ietf-mta-filters
[Top] [All Lists]

Re: Security review of SIEVE vacation

2005-09-21 08:38:34


On Wed, Sep 14, 2005 at 10:58:44AM +0200, Michael Haardt wrote:
On Tue, Sep 13, 2005 at 06:25:06PM -0700, Ned Freed wrote:
This sort of thing really needs to be up to the implementation, and the
current
specification specifically allows this (section 3.5 list item 1) You 
really
don't want to have to require that every user specify complex matching
criteria
in every vacation action they write.

I agree.  If your address is really jhutz+*(_at_)*(_dot_)cmu(_dot_)edu, 
that pattern
should be used by vacation, too, without you having to specify it.
In fact it is probably jhutz+*(_at_)cmu(_dot_)edu as well and a number 
different
patterns, if all you have are Sieve wildcard patterns.  Users will mostly
fail to get that right.  I don't want to think about sites with caseful
local parts.

Along these lines (pretty closely along these lines in fact) I had
suggested that the envelope recipient address that causes the final
delivery, if known, should be one of the "known addresses" for the user.
After all, if delivery is happening, that address is, by implementation,
one that is valid for that user.  Ned had said:

    I have no problem calling out that the current envelope recipient
    address as an additional source of information for this check. I'll
    add text to this effect to the revision.

(in and around
  http://www.imc.org/ietf-mta-filters/mail-archive/msg05948.html
)

and I think that that still addresses some of the concern.  Is that
additional text still pending or was it shot down (I didn't notice if it
was)?

Yes, this has been added and will be in the next update.

                                Ned

<Prev in Thread] Current Thread [Next in Thread>