- From: poot <cvsmail@w3.org>
- Date: Mon, 10 Oct 2011 20:29:51 -0400
- To: public-html-diffs@w3.org
hixie: Drop text/html-sandboxed (whatwg r6657)
http://dev.w3.org/cvsweb/html5/spec/Overview.html?r1=1.5338&r2=1.5339&f=h
http://html5.org/tools/web-apps-tracker?from=6656&to=6657
===================================================================
RCS file: /sources/public/html5/spec/Overview.html,v
retrieving revision 1.5338
retrieving revision 1.5339
diff -u -d -r1.5338 -r1.5339
--- Overview.html 10 Oct 2011 22:40:47 -0000 1.5338
+++ Overview.html 11 Oct 2011 00:29:29 -0000 1.5339
@@ -1350,12 +1350,11 @@
<li><a href="#iana"><span class="secno">12 </span>IANA considerations</a>
<ol>
<li><a href="#text-html"><span class="secno">12.1 </span><code>text/html</code></a></li>
- <li><a href="#text-html-sandboxed"><span class="secno">12.2 </span><code>text/html-sandboxed</code></a></li>
- <li><a href="#multipart-x-mixed-replace"><span class="secno">12.3 </span><code>multipart/x-mixed-replace</code></a></li>
- <li><a href="#application-xhtml-xml"><span class="secno">12.4 </span><code>application/xhtml+xml</code></a></li>
- <li><a href="#application-x-www-form-urlencoded"><span class="secno">12.5 </span><code>application/x-www-form-urlencoded</code></a></li>
- <li><a href="#text-cache-manifest"><span class="secno">12.6 </span><code>text/cache-manifest</code></a></li>
- <li><a href="#web-scheme-prefix"><span class="secno">12.7 </span><code>web+</code> scheme prefix</a></ol></li>
+ <li><a href="#multipart-x-mixed-replace"><span class="secno">12.2 </span><code>multipart/x-mixed-replace</code></a></li>
+ <li><a href="#application-xhtml-xml"><span class="secno">12.3 </span><code>application/xhtml+xml</code></a></li>
+ <li><a href="#application-x-www-form-urlencoded"><span class="secno">12.4 </span><code>application/x-www-form-urlencoded</code></a></li>
+ <li><a href="#text-cache-manifest"><span class="secno">12.5 </span><code>text/cache-manifest</code></a></li>
+ <li><a href="#web-scheme-prefix"><span class="secno">12.6 </span><code>web+</code> scheme prefix</a></ol></li>
<li><a class="no-num" href="#index">Index</a>
<ol>
<li><a class="no-num" href="#elements-1">Elements</a></li>
@@ -2581,8 +2580,8 @@
matches the <code title="">media-type</code> rule defined in section
3.7 "Media Types" of RFC 2616, but does not contain any U+003B
SEMICOLON characters (;). In other words, if it consists only of a
- type and subtype, with no MIME Type parameters. <a href="#refsHTTP">[HTTP]</a><p>The term <dfn id="html-mime-type">HTML MIME type</dfn> is used to refer to the <a href="#mime-type" title="MIME type">MIME types</a> <code><a href="#text-html">text/html</a></code> and
- <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code>.<p>A resource's <dfn id="critical-subresources">critical subresources</dfn> are those that the
+ type and subtype, with no MIME Type parameters. <a href="#refsHTTP">[HTTP]</a><p>The term <dfn id="html-mime-type">HTML MIME type</dfn> is used to refer to the
+ <a href="#mime-type">MIME type</a> <code><a href="#text-html">text/html</a></code>.<p>A resource's <dfn id="critical-subresources">critical subresources</dfn> are those that the
resource needs to have available to be correctly processed. Which
resources are considered critical or not is defined by the
specification that defines the resource's format. For CSS resources,
@@ -7849,8 +7848,7 @@
cookies.</p>
<p>If the contents are <a href="#sandboxed-origin-browsing-context-flag" title="sandboxed origin browsing
context flag">sandboxed into a unique origin</a> (in an
- <code><a href="#the-iframe-element">iframe</a></code> with the <code title="attr-iframe-sandbox"><a href="#attr-iframe-sandbox">sandbox</a></code> attribute) or the
- resource was labeled as <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code>, a
+ <code><a href="#the-iframe-element">iframe</a></code> with the <code title="attr-iframe-sandbox"><a href="#attr-iframe-sandbox">sandbox</a></code> attribute), a
<code><a href="#securityerror">SecurityError</a></code> exception will be thrown on getting and
setting.</p>
</dd>
