that?

In any case, I think ;AUTH=3D should be added, too, since it's quite=20
standard in URL schemes in the IMAP/mail realm: ACAP, IMAP, POP3 all=20
use it. Having both will also point out that they're describing=20
different things.

Marc

=2D-=20
We notice things that don't work. We don't notice things that do.
We notice computers, we don't notice pennies.
We notice e-book readers, we don't notice books.
                                          -- Douglas Adams

--Boundary-02=_/nYk+JxIcTkQPQO
Content-Type: application/pgp-signature
Content-Description: signature

--Boundary-02=_/nYk+JxIcTkQPQO--

Date: Sun, 06 Apr 2003 09:42:31 -0400
From: Ken Murchison <[email-masked]>
Organization: Oceana Matrix Ltd.
To: [email-masked]
Subject: Re: Proposed MANAGESIEVE changes
Sender: [email-masked]

Marc Mutz wrote:
> 
> On Saturday 05 April 2003 15:40, Ken Murchison wrote:
> <snip>
> > > authinfo = userid [ ";AUTHID=" authid ]
> > Sure.  No complaints here.
> <snip>
> 
> Please follow rfc2192, rfc2384 and probably others that have something
> like
> 
> authinfo = userid [ ";AUTH=" authid ]
> authid = "*" / sasl-authid
> sasl-authid = any mechanism identifier registered for SASL
> 
> (the point is about AUTH vs. AUTHID).

No, we _want_ AUTHID.  AUTHID is the authentication identifier, NOT and
authentication mechanism name.

-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

From: Marc Mutz <[email-masked]>
Organization: "Old Europe" - and proud
To: [email-masked]
Subject: Re: Proposed MANAGESIEVE changes
Date: Sat, 5 Apr 2003 17:39:40 +0200
Sender: [email-masked]

--Boundary-02=_Sjvj+nTiR1unf2l
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Description: signed data
Content-Disposition: inline

On Saturday 05 April 2003 15:40, Ken Murchison wrote:
<snip>
> > authinfo =3D userid [ ";AUTHID=3D" authid ]
> Sure.  No complaints here.
<snip>

Please follow rfc2192, rfc2384 and probably others that have something=20
like

authinfo =3D userid [ ";AUTH=3D" authid ]
authid =3D "*" / sasl-authid
sasl-authid =3D any mechanism identifier registered for SASL

(the point is about AUTH vs. AUTHID).

Marc

=2D-=20
Ich gegen meinen Bruder.
Ich und mein Bruder gegen unseren Cousin.
Ich, mein Bruder und unser Cousin gegen unsere Nachbarn.
Wir alle gegen den Fremden.
                                      -- Beduinen-Sprichwort

--Boundary-02=_Sjvj+nTiR1unf2l
Content-Type: application/pgp-signature
Content-Description: signature

--Boundary-02=_Sjvj+nTiR1unf2l--

Date: Sat, 05 Apr 2003 08:40:23 -0500
From: Ken Murchison <[email-masked]>
Organization: Oceana Matrix Ltd.
To: [email-masked]
Subject: Re: Proposed MANAGESIEVE changes
Sender: [email-masked]

Chris Newman wrote:
> 
> begin  quotation by Ken Murchison on 2003/4/1 14:35 -0500:
> 
> > 2. Based on Cyrus Murder/virtdomains work, Rob Siemborski and I propose
> > the following augmented Sieve URL grammar:
> >
> >
> > sieveurl = "sieve://" [ [ authinfo "@" ] hostport ] "/" scriptname
> >
> > authinfo = authid [ ";" userid ]
> >
> > authid = userid = *( unreserved | escaped |
> >                      ":" | "&" | "=" | "+" | "$" | "," )
> >
> > scriptname = *pchar
> 
> Please try to keep the authinfo syntax compatible with RFC 2192 authinfo.
> 
> I suggest instead:
> 
> authinfo = userid [ ";AUTHID=" authid ]

Sure.  No complaints here.

-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

Date: Fri, 04 Apr 2003 20:11:16 -0800
From: Chris Newman <[email-masked]>
Subject: Re: Matching NUL characters
To: [email-masked]
Cc: [email-masked]
Sender: [email-masked]

Anyone who uses a NUL of any flavor in this context deserves to lose. 
Implementations should be free to drop the NUL or truncate the line at a NUL, 
regardless of whether it is encoded.

RFC 2822 deprecated the NUL character, and I think we can and should deprecate 
an encoded NUL when RFC 2047 is revised -- one of the important steps moving 
forward on the standards track is to deprecate features that aren't useful and 
cause interoperability problems.  Encoded NUL certainly meets that test.

