Subject: Re: vacation stuff

From: Michael Haardt <[email-masked]>
Date: Mon, 04 Jul 2005 10:41:19 +0200

> > I fail to see any real added risk here. Consider: Vacation can be executed at
> > most once per incoming message, so the maximum number of database entries the
> > vacation action can produce per incoming message is one. So, if the intent is
> > to fill up the database, the simplest way to do it is set up regular vacation
> > without a handle setting and send in a bunch of messages from different
> > sources. Note. however, that implementations are free to limit the number of
> > remembered responses, so this trick will only work if the implementation allows
> > it.

The implementation may limit the number of remembered responses, but not
the number of databases.  What's a reasonable lowest limit that scripts
should be able to rely on? 100?

I don't know if it's worth an entry under "security considerations", but
allowing the implementation to limit of number of databases sounds useful
to me.  I never thought about a script using a large number of them.

Michael

---

From: Ned Freed <[email-masked]>
Date: Wed, 13 Jul 2005 10:13:11 -0700 (PDT)

(getting back to this now - sorry for the delay)

> the number of databases.

I guess I don't understand what the "number of databases" is or why it should
be limited. It certainly doesn't seem like you're talking about the number of
database entries, which in any case would be the same as the number of
remembered responses.

> What's a reasonable lowest limit that scripts

> to me.  I never thought about a script using a large number of them.

This now sounds like you're talking about limiting how many handles a given
script can specify. But I still don't see the point, since a given script can
only have one handle apply per incoming message, so the overriding limit
is still the number of remembered responses.

				Ned