@@ -19932,7 +19930,7 @@
an attacker can convince the user to just visit the hostile content
directly, rather than in the <code><a href="#the-iframe-element">iframe</a></code>. To limit the
damage that can be caused by hostile HTML content, it should be
- served using the <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> MIME type.<div class="impl">
+ served from a separate dedicated domain.<div class="impl">
<p>While the <code title="attr-iframe-sandbox"><a href="#attr-iframe-sandbox">sandbox</a></code>
@@ -20112,27 +20110,19 @@
<p>In this example, some completely-unknown, potentially hostile,
user-provided HTML content is embedded in a page. Because it is
- sandboxed, it is treated by the user agent as being from a unique
- origin, despite the content being served from the same site. Thus
- it is affected by all the normal cross-site restrictions. In
- addition, the embedded page has scripting disabled, plugins
- disabled, forms disabled, and it cannot navigate any frames or
- windows other than itself (or any frames or windows it itself
- embeds).</p>
+ served from a separate domain, it is affected by all the normal
+ cross-site restrictions. In addition, the embedded page has
+ scripting disabled, plugins disabled, forms disabled, and it cannot
+ navigate any frames or windows other than itself (or any frames or
+ windows it itself embeds).</p>
<pre><p>We're not scared of you! Here is your content, unedited:</p>
-<iframe sandbox src="getusercontent.cgi?id=12193"></iframe></pre>
-
- <p>Note that cookies are still sent to the server in the <code title="">getusercontent.cgi</code> request, though they are not
- visible in the <code title="dom-document-cookie"><a href="#dom-document-cookie">document.cookie</a></code> IDL
- attribute.</p>
+<iframe sandbox src="http://usercontent.example.net/getusercontent.cgi?id=12193"></iframe></pre>
- <p class="warning">It is important that the server serve the
- user-provided HTML using the <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> MIME
- type so that if the attacker convinces the user to visit that page
- directly, the page doesn't run in the context of the site's origin,
- which would make the user vulnerable to any attack found in the
- page.</p>
+ <p class="warning">It is important to use a separate domain so that
+ if the attacker convinces the user to visit that page directly, the
+ page doesn't run in the context of the site's origin, which would
+ make the user vulnerable to any attack found in the page.</p>
</div><div class="example">
@@ -20184,13 +20174,11 @@
ill-advised, because it can make it quite hard to reason about what
will be allowed and what will not.</p>
- </div><p class="note">Potentially hostile files can be served from the
- same server as the file containing the <code><a href="#the-iframe-element">iframe</a></code> element
- by labeling them as <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> instead of
- <code><a href="#text-html">text/html</a></code>. This ensures that scripts in the files are
- unable to attack the site (as if they were actually served from
- another server), even if the user is tricked into visiting those
- pages directly, without the protection of the <code title="attr-iframe-sandbox"><a href="#attr-iframe-sandbox">sandbox</a></code> attribute.<p class="warning">If the <code title="attr-iframe-sandbox-allow-scripts"><a href="#attr-iframe-sandbox-allow-scripts">allow-scripts</a></code>
+ </div><p class="note">Potentially hostile files should not be served from
+ the same server as the file containing the <code><a href="#the-iframe-element">iframe</a></code>
+ element. Using a different domain ensures that scripts in the files
+ are unable to attack the site, even if the user is tricked into
+ visiting those pages directly, without the protection of the <code title="attr-iframe-sandbox"><a href="#attr-iframe-sandbox">sandbox</a></code> attribute.<p class="warning">If the <code title="attr-iframe-sandbox-allow-scripts"><a href="#attr-iframe-sandbox-allow-scripts">allow-scripts</a></code>
