ietf-wg-emailcore / emailcore

3 stars 0 forks source link

Discussion of "Bcc:' and "Resent-bcc:" in rfc5322bis #87

Open aamelnikov opened 6 months ago

aamelnikov commented 6 months ago

John Klensin wrote:

In the process of slogging through the "Resent-" discussion,
which I imagine I'm not the only one coming to resent ( 🙁 ), I
did notice one thing of substance while writing an earlier note
[1].  One of the "Resent-*:" fields listed in the spec is
"Resent-bcc:".  Drawing from the recent discussions about
multiple RCPT commands in rfc5321bis and about the appropriate
use of "Bcc:" header fields with data in rfc5322bis (See the
three choices in Section 3.6.6 and the last paragraph of the
Security Considerations), it would probably be appropriate to
modify the text to warn against the uncritical use of
"Resent-bcc:" as well as about "Bcc:".

AFAICT, the same concerns apply to "Resent-bcc:" as well as
"Bcc:" and it is probably an error to not point that out.

The easiest (least painful for Pete) way to do that would
probably be to change the last paragraph of Section 5 (Security
Considerations) to point to "Resent-bcc:" (and Section 3.6.6) as
well as "Bcc:" (and 3.6.3).  But editor's choice.
aamelnikov commented 6 months ago

Pete Resnick wrote:

Oh, and Security Considerations needs to be updated anyway to account
for the change we made to the Bcc section in 3.6.3  previously, so no skin
of my nose to add a note saying, "Similar considerations need to be given
to the use of 'Resent-Bcc:' field described in section 3.6.6." 
aamelnikov commented 6 months ago

Pete's reply to Dave Crocker's proposal:

https://mailarchive.ietf.org/arch/msg/emailcore/ldc8eMWRdn5XuQS25oIUFES2TwE