So I am opposed to adding _any_ additional complexity to Sieve in order to 
support NUL.

                - Chris

begin  quotation by [email-masked] on 2003/4/3 21:58 +0000:
> as defined by RFC 3028, Sieve scripts may not contain NUL characters.
> MIME encoded headers may contain them (encoded), though, and there is
> currently no way to match them with Sieve.  For that reason I suggest
> to change paragraph 2.4.2 of the RFC to define \0 being a representation
> of the NUL character.
>
> I know, that's quite a change, but it's quite a bug, too. ;-) Btw, both
> Mutt and Outlook Express don't show anything after a MIME encoded NUL
> characters, so they simply decode it and, given C strings, terminate the
> string that way, because nobody ever thought about how to handle them.
> If a sieve implementation is not subject to this bug, then most likely
> it could support \0 pretty easy.  Otherwise some work is required anyway
> to fix the bug.
>
> While extending the meaning of \, I suggest to use the Java \u notation
> to specify unicode characters.  Sieve scripts are written in UTF-8 for
> good reasons, but being able to use non-ASCII characters without having
> to use UTF-8 would be great.  That's just an idea, though, and not really
> required like \0 is.
>
> I am currently writing my own sieve implementation as extension to Exim.
> Hacking MIME decoding, I discovered the problem above and Tim Showalter
> suggested I join the list.  It's not the first issue I had with the RFC
> so far, but the first that asks for a change in the language.

Date: Fri, 04 Apr 2003 20:04:37 -0800
From: Chris Newman <[email-masked]>
Subject: Re: Proposed MANAGESIEVE changes
To: Ken Murchison <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

begin  quotation by Ken Murchison on 2003/4/1 14:35 -0500:

> 2. Based on Cyrus Murder/virtdomains work, Rob Siemborski and I propose
> the following augmented Sieve URL grammar:
>
>
> sieveurl = "sieve://" [ [ authinfo "@" ] hostport ] "/" scriptname
>
> authinfo = authid [ ";" userid ]
>
> authid = userid = *( unreserved | escaped |
>                      ":" | "&" | "=" | "+" | "$" | "," )
>
> scriptname = *pchar

Please try to keep the authinfo syntax compatible with RFC 2192 authinfo.

I suggest instead:

authinfo = userid [ ";AUTHID=" authid ]

                - Chris

To: [email-masked]
Subject: Re: Matching NUL characters
From: Kjetil Torgrim Homme <[email-masked]>
Date: 05 Apr 2003 03:10:45 +0200
Lines: 82
Sender: [email-masked]

[[email-masked]]:
>
>   > I'm not sure about that.  I wasn't here when the draft was discussed,
>   > but it seems to me "Implementations decode header charsets to UTF-8"
>   > is as normative as a MUST.  "Implementations should decode charsets
>   > ..." is a cop-out since it is _very_ hard to support every charset in
>   > existence.  the list of required charsets is therefore listed
>   > explicitly instead.
>   
>   That may have been the intention, but there should be no room for
>   interpretation, so let's fix it.  I see three issues:
>   
>   o  Must MIME decoding of correct words succeed?
>   o  How are broken words treated?

this is specified in RFC 2047.

>   o  How are unknown character sets treated?

this is specified in the Sieve RFC.

>   The current RFC says, although not in a way that is overly clear,
>   and which may not even reflect the intention when it was written:
>   
>   o MIME decoding may not be implemented and everything is (legally)
>     treated as literal, although implementing it is a strong SHOULD.
>     If not implemented, comparison works unless 8-bit characters are
>     encountered.

no, MIME decoding is required.

>   o  Behaviour for broken words is not specified.

RFC 2047.

>   o  Unknown character sets are not converted, but assumed to be the
>      one-byte code US-ASCII.  Comparison fails if 8-bit characters are
>      encountered.

yes.

>   You don't seem to agree with that, and neither do I, so I suggest:
>   
>   o  MIME decoding MUST be implemented.
>   o  Broken words are treated as literal strings (MUAs either do that or
>      decode them to junk, when their parser fails)

words that doesn't match the grammer are treated as literals.  how to
treat words that broken for other reasons is specified in RFC 2047
section 6.

>   o  Correct words with unknown character sets are treated as literal
>      strings.  The assumption that all unknown character sets are
>      one-byte codes and identical to US-ASCII in their lower 128
>      octets is not sound.

remember that you can only compare against literal UTF-8 strings
(well, at least until we have a variables extension), so the
alternative is to make _all_ matches against strings in an unknown
character set fail.  that is not very useful.

