bugtraq - Re: base64

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200309241841.OAA16656@Sparkle.Rodents.Montreal.QC.CA>
Date: Wed, 24 Sep 2003 14:30:21 -0400 (EDT)
From: der Mouse <mouse@...ents.Montreal.QC.CA>
To: bugtraq@...urityfocus.com
Subject: Re: base64


> 99.99% of all software should create the standard form, so please let
> the tiny fraction of users with broken software suffer when their
> mails get rejected.

> (Note: this of course applies not only to Base64 but to all aspects
> of header-parsing, file-format guessing etc...)

I agree with you that such errors should produce rejections.

But there's an awful lot of otherwise legitimate mail software out
there that commits (and more that accepts and passes along) rudimentary
errors like

- One-digit hour, minute, or second values
- Invalid timezone strings ("Pacific Standard Time", "CEST", "JST", etc)
- Completely missing timezones
- Non-encoded high-half characters in header text
  (From: "François" <fxm@...mple.net>)
- High-half characters in mail implicitly marked charset=US-ASCII
- Non-8859 characters (0x80-0x9f) in mail marked charset=iso-8859-1
- Retrying messages that have been 5xx-rejected

Indeed, I recently discovered I had been auto-unsubbed from this very
list for, as near as I can tell, rejecting mail exhibiting some of
those syntax errors.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@...ents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B