keyword is set along with <code title="attr-iframe-sandbox-allow-same-origin"><a href="#attr-iframe-sandbox-allow-same-origin">allow-same-origin</a></code>
keyword, and the file is from the <a href="#same-origin">same origin</a> as the
<code><a href="#the-iframe-element">iframe</a></code>'s <code><a href="#document">Document</a></code>, then a script in the
@@ -20421,7 +20409,6 @@
<li>The element's <code><a href="#document">Document</a></code> is <a href="#fully-active">fully active</a>.</li>
<li>The element has either a <code title="attr-embed-src"><a href="#attr-embed-src">src</a></code> attribute set or a <code title="attr-embed-type"><a href="#attr-embed-type">type</a></code> attribute set (or both).</li>
<li>The element's <code title="attr-embed-src"><a href="#attr-embed-src">src</a></code> attribute is either absent or its value is the empty string.</li>
- <li>The element's <code><a href="#document">Document</a></code> was not parsed from a resource whose <a href="#content-type-sniffing-0" title="Content-Type sniffing">sniffed type</a> as determined during <a href="#navigate" title="navigate">navigation</a> is <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> (unless this has been overridden as described above).</li>
<li>The element is not a descendant of a <a href="#media-element">media element</a>.</li>
<li>The element is not a descendant of an <code><a href="#the-object-element">object</a></code> element that is not showing its <a href="#fallback-content">fallback content</a>.</li>
</ul><p>Whenever an <code><a href="#the-embed-element">embed</a></code> element that was not <a href="#concept-embed-active" title="concept-embed-active">potentially active</a> becomes <a href="#concept-embed-active" title="concept-embed-active">potentially active</a>, and whenever
@@ -20466,26 +20453,18 @@
be unloaded.</p>
<p id="sandboxPluginEmbed">When a <a href="#plugin">plugin</a> is to be
- instantiated but it cannot be <a href="#concept-plugin-secure" title="concept-plugin-secure">secured</a> and either:
-
- <ul><li>the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> was
- set on the <a href="#browsing-context">browsing context</a> for which the
- <code><a href="#the-embed-element">embed</a></code> element's <code><a href="#document">Document</a></code> is the
- <a href="#active-document">active document</a> when that <code><a href="#document">Document</a></code> was
- created, or</li>
-
- <li>the <code><a href="#the-embed-element">embed</a></code> element's <code><a href="#document">Document</a></code> was
- parsed from a resource whose <a href="#content-type-sniffing-0" title="Content-Type
- sniffing">sniffed type</a> as determined during <a href="#navigate" title="navigate">navigation</a> is
- <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code></li>
-
- </ul><p>...then the user agent must not instantiate the
- <a href="#plugin">plugin</a>, and must instead render the <code><a href="#the-embed-element">embed</a></code>
- element in a manner that conveys that the <a href="#plugin">plugin</a> was
- disabled. The user agent may offer the user the option to override
- the sandbox and instantiate the <a href="#plugin">plugin</a> anyway; if the
- user invokes such an option, the user agent must act as if the
- conditions above did not apply for the purposes of this element.</p>
+ instantiated but it cannot be <a href="#concept-plugin-secure" title="concept-plugin-secure">secured</a> and the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed
+ plugins browsing context flag</a> was set on the <a href="#browsing-context">browsing
+ context</a> for which the <code><a href="#the-embed-element">embed</a></code> element's
+ <code><a href="#document">Document</a></code> is the <a href="#active-document">active document</a> when that
+ <code><a href="#document">Document</a></code> was created, then the user agent must not
+ instantiate the <a href="#plugin">plugin</a>, and must instead render the
+ <code><a href="#the-embed-element">embed</a></code> element in a manner that conveys that the
+ <a href="#plugin">plugin</a> was disabled. The user agent may offer the user
+ the option to override the sandbox and instantiate the
+ <a href="#plugin">plugin</a> anyway; if the user invokes such an option, the
+ user agent must act as if the conditions above did not apply for the
+ purposes of this element.</p>
<p class="warning">Plugins that cannot be <a href="#concept-plugin-secure" title="concept-plugin-secure">secured</a> are disabled in
sandboxed browsing contexts because they might not honor the
@@ -21137,19 +21116,12 @@
context</a>.</p>
<p id="sandboxPluginObject">Plugins are considered sandboxed for the
- purpose of an <code><a href="#the-object-element">object</a></code> element if either:</p>
-
- <ul><li>the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> was
- set on the <code><a href="#the-object-element">object</a></code> element's <code><a href="#document">Document</a></code>'s
- <a href="#browsing-context">browsing context</a> when the <code><a href="#document">Document</a></code> was
- created, or</li>
-
- <li>the <code><a href="#the-object-element">object</a></code> element's <code><a href="#document">Document</a></code> was
- parsed from a resource whose <a href="#content-type-sniffing-0" title="Content-Type
- sniffing">sniffed type</a> as determined during <a href="#navigate" title="navigate">navigation</a> is
- <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code></li>
+ purpose of an <code><a href="#the-object-element">object</a></code> element if the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed
+ plugins browsing context flag</a> was set on the
+ <code><a href="#the-object-element">object</a></code> element's <code><a href="#document">Document</a></code>'s <a href="#browsing-context">browsing
+ context</a> when the <code><a href="#document">Document</a></code> was created.</p>
- </ul><p class="note">The above algorithm is independent of CSS properties
+ <p class="note">The above algorithm is independent of CSS properties
(including 'display', 'overflow', and 'visibility'). For example, it
runs even if the element is hidden with a 'display:none' CSS style,
and does not run <em>again</em> if the element's visibility
@@ -45027,9 +44999,6 @@
browsing context flag</a> was set when the
<code><a href="#document">Document</a></code> was created</dt>
- <dt>If a <code><a href="#document">Document</a></code> was generated from a resource
- labeled as <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code></dt>
-
<dd>The <a href="#origin">origin</a> is a globally unique identifier
assigned when the <code><a href="#document">Document</a></code> is created.</dd>
@@ -46477,7 +46446,6 @@
following list, and process the resource as described there:</p>
<dl class="switch"><dt>"<code><a href="#text-html">text/html</a></code>"</dt>
- <dt>"<code><a href="#text-html-sandboxed">text/html-sandboxed</a></code>"</dt>
<dd>Follow the steps given in the <a href="#read-html" title="navigate-html">HTML document</a> section, and abort
these steps.</dd>
@@ -51912,7 +51880,6 @@
<ul class="brief"><li><code><a href="#text-cache-manifest">text/cache-manifest</a></code></li>
<li><code>text/css</code></li>
- <li><code><a href="#text-html-sandboxed">text/html-sandboxed</a></code></li>
<li><code><a href="#text-html">text/html</a></code></li>
<li><code>text/ping</code></li>
<li><code>text/plain</code></li>
@@ -67929,10 +67896,7 @@
<a href="#fully-active">fully active</a>, and when the element's
<code><a href="#document">Document</a></code>'s <a href="#browsing-context">browsing context</a> had its
<a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> when that
- <code><a href="#document">Document</a></code> was created, and when the element's
- <code><a href="#document">Document</a></code> was parsed from a resource whose <a href="#content-type-sniffing-0" title="Content-Type sniffing">sniffed type</a> as determined
- during <a href="#navigate" title="navigate">navigation</a> is
- <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code>, and when the element has an
+ <code><a href="#document">Document</a></code> was created, and when the element has an
ancestor <a href="#media-element">media element</a>, and when the element has an
ancestor <code><a href="#the-object-element">object</a></code> element that is <em>not</em> showing
its <a href="#fallback-content">fallback content</a>, and when no Java Language runtime
@@ -69137,78 +69101,7 @@
<dd>W3C</dd>
</dl><p>Fragment identifiers used with <code><a href="#text-html">text/html</a></code> resources
either refer to <a href="#the-indicated-part-of-the-document">the indicated part of the document</a> or
- provide state information for in-page scripts.<h3 id="text-html-sandboxed"><span class="secno">12.2 </span><dfn><code>text/html-sandboxed</code></dfn></h3><p>This registration is for community review and will be submitted
- to the IESG for review, approval, and registration with IANA.</p><dl><dt>Type name:</dt>
- <dd>text</dd>
- <dt>Subtype name:</dt>
- <dd>html-sandboxed</dd>
- <dt>Required parameters:</dt>
- <dd>No required parameters</dd>
- <dt>Optional parameters:</dt>
- <dd>Same as for <code><a href="#text-html">text/html</a></code></dd>
- <dt>Encoding considerations:</dt>
- <dd>Same as for <code><a href="#text-html">text/html</a></code></dd>
- <dt>Security considerations:</dt>
- <dd>
- <p>The purpose of the <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> MIME type
- is to provide a way for content providers to indicate that they
- want the file to be interpreted in a manner that does not give the
- file's contents access to the rest of the site. This is achieved
- by assigning the <code><a href="#document">Document</a></code> objects generated from
- resources labeled as <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> unique
- origins.</p>
- <p>To avoid having legacy user agents treating resources labeled
- as <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> as regular
- <code><a href="#text-html">text/html</a></code> files, authors should avoid using the <code title="">.html</code> or <code title="">.htm</code> extensions for
- resources labeled as <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code>.</p>
- <p>Furthermore, since the <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> MIME
- type impacts the origin security model, authors should be careful
- to prevent tampering with the MIME type labeling mechanism itself
- when documents are labeled as <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code>. If
- an attacker can cause a file to be served as
- <code><a href="#text-html">text/html</a></code> instead of
- <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code>, then the sandboxing will not
- take effect and a cross-site scripting attack will become
- possible.</p>
- <p>Beyond this, the type is identical to <code><a href="#text-html">text/html</a></code>,
- and the same considerations apply.</p>
- </dd>
- <dt>Interoperability considerations:</dt>
- <dd>Same as for <code><a href="#text-html">text/html</a></code></dd>
- <dt>Published specification:</dt>
- <dd>
- This document is the relevant specification. Labeling a resource
- with the <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> type asserts that the
- resource is an <a href="#html-documents" title="HTML documents">HTML document</a>
- using <a href="#syntax">the HTML syntax</a>.
- </dd>
- <dt>Applications that use this media type:</dt>
- <dd>Same as for <code><a href="#text-html">text/html</a></code></dd>
- <dt>Additional information:</dt>
- <dd>
- <dl><dt>Magic number(s):</dt>
- <dd>Documents labeled as <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> are
- heuristically indistinguishable from those labeled as
- <code><a href="#text-html">text/html</a></code>.</dd>
- <dt>File extension(s):</dt>
- <dd>"<code title="">sandboxed</code>"</dd>
- <dt>Macintosh file type code(s):</dt>
- <dd><code title="">TEXT</code></dd>
- </dl></dd>
- <dt>Person & email address to contact for further information:</dt>
- <dd>Ian Hickson <ian@hixie.ch></dd>
- <dt>Intended usage:</dt>
- <dd>Common</dd>
- <dt>Restrictions on usage:</dt>
- <dd>No restrictions apply.</dd>
- <dt>Author:</dt>
- <dd>Ian Hickson <ian@hixie.ch></dd>
- <dt>Change controller:</dt>
- <dd>W3C</dd>
- </dl><p>Fragment identifiers used with <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code>
