Subject: Re: [sieve] WGLC: draft-ietf-sieve-external-lists-06.txt

From: Alexey Melnikov <[email-masked]>
Date: Sat, 09 Apr 2011 21:58:48 +0100

Cyrus Daboo wrote:

> Hi folks,
> This is the announcement for the start of a working group last call on 
> the draft-ietf-sieve-external-lists-06.txt draft. Please review this 
> draft and post comments to the list. The WGLC will run for two weeks 
> and end on April 13th.

Is anybody still there?

---

From: Stephan Bosch <[email-masked]>
Date: Sat, 09 Apr 2011 23:42:02 +0200

Op 9-4-2011 22:58, Alexey Melnikov schreef:
> Cyrus Daboo wrote:
>
>> Hi folks,
>> This is the announcement for the start of a working group last call 
>> on the draft-ietf-sieve-external-lists-06.txt draft. Please review 
>> this draft and post comments to the list. The WGLC will run for two 
>> weeks and end on April 13th.
>
> Is anybody still there?

There is a syntax error in the second version of Example 1. On line 8, 
the variable substitution ${limit} is not a string, since the double 
quotes are missing.

Other than that, it looks very mature now. No more comments..

Regards,

Stephan.

---

From: Barry Leiba <[email-masked]>
Date: Mon, 11 Apr 2011 21:23:24 -0400

> There is a syntax error in the second version of Example 1. On line 8, the
> variable substitution ${limit} is not a string, since the double quotes are
> missing.

Thanks; fixed in my working copy.

> Other than that, it looks very mature now. No more comments..

Cool!

Barry

---

From: Cyrus Daboo <[email-masked]>
Date: Tue, 12 Apr 2011 12:12:01 -0400

Hi,
My comments:

1) Please add a reference to CardDAV (draft-ietf-vcarddav-carddav-10) 
alongside LDAP and ACAP in the abstract and introduction (hopefully this 
draft will be unblocked by the vcard docs).

2) So most of the document is about external lists of email addresses. But 
then in the example in 2.8.2 we introduce a list of dates. Whilst 2.5 does 
suggest that a list of dates might be one option, 2.4 kind of implies other 
uses like that ought to be in a separate spec. If we want to officially 
support date lists in this spec, then I think that needs to be mentioned in 
the abstract and introduction, and described properly in section 2.2. Plus, 
the RFC5260 reference ought to be normative. Alternatively we should drop 
the date list option from this spec.

-- 
Cyrus Daboo

---

From: [email-masked]
Date: Tue, 12 Apr 2011 10:33:09 -0700 (PDT)

> draft will be unblocked by the vcard docs).

Not sure I see the point of adding such a reference, but as long as it doesn't
have  the potential of blocking publication it's Mostly Harmless.

> 2) So most of the document is about external lists of email addresses.

I disagree with this characterization. The language used refers to checking
"membership in an external list". Those members can and will be practically
anything: Addresses, personal names, dates, keywords, IP addresses, etc.

Moreover, the fact that the header test is required to support :list means that
the intent from the start is  to be able to use things other than addresses -
if addresses were the only thing that this was about we'd only require support
in the envelope and address tests. And the requirement that string support
:list is also key, since that's opens the door to using, say, header :matches
to capture some component of a header list which you can then check against a
list.

The only place this document restricts list content to addresses is in the case
of redirect :list, which is entirely appropriate in that case. And that's
pretty much the only place besides the examples that email addresses as  list
contents are even talked about.

> But
> uses like that ought to be in a separate spec.

It does no such thing. This section is talking about the possibility of adding
list checks to other parts of Sieve and interacting with Sieve in ways other
than as a match type. It isn't talking about expanding what the possible
contents of lists might be - there's no need for that. And I have to say I have
a great deal of difficulty reading the section the way you have.

> If we want to officially
> the abstract and introduction, and described properly in section 2.2.

I strongly disagree with this approach. Trying to come up with a list of
possible things that can be stored in an external list is unnecessarily
proscriptive, not to mention confusing. If anything we need to move in the
opposite direction and be even less specific about how this will be used.