>   Rationale: I would like the following test to be true:
>   
>      Subject: abc =?iso-8859-1?q?=c3abc?= =?unknown?q?def?=
>   
>      header : contains ["Subject"] ["abc"]
>   
>   The header can not be decoded entirely, so Sieve scripts should
>   view it as the UTF-8 character for capital A with diaresis,
>   followed by "abc" and "=?unknown?q??=".
>   
>   RFC 3028 would let the test fail, because the _whole_ header could
>   not be converted and there is an 8-bit character.

actually, this isn't clear in the RFC.  the string "abc" doesn't
contain 8-bit characters, and neither does the matching substring
"abc"...  I think the RFC can be read either way.  I favour that the
test is allowed to fail, though.

-- 
Kjetil T.			|  read and make up your own mind
				|  http://www.cactus48.com/truth.html

Date: Fri, 4 Apr 2003 16:10:03 -0800
From: Jutta Degener <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Subject: Re: Last Call: Sieve -- Subaddress Extension - NUL
Sender: [email-masked]

On Fri, Apr 04, 2003 at 08:39:55AM -0000, [email-masked] wrote:
> 
> > Michael, I believe that we are not talking about the same thing, and 
> > there's nothing to worry about, and no change to the RFC needed.
> 
> I think you misunderstood me.  I just jumped into the list and I am
> talking about how to match this:
> 
>   Subject: =?iso-8859-1?q?=00text?=
> 
> Sieve can't do that right now other than by using a pattern match.

I'm not convinced sieve needs to address this.

>From RFC 2047, section 5, use of encoded-words in message headers:

#  Only printable and white space character data should be encoded using
#  this scheme.  However, since these encoding schemes allow the
#  encoding of arbitrary octet values, mail readers that implement this
#  decoding should also ensure that display of the decoded data on the
#  recipient's terminal will not cause unwanted side-effects.
#
#  Use of these methods to encode non-textual data (e.g., pictures or
#  sounds) is not defined by this memo. [...]

I'd conclude that by using RFC 2047 to encode NUL bytes, you're
sending bogus data.  (It isn't printable or white space.)

I don't think the sieve language needs to be extended to address
the specific details of bogosity, no more than it should be extended
to deal with e.g. octet sequences that don't occur in UTF-8 at all,
yet could be encoded in a header.

Sieve has made a deliberate design choice to deal with pieces of
text as logical UTF-8 strings (and not as physical sequences of
octets).  I think you're unhappy with that design choice, but I
don't think you've identified a flaw in its implementation.

--

While we're talking about binary data:

Over lunch at the last IETF, I got the sense that people wanted
a way of executing binary comparisons on MIME part contents, mainly
to roll their own virus checking (in spite of the overlap
with a "virustest" command).

I said then that I'd like to have a "hex" comparator that can
compare binary strings as part of the "body" command.  Due to
the fact that sieve works with UTF-8 strings, that just didn't
work out as a comparator in the sense of "i;octet"; instead, the
next version of "body" will have a new :binary match-type,
a version of "content" that works in the hex domain.

Here's what that text looks like so far:

| 4.4 Body Transform ":binary"
| 
|    If the body transform is ":binary", the rules for selecting MIME
|    body parts for matching are the same as with the ":content"
|    body transform.
| 
|    MIME parts encoded in "quoted-printable" or "base64" content
|    transfer encodings MUST be decoded prior to the match.
|    MIME parts in other transfer encodings MAY be decoded, omitted
|    from the test, or processed as raw data.
| 
|    Unlike in :content, the charset of the :binary MIME content is
|    disregarded.   Instead, the match against the keys provided in
|    the "body" statement proceeds as if the file's content data had
|    been translated into space-separated hex bytes of the form
|    [0-9a-f][0-9a-f] prior to matching.
| 
|    Search expressions MUST NOT match across MIME part boundaries.
|    MIME headers of the containing text MUST NOT be included in the
|    data.
| 
|    If the optional ":offset <start: number>" is provided, the
|    binary match is executed after skipping <number> octets of
|    the binary data.  (Note that the offset counts bytes of the
|    internal data, not characters of the hexadecimal representation.)
| 
|    Example:
|    	require ["body", "fileinto"];
| 
| 	# Save any message with any application MIME part that contains
| 	# an ascii C string representation of "Hello, World!" into the
| 	# "helloworld" folder. 
| 	
| 	if body :binary ["application"]
| 		:contains "48 65 6c 6c 6f 2c 20 57 6f 72 6c 64 21 00"
| 	{
| 		fileinto "helloworld";
| 		stop;
| 	}
| 
| 	# Check if the bytes at offsets 1000...1003 match some fictitious
| 	# signature 44, 3c, 0, 1; if yes, reject the message.
| 
| 	if body :binary ["application"] :offset 1000 :matches "44 3c 00 01 *"
| 	{
| 		reject "example virus detected";
| 		stop;
| 	}

Originally, I didn't have spaces between the hex values, but
that meant that "c2" would match in "0c20" unless I made up a
new strictly pairwise comparator as well -- and some things are
just too clumsy to describe.  Besides, I think it actually looks
better this way.

There was also no mention of :offset over lunch, and it may be
that I'm going too far and should leave that to :regex instead;
but it did seem common enough to warrant an explicit mechanism.

Jutta Degener <[email-masked]>

Date: 4 Apr 2003 13:12:08 -0000
From: [email-masked]
To: [email-masked]
Subject: Re: Matching NUL characters
Sender: [email-masked]

> I'm not sure about that.  I wasn't here when the draft was discussed,
> but it seems to me "Implementations decode header charsets to UTF-8"
> is as normative as a MUST.  "Implementations should decode charsets
> ..." is a cop-out since it is _very_ hard to support every charset in
> existence.  the list of required charsets is therefore listed
> explicitly instead.

That may have been the intention, but there should be no room for
interpretation, so let's fix it.  I see three issues:

o  Must MIME decoding of correct words succeed?
o  How are broken words treated?
o  How are unknown character sets treated?

The current RFC says, although not in a way that is overly clear, and
which may not even reflect the intention when it was written:

o  MIME decoding may not be implemented and everything is (legally) treated
   as literal, although implementing it is a strong SHOULD.  If not
   implemented, comparison works unless 8-bit characters are encountered.
o  Behaviour for broken words is not specified.
o  Unknown character sets are not converted, but assumed to be the
   one-byte code US-ASCII.  Comparison fails if 8-bit characters are
   encountered.

You don't seem to agree with that, and neither do I, so I suggest:

o  MIME decoding MUST be implemented.
o  Broken words are treated as literal strings (MUAs either do that or
   decode them to junk, when their parser fails)
o  Correct words with unknown character sets are treated as literal
   strings.  The assumption that all unknown character sets are one-byte
   codes and identical to US-ASCII in their lower 128 octets is not sound.

Rationale: I would like the following test to be true:

   Subject: abc =?iso-8859-1?q?=c3abc?= =?unknown?q?def?=

   header : contains ["Subject"] ["abc"]

The header can not be decoded entirely, so Sieve scripts should view it
as the UTF-8 character for capital A with diaresis, followed by "abc"
and "=?unknown?q??=".

RFC 3028 would let the test fail, because the _whole_ header could not
be converted and there is an 8-bit character.

Michael

To: [email-masked]
Subject: Re: Matching NUL characters
From: Kjetil Torgrim Homme <[email-masked]>
Date: 04 Apr 2003 13:31:18 +0200
Lines: 68
Sender: [email-masked]

[[email-masked]]:
>
>   > I don't believe this is true.  every implementation must understand
>   > that the sequence of N octets making up one UTF-8 character is _one_
>   > character, not N.
>   
>   Where would it make a difference, if the implementation could not
>   decode headers to UTF-8, which is allowed? Quoting section 2.7.2:
>   
>   ----------
>      Implementations decode header charsets to UTF-8.  Two strings are
>      considered equal if their UTF-8 representations are identical.
>      Implementations should decode charsets represented in the forms
>      specified by [MIME] for both message headers and bodies.
>      Implementations must be capable of decoding US-ASCII, ISO-8859-1,
>      the ASCII subset of ISO-8859-* character sets, and UTF-8.
>   
>   If implementations fail to support the above behavior, they MUST
>   conform to the following:
>   
>      No two strings can be considered equal if one contains octets
>      greater than 127.
>   ----------
>   
>   To me, that means an implementation could entirely forget about UTF-8.
>   If someone used a script that contains UTF-8 characters, it does not
>   make a difference but for comparisons, and those are always false if
>   the string contains UTF-8 encoding for unicode characters >127.

I'm not sure about that.  I wasn't here when the draft was discussed,
but it seems to me "Implementations decode header charsets to UTF-8"
is as normative as a MUST.  "Implementations should decode charsets
..." is a cop-out since it is _very_ hard to support every charset in
existence.  the list of required charsets is therefore listed
explicitly instead.

so the fallback rule only applies to headers containing unknown
charsets.  if the decoded header contains octets with 8th bit set, it
can never match anything.