- resources either refer to <a href="#the-indicated-part-of-the-document">the indicated part of the
- document</a> or provide state information for in-page
- scripts.<h3 id="multipart-x-mixed-replace"><span class="secno">12.3 </span><dfn><code>multipart/x-mixed-replace</code></dfn></h3><p>This registration is for community review and will be submitted
+ provide state information for in-page scripts.<h3 id="multipart-x-mixed-replace"><span class="secno">12.2 </span><dfn><code>multipart/x-mixed-replace</code></dfn></h3><p>This registration is for community review and will be submitted
to the IESG for review, approval, and registration with IANA.</p><dl><dt>Type name:</dt>
<dd>multipart</dd>
<dt>Subtype name:</dt>
@@ -69261,7 +69154,7 @@
<dd>W3C</dd>
</dl><p>Fragment identifiers used with
<code><a href="#multipart-x-mixed-replace">multipart/x-mixed-replace</a></code> resources apply to each body
- part as defined by the type used by that body part.<h3 id="application-xhtml-xml"><span class="secno">12.4 </span><dfn><code>application/xhtml+xml</code></dfn></h3><p>This registration is for community review and will be submitted
+ part as defined by the type used by that body part.<h3 id="application-xhtml-xml"><span class="secno">12.3 </span><dfn><code>application/xhtml+xml</code></dfn></h3><p>This registration is for community review and will be submitted
to the IESG for review, approval, and registration with IANA.</p><dl><dt>Type name:</dt>
<dd>application</dd>
<dt>Subtype name:</dt>
@@ -69309,7 +69202,7 @@
<dd>W3C</dd>
</dl><p>Fragment identifiers used with <code><a href="#application-xhtml-xml">application/xhtml+xml</a></code>
resources have the same semantics as with any <a href="#xml-mime-type">XML MIME
- type</a>. <a href="#refsRFC3023">[RFC3023]</a><h3 id="application-x-www-form-urlencoded"><span class="secno">12.5 </span><dfn><code>application/x-www-form-urlencoded</code></dfn></h3><p>This registration is for community review and will be submitted
+ type</a>. <a href="#refsRFC3023">[RFC3023]</a><h3 id="application-x-www-form-urlencoded"><span class="secno">12.4 </span><dfn><code>application/x-www-form-urlencoded</code></dfn></h3><p>This registration is for community review and will be submitted
to the IESG for review, approval, and registration with IANA.</p><dl><dt>Type name:</dt>
<dd>application</dd>
<dt>Subtype name:</dt>
@@ -69364,7 +69257,7 @@
</dl><p>Fragment identifiers have no meaning with the
<code><a href="#application-x-www-form-urlencoded">application/x-www-form-urlencoded</a></code> type as this type is
only used for uploaded payloads that do not have <a href="#url">URL</a>
- identifiers.<h3 id="text-cache-manifest"><span class="secno">12.6 </span><dfn><code>text/cache-manifest</code></dfn></h3><p>This registration is for community review and will be submitted
+ identifiers.<h3 id="text-cache-manifest"><span class="secno">12.5 </span><dfn><code>text/cache-manifest</code></dfn></h3><p>This registration is for community review and will be submitted
to the IESG for review, approval, and registration with IANA.</p><dl><dt>Type name:</dt>
<dd>text</dd>
<dt>Subtype name:</dt>
@@ -69422,7 +69315,7 @@
<dt>Change controller:</dt>
<dd>W3C</dd>
</dl><p>Fragment identifiers have no meaning with
- <code><a href="#text-cache-manifest">text/cache-manifest</a></code> resources.<h3 id="web-scheme-prefix"><span class="secno">12.7 </span><dfn title="scheme-web"><code>web+</code> scheme prefix</dfn></h3><p>This section describes a convention for use with the IANA URI
+ <code><a href="#text-cache-manifest">text/cache-manifest</a></code> resources.<h3 id="web-scheme-prefix"><span class="secno">12.6 </span><dfn title="scheme-web"><code>web+</code> scheme prefix</dfn></h3><p>This section describes a convention for use with the IANA URI
scheme registry. It does not itself register a specific scheme. <a href="#refsRFC4395">[RFC4395]</a><dl><dt>URI scheme name</dt>
<dd>
Schemes starting with the four characters "<code title="">web+</code>" followed by one or more letters in the range
Received on Tuesday, 11 October 2011 00:30:05 UTC