> Plus,

Disagree again. Use of something in an example doesn't translate into 
a normative reference.

If anything we need more examples of uses and more informational references
along these lines. In fact, how about we add an example like this:

require ["variables", "extlists", "index", "reject"];
if header :index 1 :matches "received" "*(* [*.*.*.*])*" {
  set "ip" "${3}.${4}.${5}.${6}";
  if string :list "${ip}" "tag:example.com,2011-04-10:DisallowedIPs" {
    reject "Message not allowed from this IP address";
  }
}

				Ned

---

From: Cyrus Daboo <[email-masked]>
Date: Tue, 12 Apr 2011 15:48:38 -0400

Hi Ned,

--On April 12, 2011 10:33:09 AM -0700 Ned Freed <[email-masked]> 
wrote:

>> If we want to officially
>> support date lists in this spec, then I think that needs to be mentioned
>> in the abstract and introduction, and described properly in section 2.2.
>

OK, I can support the more "generic" view of this as a list of "anything" 
(I guess my bias comes from the original starting point for this spec which 
was definitely based on the address book example). As you suggest perhaps 
there should be more examples - your IP reject one is worth including. 
Another might be (modifying Example 2 in RFC5703 - 
<http://tools.ietf.org/html/rfc5703#section-9.2> ):

   require [ "extlists", "foreverypart", "mime", "enclose" ];

   foreverypart
   {
     if header :mime :param "filename"
        :list ["Content-Type", "Content-Disposition"]
          "tag:example.com,2011-04-11:BadFileNameExts"
     {
       # these attachment types are executable
       enclose :subject "Warning" :text
   WARNING! The enclosed message contains executable attachments.
   These attachment types may contain a computer virus program
   that can infect your computer and potentially damage your data.

   Before clicking on these message attachments, you should verify
   with the sender that this message was sent by them and not a
   computer virus.
   .
   ;
       break;
     }
   }

-- 
Cyrus Daboo

---

From: Cyrus Daboo <[email-masked]>
Date: Tue, 12 Apr 2011 15:50:28 -0400

Hi folks,

--On March 29, 2011 9:34:12 AM -0400 Cyrus Daboo <[email-masked]> wrote:

> draft and post comments to the list. The WGLC will run for two weeks and
> end on April 13th.

One day left on this last call. We would still like to have reviews and 
feedback from more people, please.

-- 
Cyrus Daboo

---

From: Barry Leiba <[email-masked]>
Date: Tue, 12 Apr 2011 17:16:00 -0400

I like the two new examples, which I'll add.  And I'm happy to add an
informative reference to CardDAV as "work in progress" (for now).

And, yes, everyone: more reviews, please.  It took us a while to get
this to where we think it's right, and more checking will be useful.

Barry

---

From: Barry Leiba <[email-masked]>
Date: Tue, 12 Apr 2011 17:39:29 -0400

> should be more examples - your IP reject one is worth including. Another
> might be (modifying Example 2 in RFC5703 -

FYI, I changed the wording a little, and put this introductory text in
the example:

        This example uses several features of the MIME parts extension
        <xref target="RFC5703"/>
        to scan for unsafe attachment types.
        To make it easily extensible, the unsafe types are kept in an
        external list, which would be shared among all users and all scripts,
        avoiding the need to change scripts when the list changes.

        [Note that this is an illustrative example, and more rigorous
        mailware filtering is advisable.  It is insufficient to base
        email security on checks of filenames alone.]

Without the second paragraph, I think people might misinterpret us,
and we'd surely get pushback from the security folks.

Barry

---

From: Cyrus Daboo <[email-masked]>
Date: Tue, 12 Apr 2011 18:14:12 -0400

Typo "mailware" - other than that this looks fine. 

-- 
Cyrus Daboo
(Tapped out on my iPad)

---

From: [email-masked]
Date: Sat, 16 Apr 2011 17:14:34 -0700 (PDT)

Agreed. This example is a good addition.

				Ned

> _______________________________________________
> sieve mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sieve