4 ms·

Among other interesting things: "for the exchange of DNA profile information [...]: Data are exchanged by Simple Mail Transfer Protocol (SMTP) and other state-o

by Faaak 6y ago

Among other interesting things: "for the exchange of DNA profile information [...]: Data are exchanged by Simple Mail Transfer Protocol (SMTP) and other state-of-the-art technologies, using a central relay mail server provided by the network provider. The XML file is transported as mail body" Well, this is not good

wongarsu 6y ago
Why? XML in S/MIME over SMTP might not be cutting edge, but it's still state-of-the-art. I would be hard pressed to come up with something better that's equally based on open, established standards. XML is the only thing I would like to replace, but that's probably not worth it given the number of existing legacy systems
- jmnicolas 6y ago
  > for the exchange of DNA profile information So you're fine that your DNA information is transmitted in clear in an email?
  - matthewmacleod 6y ago
    It’s not “in clear” though, is it? It’s encrypted.
  - wongarsu 6y ago
    Of course it's encrypted, the deal reads "The open standard s/MIME as extension to de facto e-mail standard SMTP will be deployed to encrypt messages containing DNA profile information" (highlight mine). Then it goes on with technical details (that could be updated a bit), then the mention that common email software already supports this (including those from the headline, which is how we got this headline). https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/948119/EU-UK_Trade_and_Cooperation_Agreement_24.12.2020.pdf https://assets.publishing.service.gov.uk/government/uploads/... page 921
  - Piskvorrr 6y ago
    Except...not. HTTP is also cleartext, but it is usually tunelled through TLS. The entire stack matters, not that this one part is insecure when considered in isolation.
kortilla 6y ago
That’s all open source standardized. That’s a million times better than a dependency on GitHub, AWS, or some Google Drive link.
moby_click 6y ago
A really puzzling part: "SMTP is a ‘push’ protocol that does not allow one to ‘pull’ messages from a remote server on demand. To do this a mail client shall use POP3 or IMAP. Within the framework of implementing DNA data exchange it is decided to use the protocol POP3."
- albertgoeswoof 6y ago
  What’s puzzling about that? It’s true, and seems a reasonable choice
  - moby_click 6y ago
    Unless they invented a creative way to use pop3, it is not 'pull' in any reasonable sense, because you can only pull what has already been pushed. You can't even even select what to pull once more than one request is outstanding, because pop3 does not convey information beyond message size. Also, you have to poll continuously, destroying the benefit of having something pushed over smtp.
megablast 6y ago
You prefer Snapchat or tik tok??

by Faaak 6y ago

wongarsu 6y ago

Why? XML in S/MIME over SMTP might not be cutting edge, but it's still state-of-the-art. I would be hard pressed to come up with something better that's equally based on open, established standards. XML is the only thing I would like to replace, but that's probably not worth it given the number of existing legacy systems

jmnicolas 6y ago
> for the exchange of DNA profile information So you're fine that your DNA information is transmitted in clear in an email?
- matthewmacleod 6y ago
  It’s not “in clear” though, is it? It’s encrypted.
- wongarsu 6y ago
  Of course it's encrypted, the deal reads "The open standard s/MIME as extension to de facto e-mail standard SMTP will be deployed to encrypt messages containing DNA profile information" (highlight mine). Then it goes on with technical details (that could be updated a bit), then the mention that common email software already supports this (including those from the headline, which is how we got this headline). https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/948119/EU-UK_Trade_and_Cooperation_Agreement_24.12.2020.pdf https://assets.publishing.service.gov.uk/government/uploads/... page 921
- Piskvorrr 6y ago
  Except...not. HTTP is also cleartext, but it is usually tunelled through TLS. The entire stack matters, not that this one part is insecure when considered in isolation.

kortilla 6y ago

That’s all open source standardized. That’s a million times better than a dependency on GitHub, AWS, or some Google Drive link.

moby_click 6y ago

A really puzzling part: "SMTP is a ‘push’ protocol that does not allow one to ‘pull’ messages from a remote server on demand. To do this a mail client shall use POP3 or IMAP. Within the framework of implementing DNA data exchange it is decided to use the protocol POP3."

albertgoeswoof 6y ago
What’s puzzling about that? It’s true, and seems a reasonable choice
- moby_click 6y ago
  Unless they invented a creative way to use pop3, it is not 'pull' in any reasonable sense, because you can only pull what has already been pushed. You can't even even select what to pull once more than one request is outstanding, because pop3 does not convey information beyond message size. Also, you have to poll continuously, destroying the benefit of having something pushed over smtp.

megablast 6y ago

You prefer Snapchat or tik tok??