Subject: Re: Eliminating Virus Spam

From: Vernon Schryver <[email-masked]>
Date: Wed, 3 Jan 2001 17:38:31 -0700 (MST)

> From: "Theodore Y. Ts'o" <[email-masked]>

> ...
> I agree that filtering multipart messages goes too far; they can be
> useful.

Please point to an example of a useful multipart message seen in
this list or that might someday be useful in this mailing list.
I have Microsoft, Linux, and various BSD UNIX systems, but I cannot
think of any way I or anyone at @rhyolite.com or almost anywhere else
might find a use VCARDs from an IETF list.  I honestly cannot think
of anything that is not a simple non-MIME, 7-bit ASCII message and
that makes sense from the main IETF list.  What am I missing?

(Yes, most people have non-U.S.English (i.e. non-ASCII) characters in
their names and anything they write in their mother tongues, but anyone
who wants their name or anything else to be understood in an international
email forum has no alternative but to use transliterations to ASCII.)

(I keep saying "main IETF list" on the possibility that some WG list
might reasonably need to ship arbitrary MIME attachments.)

> ...
> simply filtering all messages that orignated from Microsoft MUA's (which
> would also solve the problem), although arguably that penalizes the
> wrong set of people --- the users, instead of the idiots who wrote the
> MS-MUA's in the first place.

On contrary, the idiots are merely agents of the users.  The idiots
should be penalized only by the common, many years old skepticism of
resumes with the well known stigmata.

The people who should and do go to jail for "cracking" and other fun are
not the authors of the tools and scripts but those who use them.  The
people who should be penalized for the behavior of their MUA's and MTA's
are the people who own the computers and software and who continue to use
it despite knowing that it is simply wrong that "you can't go wrong by
buying Microsoft."

The problem with PC software is not the vendors, but the users who refuse
to deal with their responsibilities.  Those who whine that it's not their
fault that their employers "standardize" on junk should be excluded from
all IETF activities for an intolerable lack of basic professional ethics
or at least technical competence.

Vernon Schryver    [email-masked]

---

From: [email-masked]
Date: Wed, 3 Jan 2001 17:03:16 -0800 (PST)

> this list or that might someday be useful in this mailing list.

Example:

A multipart/signed message containing a pgp signature known to
some/all members of this list.  As, for example, the ietf registrar pgp
signature (see http://www.ietf.org/ietf-registrar.asc).

			regards,
				Ted Hardie

---

From: Michael Richardson <[email-masked]>
Date: Thu, 04 Jan 2001 07:55:56 -0500

>>>>> "hardie" == hardie  <[email-masked]> writes:
    hardie> Example:

    hardie> A multipart/signed message containing a pgp signature known to
    hardie> some/all members of this list.  As, for example, the ietf registrar pgp
    hardie> signature (see http://www.ietf.org/ietf-registrar.asc).

  Of the subset that can process PGP, a very small number can actually
process multipart/signed.  I have never got mailcrypt.el to do it, 
the Euroda and Outlook PGP plug-ins don't do it. The only ones that I know do
it are PINE, ELM and EXMH. 
  So, such a message would be better done as a straight clear-signed message.

   :!mcr!:            |  Solidum Systems Corporation, http://www.solidum.com
   Michael Richardson |For a better connected world,where data flows faster<tm>
 Personal: http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html
	mailto:[email-masked]	mailto:[email-masked]

---

From: "Matt Crawford" <[email-masked]>
Date: Thu, 04 Jan 2001 08:10:44 -0600

> this list or that might someday be useful in this mailing list.

I have sent to wg lists a multipart containing a preamble and an
internet-draft or similar file.  This makes it easy for recipients to
save the draft as-is.  Sometimes I have made the file a
content/external-body to avoid stuffing O(100kB) into many mailboxes
where it wouldn't be wanted.

You said "this list", but the above scenario would apply if the
document were pertinent to a BOF or brand-new working group.

---

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Thu, 04 Jan 2001 10:13:34 -0500

The fact that very few can/do create/verify multipart/signed email is
mostly a statement on the extremely sad state of security on the
Internet; to which I guess I'm contributing by not signing my mail :-(

The use of authenticating tehcnology (even if it is just to
authenticate that two messages came from the same nym) should be
encouraged, not blocked.

Donald
===================================================================
 Donald E. Eastlake 3rd                    [email-masked]
 155 Beaver Streeet                         [email-masked]
 Milford, MA 01757 USA     +1 508-634-2066(h)   +1 508-261-5434(w)

From:  Michael Richardson <[email-masked]>
Message-Id:  <[email-masked]>
In-Reply-To:  Your message of "Wed, 03 Jan 2001 17:03:16 PST."
	                  <[email-masked]> 
Date:  Thu, 04 Jan 2001 07:55:56 -0500

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 05 Jan 2001 09:19:08 +0100

>   So, such a message would be better done as a straight clear-signed message.

Version 6.5.8 of the Eudora PGP plugin can generate and parse MIME 
multipart/signed.
--
Harald Tveit Alvestrand, [email-masked]
+47 41 44 29 94
Personal email: [email-masked]