>   Personally, I am surprised that UTF-8 aware string comparisons do
>   not require an extension, since RFC conforming Sieve implementations
>   do not absolutely have to support it.  Depending on the (conforming)
>   implementation, the following test may be true or false
>   
>      Subject: =?iso-8859-1?q?abc=80def?=
>   
>      header :contains ["Subject"] ["abc"]
>   
>   "Fail to support the above behaviour" means "fail to decode MIME words"
>   (no MIME support) or "fail to decode MIME words to UTF-8" (MIME support,
>   but no character set translation).  If the intention was different,
>   the specification should be, too.

the specification may not be completely clear, but let's not postulate
that broken behaviour is allowed if we don't have to.

btw, if you change the header to

  Subject: =?iso-8859-15?q?abc=a0def?=

the implementation can fail to decode it to UTF-8, and the fallback
rule applies.  I'm not completely sure, but I think the test MUST fail
due to the existence of U+A0 in the subject string.

-- 
Kjetil T.			|  read and make up your own mind
				|  http://www.cactus48.com/truth.html

Date: 4 Apr 2003 10:42:31 -0000
From: [email-masked]
To: [email-masked]
Subject: Re: Matching NUL characters
Sender: [email-masked]

> >     Subject: =?iso-8859-1?q?abc=00def?=
> >   
> >   and the tests:
> >   
> >     header :contains ["Subject"] ["abc"]
> >     header :contains ["Subject"] ["def"]
> >     header :matches ["Subject"] ["abc?def"]
> >   
> >   An implementation that evaluates the second or third test as false
> >   is broken, isn't it?
>
> granted.  good example.

Well, that means the implementation must already be able to deal with
strings containing NUL characters somewhere already.

> I don't believe this is true.  every implementation must understand
> that the sequence of N octets making up one UTF-8 character is _one_
> character, not N.

Where would it make a difference, if the implementation could not decode
headers to UTF-8, which is allowed? Quoting section 2.7.2:

----------
   Implementations decode header charsets to UTF-8.  Two strings are
   considered equal if their UTF-8 representations are identical.
   Implementations should decode charsets represented in the forms
   specified by [MIME] for both message headers and bodies.
   Implementations must be capable of decoding US-ASCII, ISO-8859-1,
   the ASCII subset of ISO-8859-* character sets, and UTF-8.

If implementations fail to support the above behavior, they MUST
conform to the following:

   No two strings can be considered equal if one contains octets
   greater than 127.
----------

To me, that means an implementation could entirely forget about UTF-8.
If someone used a script that contains UTF-8 characters, it does not
make a difference but for comparisons, and those are always false if
the string contains UTF-8 encoding for unicode characters >127.

Personally, I am surprised that UTF-8 aware string comparisons do
not require an extension, since RFC conforming Sieve implementations
do not absolutely have to support it.  Depending on the (conforming)
implementation, the following test may be true or false

   Subject: =?iso-8859-1?q?abc=80def?=

   header :contains ["Subject"] ["abc"]

"Fail to support the above behaviour" means "fail to decode MIME words"
(no MIME support) or "fail to decode MIME words to UTF-8" (MIME support,
but no character set translation).  If the intention was different,
the specification should be, too.

Michael

To: [email-masked]
Subject: Re: Matching NUL characters
From: Kjetil Torgrim Homme <[email-masked]>
Date: 04 Apr 2003 11:58:14 +0200
Lines: 48
Sender: [email-masked]

[[email-masked]]:
>
>   > I suggest you propose an extension.  an implementation that follows
>   > the current RFC should not be rendered incompatible.
>   
>   I thought about an extension, too, but what should be the result
>   of the following two matches (as specified by the RFC) given
>   those comparisons, if we have the header
>   
>     Subject: =?iso-8859-1?q?abc=00def?=
>   
>   and the tests:
>   
>     header :contains ["Subject"] ["abc"]
>     header :contains ["Subject"] ["def"]
>     header :matches ["Subject"] ["abc?def"]
>   
>   An implementation that evaluates the second or third test as false
>   is broken, isn't it?

granted.  good example.

>   > if you want the "\0" escape, you can't express U+ef followed by zero.
>   >
>   >   \uef\0 => U+ef NUL
>   >
>   > "\u0" is so short "\0" is superfluous.  the number of escapes
>   > should be kept to a minimum.
>   
>   Not entirely.  RFC 3028 allows not to implement UTF-8 comparisons,
>   which means the input script may be in UTF-8, but the
>   implementation is not aware of that, and it makes no sense to use
>   anything but ASCII characters in that case.

I don't believe this is true.  every implementation must understand
that the sequence of N octets making up one UTF-8 character is _one_
character, not N.

