Bugtraq mailing list archives
RE: base64
From: Michael Wojcik <Michael.Wojcik () microfocus com>
Date: Fri, 26 Sep 2003 12:11:50 -0700
From: Bennett Todd [mailto:bet () rahul net] Sent: Friday, September 26, 2003 1:08 PM For the kind of companies I work in, the very best solution would (in my opinion!) be a canonicalizer that was smart enough to hold off actually committing any rewrites until it finds something that's ambiguous or dangerous, and that leaves notes describing what it did and why.
Keep in mind that canonicalization, or any other sort of rewriting, is considerably more complex than scanning for invalid syntax and rejecting, and so it's more prone to be fragile and have bugs itself. I agree, though, that there won't be a universal solution. For my own incoming email, I'd prefer a strict filter that rejects (or more likely quarantines for further study) any messages with invalid Base64 or MIME syntax. With the amount of email traffic I get, and the proportion likely to fall into that category, that's manageable. But large organizations with many nontechnical users will obviously have different requirements. -- Michael Wojcik Principal Software Systems Developer, Micro Focus
Current thread:
- Re: base64, (continued)
- Re: base64 Bennett Todd (Sep 25)
- Re: base64 MightyE (Sep 25)
- Re: base64 Earl Hood (Sep 26)
- Re: base64 Bennett Todd (Sep 26)
- Re[2]: base64 3APA3A (Sep 26)
- RE: base64 Alun Jones (Sep 26)
- Re: base64 Bennett Todd (Sep 26)
- Re: base64 Bennett Todd (Sep 26)
- Re: base64 Greg A. Woods (Sep 27)