I know this is off the current subject., but some of you are sending these e-mail's to the list that appear as attachments and not text. This is even more annoying than HTML Mail. The message appears with an empty body and attachments that have names that start with ATT.... This is annoying. Many people wont read your messages because opening attachments is a security risk. If you want your postings read, please use plain text e-mail and not these stupid ATT attachments. (flame off) ----- Original Message ----- From: "Joseph T. Klein" <jtk@titania.net> Cc: <nanog@trapdoor.merit.edu> Sent: Tuesday, July 09, 2002 5:21 PM Subject: Billing Notice

On Tue, Jul 09, 2002 at 04:41:46PM -0600, mike@rockynet.com said:

John Palmer wrote:

...

I know this is off the current subject., but some of you are sending these e-mail's to the list that appear as attachments and not text.

Agreed, that is annoying.

It appears to be the result of PGP signed messages, from every instance I can see:

[snip] It is. I know mutt, at least, switched to the PGP/MIME attachment style of signatures from the old ASCII-armored messages a few versions back. I personally liked the old style better, but the new one appears to be compliant to the current MIME standards. I'm willing to accept a bit of annoyance in order to promote standards compliance. If only Microsoft was thus motivated. -- -= Scott Francis || darkuncle (at) darkuncle (dot) net =- GPG key CB33CCA7 has been revoked; I am now 5537F527 illum oportet crescere me autem minui

I'm afraid you have brought up one of my pet peeves here. On 03:57 PM 7/9/02, Bill Thompson wrote:

What you are seeing is PGP/MIME, a standards based protocol for

<snip blah blah blah> Standards exist as a way for parties who *agree* to use certain data formats to use a previously defined standard format without having to redefine or renegotiate the format all the time. Just because a standard exists for sending email with certain types of attachments, that doesn't mean that all users must agree to use clients that can (and will) process data in every new format, and thus everyone else needs to immediately adjust to each and every new standard that managed to make it thru the RFC process. For instance, there's a "standard" for the text/html protocol too (and dozens of others), yet we clearly eschew that "standard" for messages sent to this mailing list. What makes the PGP-MIME standard different, and so important, that the rest of us have to adapt to it, while eschewing other new standards? What's wrong with just using plain text and putting the damn PGP sig in the body? That's a standard that all email clients can process, and it works for everyone. Heck, it even worked for you when you sent the post I'm replying to here....

"John Palmer" <nanog@adns.net> wrote:

...

This is even more annoying than HTML Mail.

That would be annoying if it were true.

What is most annoying is the apparent insistence that this particular standard is so critically important that everyone should rush out and upgrade their mail clients to new ones that can process these attachments (while 1001 other new types can just be ignored). There are other ways to achieve the same goal (using plain text, no attachments needed), especially in a discussion list forum. I find your position on PGP-MIME to be a violation of the spirit of RFC 1855 (which predates 2015): - If you include a signature keep it short. Rule of thumb is no longer than 4 lines. Remember that many people pay for connectivity by the minute, and the longer your message is, the more they pay. - "Reasonable" expectations for conduct via e-mail depend on your relationship to a person and the context of the communication. Norms learned in a particular e-mail environment may not apply in general to your e-mail communication with people across the Internet. Be careful with slang or local acronyms. - Delivery receipts, non-delivery notices, and vacation programs are neither totally standardized nor totally reliable across the range of systems connected to Internet mail. They are invasive when sent to mailing lists, and some people consider delivery receipts an invasion of privacy. In short, do not use them. (today's multitude of attachment formats are the invasive equivalent of yesteryear's invasive and non-standard auto-responders, especially when sent to mailing lists) - Be careful with monospacing fonts and diagrams. These will display differently on different systems, and with different mailers on the same system. IMHO if you had to be careful about _font spacing_ to ensure your message was readable to everyone in the discussion forum, today you should be even *more* careful about attachments, ensuring that your message is sent in a format where it can be "properly displayed" on *all* recipient systems. Attempting to force a new format on all members of a large and diverse mailing list when the new format is neither necessary nor widely supported (and reasonable alternatives exist) is just selfish, and rude. jc

Eric A. Hall <ehall@ehsco.com> was seen to declaim:

Nobody is forcing anybody to adopt it. I think the point is people with non-compliant maillers delete mails with attachments and no body on sight... sometimes, in an automated rule. If you don't care that a percentage of your recipients don't ever get to see your missives (and/or think you are infected with some sort of virus) as long as those that use the same software as you do, then you are in good company - its how most web designers seem to feel about Internet Explorer and flash.

OTOH, complaining to people who use the spec about problems with your own mailer is pretty dumb. As has already been pointed out, just because a standard exists is not a good reason to use it if there is a more backwards-complaint standard that does the same job - like clearsigning the message in the body. As an (extreme) counter-example, there are standards I would be compliant with if I had decided to start each paragraph with a pretty illuminated capital (using a gif image), change the font to a nice, bubbly font in ebcdic order (and include a AOT file for that) and then wrap the whole thing up in mime multipart/related so that a *compliant* reader could view it. however, I am fairly sure that would get me booted from the list *and* would be megabytes of unreadable garbage to most of the list (it is probably unreadable garbage now, but that is just their personal opinion of my emails :) Just because it is a standard, doesn't mean it is appropriate.

Thus spake "Leo Bicknell" <bicknell@ufp.org>

More to the point, if anyone bothered to look at a MIME/PGP message, that's all it is. Specifically, you'll see two parts:

] Content-Type: text/plain; charset=us-ascii ] Content-Disposition: inline ] Content-Transfer-Encoding: quoted-printable

] Content-Type: application/pgp-signature ] Content-Disposition: inline

If your mailer isn't showing you the first one as a text/plain message, even if it doesn't understand the second you need a new mailer.

You left out the MIME header that's actually causing the problem: ] Content-Type: multipart/signed; micalg=pgp-md5; ] protocol="application/pgp-signature"; boundary="0eh6TmSyL6TZE2Uz" My MUA understands multipart/mixed and multipart/alternative; it doesn't understand multipart/signed and therefore has no clue what to do with the message as a whole, even if it does understand one of the component's type. If anyone has a procmail recipe for dropping the second part and promoting the text/* to main body, I'm all ears. S

In a message written on Wed, Jul 10, 2002 David Howe wrote:

...

I think the point is people with non-compliant maillers delete mails with attachments and no body on sight... sometimes, in an automated rule. If you don't care that a percentage of your recipients don't ever

Ok, I tried to stay out of this one, but this comment made me feel I have to jump in. I'm all against attachments, file attachments. Just because a message is MIME encoded, does not mean it is a file though. If people are throwing away MIME messages with a single "text/plain" section then they are firmly in the wrong. All of the "modern" text and GUI mailers display this properly, inline, as a plain old text message. Yup - I am not defending M$'s crapware here; any decent mail client written in the last few years should at least show the text inline and

"Leo Bicknell" <bicknell@ufp.org> illuminated our understanding with: the sig as an attachment. What I am trying to say is it isn't a good defense to say "oh, but its an RFC and my client can handle it, so yours is broken". A documented abomination (and M$'s crapware handles that abomination I came up with just fine) is still an abomination. However, I try to avoid any sort of attachment or mime encoding for mailing lists - simply because it can be badly broken by the list itself (some lists strip attachments, leaving an uninteresting blank message when you try to use pgp mime; some people read in digest mode which is why attachments are stripped, and so forth). pgp mime avoids taking up message body space with the signature (which in most cases can be four times the size of the message) so is a good thing - but that doesn't mean that you should openly insult anyone whose software doesn't include this feature. smtp works best with plaintext ascii-7; anything else is a bonus, but shouldn't be mandatory.

On Wed, 10 Jul 2002, JC Dill wrote:

What part of "it is rude to expect all members of a large and diverse mailing list to accept and parse your particular attachment format" isn't perfectly clear?

Netiquette. It's been around a looooong time. You might try following it.

I have no problem reading the attachments (pine displays most attachments nicely), but personally I think the notion of pgp signing every mail you send is extremely arrogant. Remind me again about why I should care about whether or not somebody was spoofing Joe Klein's email address, when this is the content: ------------- This mail is to notify you that the OC768c that you have ordered has been installed (sometime soon ... promise ... after the check clears). Please send the check for 1,000,000,000.00 USD for the first six months of service to: CASH c/o Joseph T. Klein retirement fund. P.O.Box 551510 Las Vegas, NV. 89155-1510 Thank You. ------------- So, in sum: To the people who complain about not being able to read attachments: Learn how to filter. To the people who so arrogantly pgp sign every email they send: Learn how to consider the importance of your words. Andy xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Andy Dills 301-682-9972 Xecunet, LLC www.xecu.net xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Dialup * Webhosting * E-Commerce * High-Speed Access

On Wed, 10 Jul 2002, Joseph T. Klein wrote:

Regarding electronic signatures.

The post was signed so you know for certain that I'm the knucklehead that accidentally started the OT thread with my stupid joke. Arrogant or not IMHO PGP sigs are a good business practice.

...when doing business.

Signing post means only that you know with some certainty the bozo to hold responsible. I want to own up to my bozoesk, arrogant and stupid ramblings.