>   That allows a simple implementation and such an implementation
>   probably would not understand \u escapes, but it still requires \0
>   to encode the NUL character.

I don't agree.  and I still think that to change the backslash, you
need to make an extension.

-- 
Kjetil T.			|  read and make up your own mind
				|  http://www.cactus48.com/truth.html

Date: 4 Apr 2003 08:57:51 -0000
From: [email-masked]
To: [email-masked]
Subject: Re: Matching NUL characters
Sender: [email-masked]

> >   If a sieve implementation is not subject to this bug, then most
> >   likely it could support \0 pretty easy.  Otherwise some work is
> >   required anyway to fix the bug.
>
> I suggest you propose an extension.  an implementation that follows
> the current RFC should not be rendered incompatible.

I thought about an extension, too, but what should be the result
of the following two matches (as specified by the RFC) given
those comparisons, if we have the header

  Subject: =?iso-8859-1?q?abc=00def?=

and the tests:

  header :contains ["Subject"] ["abc"]
  header :contains ["Subject"] ["def"]
  header :matches ["Subject"] ["abc?def"]

An implementation that evaluates the second or third test as false is
broken, isn't it? To fix that, adding NUL support is required.  It
would not shed a good light onto sieve if the above tests only evaluate
as true if the scripts begins with

  require "no_NUL_bug";

And even that would require conforming implementations to artificially
introduce the bug when that extension is not selected.

> if you want the "\0" escape, you can't express U+ef followed by zero.
>
>   \uef\0 => U+ef NUL
>
> "\u0" is so short "\0" is superfluous.  the number of escapes whould
> be kept to a minimum.

Not entirely.  RFC 3028 allows not to implement UTF-8 comparisons,
which means the input script may be in UTF-8, but the implementation
is not aware of that, and it makes no sense to use anything but
ASCII characters in that case.  That allows a simple implementation
and such an implementation probably would not understand \u escapes,
but it still requires \0 to encode the NUL character.

Michael

Date: 4 Apr 2003 08:39:55 -0000
From: [email-masked]
To: [email-masked]
Subject: Re: Last Call: Sieve -- Subaddress Extension - NUL
Sender: [email-masked]

> Michael, I believe that we are not talking about the same thing, and 
> there's nothing to worry about, and no change to the RFC needed.

I think you misunderstood me.  I just jumped into the list and I am
talking about how to match this:

  Subject: =?iso-8859-1?q?=00text?=

Sieve can't do that right now other than by using a pattern match.

Michael

To: [email-masked]
Subject: Re: Matching NUL characters
From: Kjetil Torgrim Homme <[email-masked]>
Date: 04 Apr 2003 10:11:52 +0200
Lines: 50
Sender: [email-masked]

[[email-masked]]:
>
>   as defined by RFC 3028, Sieve scripts may not contain NUL
>   characters.  MIME encoded headers may contain them (encoded),
>   though, and there is currently no way to match them with Sieve.
>   For that reason I suggest to change paragraph 2.4.2 of the RFC to
>   define \0 being a representation of the NUL character.
>   
>   I know, that's quite a change, but it's quite a bug, too. ;-) Btw,
>   both Mutt and Outlook Express don't show anything after a MIME
>   encoded NUL characters, so they simply decode it and, given C
>   strings, terminate the string that way, because nobody ever
>   thought about how to handle them.

since the wording is quite explicit in the Sieve standard, I'd rather
say that this was intentional.  it complicates implementation to
support the NUL character, for little benefit.

>   If a sieve implementation is not subject to this bug, then most
>   likely it could support \0 pretty easy.  Otherwise some work is
>   required anyway to fix the bug.

I suggest you propose an extension.  an implementation that follows
the current RFC should not be rendered incompatible.

>   While extending the meaning of \, I suggest to use the Java \u
>   notation to specify unicode characters.  Sieve scripts are written
>   in UTF-8 for good reasons, but being able to use non-ASCII
>   characters without having to use UTF-8 would be great.  That's
>   just an idea, though, and not really required like \0 is.

in that case I suggest an arbitrary length of hexadecimal digits,
e.g., \u0 == \u00000000.  otherwise we'll get a mess when characters
outside the basic plane are needed.  (encode to UTF-16 yourself, let
the Sieve implementation convert that to UTF-8 -- ugly!)  note that
you can terminate the hex sequence with a backslash, this never gives
ambiguity since the only escaped characters are backslash, doublequote
and "u".  e.g.,

  \u0\foo => NUL f o o
  
if you want the "\0" escape, you can't express U+ef followed by zero.

