--On 8 February 2010 01:28:59 -0500 "John R. Levine"
<johnl(_at_)iecc(_dot_)com> wrote:
Here's some scenarios in which I'm not sure what the best thing is to do.
A) User has multiple incoming accounts, presses the spam button, and the
outbound MSA doesn't match the incoming account. Hence the report goes
via unrelated third parties that might snoop on it. Do we care? The
user has said it's spam, after all.
Snooping might well be an issue, for example, it might be a false positive
where the actual message contains confidential information. The reporter is
using a system that supposedly communicates with their service provider.
Reporting a message to the mailstore operator (who can already read it from
the mailstore) is a lot less sensitive than forwarding it to the operator
of a third party mailstore.
What else might we care about? That we're failing to actually report the
message? That we're spamming the unrelated third party? That the unrelated
third party's automatic processor might generate an onward report about an
unrelated message?
B) Assume a model in which the spam reporting address is determined per
account, e.g., fetched from the POP or IMAP server via an extension. The
user for whatever reason moves a message from account A into the IMAP
mailbox for account B and then hits the spam button, which sends the
report to B, even though the message was from A. Do we care?
We don't care as much. The message is already visible to the operator of
the second mailstore.
It's the
user's fault, although I can think of some simple configurations that
would cause that, e.g., MUA based spam filter that puts all the junk into
the Junk folder on the first IMAP account.
C) I have a Gmail account and a Yahoo account. The Gmail account is set
up to fetch my Yahoo mail so I can see it all in one place. I use
Gmail's IMAP server to read my mail. (I really do this, by the way.) I
hit the spam button. Who should get the report?
1) Gmail since that's who I picked it up from
2) Yahoo since that's where the spam was sent
3) Gmail but they should also forward the report to Yahoo
This is already a problem with simple forwarding. I get ARF reports from
AOL for messages that originated elsewhere, but were forwarded by my SMTP
servers.
The answer, I think, is that the report should go to Gmail, and they should
forward the report to Yahoo if they're sure of the origin of the mail. If
they're fetching it using POP or IMAP, that's the case. Otherwise some kind
of feedback loop is required (or SPF or DKIM matches).
R's,
John
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg
--
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg