ietf-mta-filters
[Top] [All Lists]

Re: Security review of SIEVE vacation

2005-09-14 07:00:14

"Michael" == Michael Haardt <michael(_at_)freenet-ag(_dot_)de> writes:

    Michael> On Tue, Sep 13, 2005 at 06:25:06PM -0700, Ned Freed
    Michael> wrote:
    >> >Just as one example, any address with a mailbox name beginning
    >> 'jhutz+' or >'jhutz=' and a domain ending in 'cmu.edu' is is
    >> probably mine, and if I >used vacation, I'd certainly want it
    >> to treat mail sent to any such address >as belonging to me,
    >> regardless of the specific host the mail went to or >what, if
    >> anything, occurs after the plus.  I'd want that even if the
    >> mail >server weren't also at CMU, if I ever decided to forward
    >> my CMU mail >off-site.  One way to deal with this sort of
    >> problem would be to allow a >match type and comparator to be
    >> specified for the addresses.
    >> 
    >> This sort of thing really needs to be up to the implementation,
    >> and the current specification specifically allows this (section
    >> 3.5 list item 1) You really don't want to have to require that
    >> every user specify complex matching criteria in every vacation
    >> action they write.

    Michael> I agree.  If your address is really 
jhutz+*(_at_)*(_dot_)cmu(_dot_)edu,
    Michael> that pattern should be used by vacation, too, without you
    Michael> having to specify it.  In fact it is probably
    Michael> jhutz+*(_at_)cmu(_dot_)edu as well and a number different patterns,


Jeff's concern is that imap.outsourcemail.com may well know nothing
about CMU's addressing plan.  If outsourcemail.com is affiliated with
Jeff and not with CMU it is unreasonable for them to have out of band
configuration.

That said, the WG may choose not to solve that use case.