  \uef\0 => U+ef NUL

"\u0" is so short "\0" is superfluous.  the number of escapes whould
be kept to a minimum.

-- 
Kjetil T.

Date: Thu, 03 Apr 2003 17:01:44 -0800
From: "Matthew Elvey (FM)" <[email-masked]>
To: [email-masked]
Subject: Re: Last Call: Sieve -- Subaddress Extension - NUL
Sender: [email-masked]

Alexey Melnikov wrote:

>Ken Murchison wrote:
>  
>
>>I was just asked what would happen if this extension is used on an
>>address such as:
>>
>>[email-masked]
>>
>>I'm proposing adding the following text to the draft:
>>
>>"NOTE: If the separator character occurs more than once in the
>>local-part,
>>then the address SHOULD be split at the left-most separator."
>>
>>Does this seem sufficient?  Should this be a MUST instead of a SHOULD?
>>Any other thoughts?
>>    
>>
>
>IMHO, this should be MUST and it is sufficient.
>
I concur, and since brought this all up, that means there's no 
disagreement.  :)

However, regarding Michael's NUL comment:
Michael, I believe that we are not talking about the same thing, and 
there's nothing to worry about, and no change to the RFC needed.  The 
null key ("") that I was referring to, and that the subadress extension 
refers to is the empty string.  Sematically, it's a string of 0 
characters, not a string with one character with the value 0. (Except 
that it might be stored such that it looks that way - in languages such 
as C, it might be stored as a pointer to a an array of 0 characters 
followed by the value 0.)
The NUL (ASCII 0) referred to in 2.4.2 of the RFC is a character with 
the value 0, often used in languages such as C to indicate the end of a 
string, and therefore cannot be part of a string (which is probably why 
it is forbidden by the RFC.)  You'l note that the RFC separately refers 
to the null key (""); certainly these are different things.  Cool?

Finally, I noticed that 2.7.1 of the RFC states in part:

The null key ("") is contained in all values.

That answers question 4. There's just a bug in the implementation I use; 
smooth sailing for the subaddress draft.

Therefore there IS a way to match the null key:

header :contains "Subject" ""
should return true for all mail with a Subject header, including an 
extant but empty one.

Date: 3 Apr 2003 21:58:00 -0000
From: [email-masked]
To: [email-masked]
Subject: Matching NUL characters
Sender: [email-masked]

Hello,

as defined by RFC 3028, Sieve scripts may not contain NUL characters.
MIME encoded headers may contain them (encoded), though, and there is
currently no way to match them with Sieve.  For that reason I suggest
to change paragraph 2.4.2 of the RFC to define \0 being a representation
of the NUL character.

I know, that's quite a change, but it's quite a bug, too. ;-) Btw, both
Mutt and Outlook Express don't show anything after a MIME encoded NUL
characters, so they simply decode it and, given C strings, terminate the
string that way, because nobody ever thought about how to handle them.
If a sieve implementation is not subject to this bug, then most likely
it could support \0 pretty easy.  Otherwise some work is required anyway
to fix the bug.

While extending the meaning of \, I suggest to use the Java \u notation
to specify unicode characters.  Sieve scripts are written in UTF-8 for
good reasons, but being able to use non-ASCII characters without having
to use UTF-8 would be great.  That's just an idea, though, and not really
required like \0 is.

I am currently writing my own sieve implementation as extension to Exim.
Hacking MIME decoding, I discovered the problem above and Tim Showalter
suggested I join the list.  It's not the first issue I had with the RFC
so far, but the first that asks for a change in the language.

Michael

Date: Thu, 03 Apr 2003 12:17:12 -0700
From: Alexey Melnikov <[email-masked]>
Organization: ACI WorldWide / MessagingDirect
To: Ken Murchison <[email-masked]>
CC: [email-masked]
Subject: Re: Last Call: Sieve -- Subaddress Extension to Proposed Standard
Sender: [email-masked]

Ken Murchison wrote:

> I was just asked what would happen if this extension is used on an
> address such as:
>
> [email-masked]
>
> I'm proposing adding the following text to the draft:
>
> "NOTE: If the separator character occurs more than once in the
> local-part,
> then the address SHOULD be split at the left-most separator."
>
> Does this seem sufficient?  Should this be a MUST instead of a SHOULD?
> Any other thoughts?

IMHO, this should be MUST and it is sufficient.

