From: Jeremy Nickurak Date: Thu, 8 Mar 2012 17:38:32 +0000 (+1700) Subject: Re: a DoS vulnerability associated with conflated Message-IDs? X-Git-Url: http://git.tremily.us/gitweb.cgi?a=commitdiff_plain;h=0ebcd06a6cc1de02655d9533edd6e5f5a55c5c4f;p=notmuch-archives.git Re: a DoS vulnerability associated with conflated Message-IDs? --- diff --git a/87/b71206af039e4a2f4fd5eb7e4233e38d3d6a69 b/87/b71206af039e4a2f4fd5eb7e4233e38d3d6a69 new file mode 100644 index 000000000..42da0f9ea --- /dev/null +++ b/87/b71206af039e4a2f4fd5eb7e4233e38d3d6a69 @@ -0,0 +1,74 @@ +Return-Path: +X-Original-To: notmuch@notmuchmail.org +Delivered-To: notmuch@notmuchmail.org +Received: from localhost (localhost [127.0.0.1]) + by olra.theworths.org (Postfix) with ESMTP id CFCC3431FB6 + for ; Thu, 8 Mar 2012 09:38:33 -0800 (PST) +X-Virus-Scanned: Debian amavisd-new at olra.theworths.org +X-Spam-Flag: NO +X-Spam-Score: -0.7 +X-Spam-Level: +X-Spam-Status: No, score=-0.7 tagged_above=-999 required=5 + tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] + autolearn=disabled +Received: from olra.theworths.org ([127.0.0.1]) + by localhost (olra.theworths.org [127.0.0.1]) (amavisd-new, port 10024) + with ESMTP id dyJJWOecBCvv for ; + Thu, 8 Mar 2012 09:38:33 -0800 (PST) +Received: from mail-pz0-f53.google.com (mail-pz0-f53.google.com + [209.85.210.53]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) + (No client certificate requested) + by olra.theworths.org (Postfix) with ESMTPS id 3F02B431FAE + for ; Thu, 8 Mar 2012 09:38:33 -0800 (PST) +Received: by dady25 with SMTP id y25so728800dad.26 + for ; Thu, 08 Mar 2012 09:38:32 -0800 (PST) +DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; + d=nickurak.ca; s=google-dkim; + h=mime-version:sender:x-originating-ip:in-reply-to:references:date + :x-google-sender-auth:message-id:subject:from:to:content-type; + bh=Il3a+ueWmxLt8LGWvwNlT/SPmvfwUTNPQrKBsmujjco=; + b=O1TP+mn41RkuiG7csH40eRZh3xmE7mWza8EB5gUqJv6l3wMqLO5y8IK1IJDBwPdLjQ + b4xkoW7YQuDXyomQGNXtVtDr9bePnIs3dolCg1MIKkYzsaFJ2Mo/kd74z8kd/Vu2ZDBj + qg59QIjZgLyB0/hUQiAx0PUq7AVdepBjg7T5E= +MIME-Version: 1.0 +Received: by 10.68.216.138 with SMTP id oq10mr10919223pbc.85.1331228312506; + Thu, 08 Mar 2012 09:38:32 -0800 (PST) +Sender: jeremy@nickurak.ca +Received: by 10.68.228.42 with HTTP; Thu, 8 Mar 2012 09:38:32 -0800 (PST) +X-Originating-IP: [128.221.197.58] +In-Reply-To: <4F58E962.1050403@fifthhorseman.net> +References: <87k42vrqve.fsf@pip.fifthhorseman.net> + <87ipif2fdn.fsf@wyzanski.jamesvasile.com> + <4F58E962.1050403@fifthhorseman.net> +Date: Thu, 8 Mar 2012 10:38:32 -0700 +X-Google-Sender-Auth: 1_sl2UIMbywzGKvatmc9BLQsNR8 +Message-ID: + +Subject: Re: a DoS vulnerability associated with conflated Message-IDs? +From: Jeremy Nickurak +To: notmuch +Content-Type: text/plain; charset=UTF-8 +X-Gm-Message-State: + ALoCoQlwAw35DwXun8NdZPPp1qUUcc0H16M8Bhm5+7GysyXehkbmpiHYf1uOiBEQ4nQr8eAQ3mea +X-BeenThere: notmuch@notmuchmail.org +X-Mailman-Version: 2.1.13 +Precedence: list +List-Id: "Use and development of the notmuch mail system." + +List-Unsubscribe: , + +List-Archive: +List-Post: +List-Help: +List-Subscribe: , + +X-List-Received-Date: Thu, 08 Mar 2012 17:38:33 -0000 + +On Thu, Mar 8, 2012 at 10:16, Daniel Kahn Gillmor wrote: +> Any other suggestions or ideas? + +What about representing the contents from both message in one apparent message? + +- Aggregate the headers together, perhaps? +- Where headers disagree, display both +- If the bodies disagree, display both.