Ah, and that's where the arrogance comment came from. You assume that the members of nanog care. I'm not trying to call you an arrogant person, and I recognize that you're not being blatantly arrogant, it's more of a passive assumption. The passive assumption is that your words are important enough that somebody might want to verify them. So, does EVERY email need to be pgp signed? When was the last time somebody on this list bothered to check the validity of a pgp signed message which they received via nanog? I mean, if John Sidgmore posted to that from now on, Worldcom's official pricing is $100/meg with a 3 meg commit, I wouldn't believe it for a second unless it was signed and I verified it. Andy xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Andy Dills 301-682-9972 Xecunet, LLC www.xecu.net xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Dialup * Webhosting * E-Commerce * High-Speed Access

My mail user agent verifies every pgp signature it reads. Automatically. Isn't NANOG business??? I work for a big North American Network, have been accused on being an Operator, and on rare occasions post things that are on topic. I'm confused ... We have signing parties at NANOG and IETF to promote the use of trusted e-mail. --On Wednesday, 10 July 2002 15:01 -0400 Andy Dills <andy@xecu.net> wrote:

When was the last time somebody on this list bothered to check the validity of a pgp signed message which they received via nanog?

-- Joseph T. Klein jtk@titania.net "I thought PGP signature where cool." -- an arrogant bastard

On Mon, 15 Jul 2002, Brad Knowles wrote:

...

So, does EVERY email need to be pgp signed?

Do you need to use ssh every time you access a server remotely?

Every time the device runs ssh and I have to type a password, yes.

Surely you know when your line is being tapped or when your packets are being sniffed, and you choose only those times to use ssh, and otherwise you use telnet?

There's some degree of truth to this. For instance, most of my routers do not run ssh. However, I control the network between here and there, so I am comfortable that nobody is capable of sniffing the session, so I am comfortable using telnet and not going through an OOB connection.

Same goes for actually using passwords to login -- surely you know when it's a legitimate user that is trying to login and when it's someone trying to gain illicit access to your system, and you require them to use passwords accordingly?

Of course not. In the previous two situations, a human is making decisions, "judgement calls". This situation, you're asking a computer to do so. Bad analogy.

...

When was the last time somebody on this list bothered to check the validity of a pgp signed message which they received via nanog?

When was the last time anyone on this list bothered to check the validity of any message they received via any channel? I mean, if you're going to use probability to support your argument, you might as well widen the discussion to a much broader sample group.

So why is it that people are bothering to sign their posts to nanog if nobody cares if the people are who they say they are?

...

I mean, if John Sidgmore posted to that from now on, Worldcom's official pricing is $100/meg with a 3 meg commit, I wouldn't believe it for a second unless it was signed and I verified it.

Not everything is black and white. At what level would you choose to validate a message like this?

"Not everything is black and white." Does that mean you agree with me that not everything needs to be signed? Or does that mean you agree with me in that a judgement call must be made? Andy xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Andy Dills 301-682-9972 Xecunet, LLC www.xecu.net xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Dialup * Webhosting * E-Commerce * High-Speed Access

Scott Francis wrote:

There are a great many good reasons to do so, and no good reasons not to. Broken software and laziness don't count.

Sure there are. Non-repudiation is not always a good thing. Do you get every physical document you write notarized? If you are sued and email is submitted as evidence by the plaintiff would you rather the mail be signed or unsigned? Bradley

On Wed, 10 Jul 2002, Andy Dills wrote:

On Wed, 10 Jul 2002, JC Dill wrote:

[ SNIP ]

To the people who so arrogantly pgp sign every email they send: Learn how to consider the importance of your words.

Andy

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Andy Dills 301-682-9972 Xecunet, LLC www.xecu.net xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Dialup * Webhosting * E-Commerce * High-Speed Access

Damn you bastard! netiquette violating people with >4 line sigs.

on 7/10/2002 10:53 AM Leo Bicknell wrote:

More to the point, if anyone bothered to look at a MIME/PGP message, that's all it is. Specifically, you'll see two parts:

] Content-Type: text/plain; charset=us-ascii ] Content-Disposition: inline ] Content-Transfer-Encoding: quoted-printable

] Content-Type: application/pgp-signature ] Content-Disposition: inline

There's also the multipart/signed parent container. Of course, RFC2046 says that UNKNOWN MEDIA-TYPES are to be treated as multipart/mixed: | 5.1.7. Other Multipart Subtypes | | Other "multipart" subtypes are expected in the future. MIME | implementations must in general treat unrecognized subtypes of | "multipart" as being equivalent to "multipart/mixed". A mailer which displays the embedded text as attachments is going out of its way to be incompatible with the spec. -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/