Cheers,
Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Watford, UK

Work Phone: +44 1923 81 2877
Home Page: http://orthanc.ab.ca/mel

I speak for myself only, not for my employer.
__________________________________________

Date: Thu, 03 Apr 2003 13:54:26 -0500
From: Ken Murchison <[email-masked]>
Organization: Oceana Matrix Ltd.
To: [email-masked]
Subject: Re: Last Call: Sieve -- Subaddress Extension to Proposed Standard
Sender: [email-masked]

I was just asked what would happen if this extension is used on an
address such as:

[email-masked]

I'm proposing adding the following text to the draft:

"NOTE: If the separator character occurs more than once in the
local-part,
then the address SHOULD be split at the left-most separator."

Does this seem sufficient?  Should this be a MUST instead of a SHOULD? 
Any other thoughts?

-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

Date: Thu, 03 Apr 2003 10:30:36 -0800
From: "Matthew Elvey (FM)" <[email-masked]>
To: [email-masked]
Subject: Re: Last Call: Sieve -- Subaddress Extension to Proposed Standard
Sender: [email-masked]

>Ken Murchison wrote:
>  
>
>>The IESG wrote:
>>    
>>
>>>The IESG has received a request to consider Sieve -- Subaddress
>>>Extension <draft-murchison-sieve-subaddress-05.txt> as a Proposed
>>>Standard.  This has been reviewed in the IETF but is not the product
>>>of an IETF Working Group.
>>>
>>>The IESG plans to make a decision in the next few weeks, and solicits
>>>final comments on this action.  Please send any comments to the
>>>[email-masked] or [email-masked] mailing lists by 2003-4-25.
>>>      
>>>
>
>Just sent in an update.  You can grab it from here until it gets posted:
>
>ftp://ftp.oceana.com/pub/drafts/draft-murchison-sieve-subaddress-06.txt
>http://www.oceana.com/ftp/drafts/draft-murchison-sieve-subaddress-06.txt
>
>  
>
Ken, looks good. 4 comments:

1)You might find FastMail's subdomain detail implementation interesting, 
as documented at
http://www.fastmail.fm/docs/faqparts/AliasesAndVirtualDomains.htm#SubDomain 
.
It meshes well with your proposed extension - this comment is just an 
FYI, not a request for any change.
It exists because many systems don't allow + in email addresses, and 
because it's cool.
By the time SIEVE sees the email, however, the address has been 
converted, so Sieve can see the canonical form that your extension 
understands:

[email-masked] ([email-masked] instead of [email-masked])
This canonical form is in the envelope to, which is (I agree) the best address to test against.

Example (trimmed) header

Subject: Welcome to the "wireless" mailing list
From: [email-masked]
To: [email-masked]

2)Does the spec leave undefined  how it would parse

[email-masked]?  It seems to assume only one separator character.
I suggest :user reference the "leftmost separator" and :detail reference the "rightmost separator".
That would leave detail1 unextractable by this extension however.

3)Suggested correction:
envelope :detail ["to", "cc", "bcc"] "foo"
is nonsense; envelopes don't have "cc" or "bcc"; eliminate them.

4)(Question for anyone on the list:) 
 - Apropos use of the null key ("") in this extension:
Should 

header :contains "Subject" "" 

return true for all mail with a Subject header?  
Perhaps its an implementation error , but this type| of test doesn't work on FastMail (which uses Cyrus IMAP); exists must be used.  
My reading of the spec is that this should ("MUST") work.  

Let me know what you think.  I didn't email [email-masked] or 
[email-masked]; didn't seem to make sense at this juncture.

-Matthew Elvey

Date: Tue, 01 Apr 2003 14:35:03 -0500
From: Ken Murchison <[email-masked]>
Organization: Oceana Matrix Ltd.
To: [email-masked]
Subject: Proposed MANAGESIEVE changes
Sender: [email-masked]

Here are the proposed changes to MANAGESIEVE that I mentioned at IETF. 
These have been sent to and accepted by Tim Martin already:

1. Based on the fact that the server no longer auto-issues the
capabilities response (per draft -04), paragraph 3 of section 2.2 should
be changed to something like (stolen from RFC 2595):

      Once TLS has been started, the client MUST discard cached
      information about server capabilities and SHOULD re-issue the
      CAPABILITY command.  This is necessary to protect against
      man-in-the-middle attacks which alter the capabilities list prior
      to STARTTLS.  The server MAY advertise different capabilities
      after STARTTLS.

2. Based on Cyrus Murder/virtdomains work, Rob Siemborski and I propose
the following augmented Sieve URL grammar:

sieveurl = "sieve://" [ [ authinfo "@" ] hostport ] "/" scriptname

authinfo = authid [ ";" userid ]

authid = userid = *( unreserved | escaped | 
                     ":" | "&" | "=" | "+" | "$" | "," )

scriptname = *pchar

-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp