-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
In message <1a1a7e6cc7c.117c9d771421195.5742950317250272831@wadevelopmen
t.co>, William Weiner <[email protected]> writes
>+1 to hashing MIME parts separately.
without providing new forms of recipe I don't see how this helps
anything -- the recipe is fundamentally the same if you remove 100 lines
or if you remove a 100 line MIME part
BTW: you can also have a LOT of MIME parts, most days I make a half-
dozen emails with 50 MIME attachments, but that's a bit odd of course.
Attachments will underestimate MIME parts by 2 or 3 in most messages.
However when I look at data from $DAYJOB$ I see that a typical day has a
handful of messages with 30 or more attachments, hundreds of thousands
of message with 20+ attachments and we get into the millions at around
12 or 13 attachments.
That's a lot of hashes to put into header fields.
>A Recipe that can undo a removal has to carry the removed content forward. If
>a
>safety filter strips a malicious content, the removed content travels on in
>the
>Message-Instance headers, and anything that reconstructs would put it back.
That would be dumb of course
> A
>filter whose purpose is removal will choose a null body Recipe and under -09
>that means the message cannot be fully verified.
Delivering it seems dumb ... why would I want to receive a message that
was malicious ? especially in a DKIM2 world where the offending message
can be correctly delivered back to its origin with an appropriate note.
>Perpart hashing gives safety removal a path and the original signature can
>still
>be checked.
You can check the 11 (or 30 or 49 or whatever) MIME parts that remain.
Depending on what was removed (a big JPEG saying "this is all a joke, do
not take this email literally" ??) the semantic meaning of the message
may or may not be preserved.
>Removed attachments map onto that directly. A dangerous link inside
>an HTML part does not; that would need the same idea at a finer grain, which
>likely is not worth the complexity.
Again ... who are these vendors that insist on giving me bad email ?
What security gateways generally do is rewrite URLs into a form that
will send clicks via their proxy where they can block the page if
information has only recently come to light about its status.
- --
richard @ highwayman . com "Nothing seems the same
Still you never see the change from day to day
And no-one notices the customs slip away"
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBauyY9GHfC/FfW545EQITpACg7y2N0HVcnN7Tv2iznEtB+GjIJocAnAyi
T7Edeb38YSN8FZ/lp2d5p44Y
=j0XL
-----END PGP SIGNATURE-----
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
