Home page logo

bugtraq logo Bugtraq mailing list archives

RE: base64
From: Michael Wojcik <Michael.Wojcik () microfocus com>
Date: Fri, 26 Sep 2003 12:11:50 -0700

From: Bennett Todd [mailto:bet () rahul net] 
Sent: Friday, September 26, 2003 1:08 PM

For the kind of companies I work in, the very best solution would
(in my opinion!) be a canonicalizer that was smart enough to hold
off actually committing any rewrites until it finds something that's
ambiguous or dangerous, and that leaves notes describing what it did
and why.

Keep in mind that canonicalization, or any other sort of rewriting, is
considerably more complex than scanning for invalid syntax and rejecting,
and so it's more prone to be fragile and have bugs itself.

I agree, though, that there won't be a universal solution.  For my own
incoming email, I'd prefer a strict filter that rejects (or more likely
quarantines for further study) any messages with invalid Base64 or MIME
syntax.  With the amount of email traffic I get, and the proportion likely
to fall into that category, that's manageable.  But large organizations with
many nontechnical users will obviously have different requirements.

Michael Wojcik
Principal Software Systems Developer, Micro Focus

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]