Subject: Re: maximum size of a VALUE

From: Tom-PT Taylor <[email-masked]>
Date: Thu, 3 Feb 2000 09:34:42 -0500

Looks like a good one for "errata".

> -----Original Message-----
> From: Steven Magnell [SMTP:[email-masked]]
> Sent: Wednesday, February 02, 2000 7:20 PM
> To:   [email-masked]
> Subject:      maximum size of a VALUE
>
> This may be minor compared to other issues, but it seems that the maximum
> size of a VALUE is 64 characters (not including quotes) in the ABNF
> syntax.
> It should be larger, perhaps arbitrary. The ASN.1 definition of Value does
> not have this limitation.
>
> While this does not seem to be a concern with the basic packages, looking
> ahead to upcoming packages such as the display and text telephone packages
> in the otherpkgs draft and the cromwell ARF draft, there is a need to
> support longer strings. The text telephone package, for example, defines
> string parameters with a maximum of 256 characters and the others have
> strings of arbitrary length where some larger string, such as a display or
> text-to-speech announcement, would certainly be reasonable.
>
> steve magnell

---

From: Abdallah Rayhan <[email-masked]>
Date: Thu, 3 Feb 2000 10:06:37 -0500

Not too fast. I believe couple of the issues were considered when 64 was

decided; efficiency and security. We dont have max msg size restriction.
A
user could cause buffering flooding intentionally if VALUE is huge, not
to
mention parsing a msg with huge VALUEs. This could reduce the efficiency

dramatically. Also, what if VALUE is used to pass malicious code through

a firewall. If VALUE is unlimited, we could be jeopardizing security. If
64 is
too small we could increase it to 128 or 256 but not unlimited.

Abdallah Rayhan

"Taylor, Tom-PT (P.T.) [EXCHANGE:CAR:B904]" wrote:

>      size of a VALUE is 64 characters (not including quotes) in the
>      ABNF syntax.

---

From: John Segers <[email-masked]>
Date: Thu, 3 Feb 2000 17:11:55 +0100

Abdallah,

I feel 128 and 256 are still overly restrictive.  If you have
text-to-speech capability in your MG, you wouldn't be able to have
announcements that are longer than 128/256 characters.

The malicious code problem only becomes important if you allow values
that contain code to be executed by the MG.  I would like to have
scripting, but it isn't in the protocol.  And if it were, I wouldn't
want script size to be restricted to 256 characters.

John

Abdallah Rayhan wrote:
> decided; efficiency and security. We dont have max msg size
> restriction. A
> user could cause buffering flooding intentionally if VALUE is huge,
> not to
> a firewall. If VALUE is unlimited, we could be jeopardizing security.
> If 64 is

--
John Segers                                  email: [email-masked]
Lucent Technologies                                        Room HE 306
Dept. Forward Looking Work                      phone: +31 35 687 4724
P.O. Box 18, 1270 AA  Huizen                      fax: +31 35 687 5954