Re: Trailing whitespace and PGP/MIME

[Simon Josefsson <jas@extundo.com>]

Russ Allbery <rra@stanford.edu> writes:

> Simon Josefsson <jas@extundo.com> writes:
>
>> Ah.  Hm.  Er.  So what IS the right thing?  The MUST above is for
>> PGP/MIME, yes, but the _reason_ the MUST is there in the document is
>> about as valid for plain PGP as it is for PGP/MIME, I think, arguing
>> that the obvious approach is the right.
>
> It shouldn't be as valid for inline PGP.  PGP implementations generally
> handle trailing spaces without difficulty when processing attached
> signatures (by stripping them before processing the message).

Even pre-OpenPGP implementations?  E.g., PGP 2.x.  RFC 1991 does not
mention "whitespace", "trailing", or "strip".  Gnus currently claim to
support them, although I'm not sure this is a good idea, nor if anyone
actually uses PGP 2.x.

>> One (non-)solution is to warn the user whenever the message content
>> may not work reliably with plain PGP and ask the user if she wants to
>> continue, or use PGP/MIME instead.
>
> This is going to get really annoying for people who use inline signatures
> with a sig delimiter.
>
> The real solution is for people to stop using the broken inline PGP
> signature standard and switch to PGP/MIME so that the true structure of
> their messages is exposed to software, but it's so hard to convince people
> of that....

So maybe an annoying blurb showing up every time users try to use
inline PGP with non-ASCII, trailing whitespace, or dash escaped text,
is the best we can hope to do.  If we annoy people with the blurb,
maybe they stop annoying us by using inline PGP.

For pure-ASCII, no trailing whitespace, no possibly dash escaped text,
use of inline isn't that bad, especially for announcements stored in
files -- PGP/MIME is too e-mail specific to be used in that case.