Subject: Re: Adding SpamAssassin Headers to IETF mail

From: "Sujit Menon" <[email-masked]>
Date: Wed, 17 Dec 2003 09:05:12 +0530

Hi Everybody,

I am a new entrant into ietf mailing list. I wish all of you regards and
best wishes and Merry Christmas/Happy New Year.
The Idea given by Mr. Gordon is plausible and I support him for an
improvement to be to added to the mails from IETF Mailing list.
Subject line should have only: (IETF Mailing List) and by adding an example
of GNU SIP mailing list Sent by: [email-masked]
in the mail from header. This will make it easier to set rules in our mail
boxes and it will get collected in a particular folder in the
mailbox from where we may read it and send replies and suggestions.

Thanks and Regards
Sujit Menon

                      Gordon Cook                                                                                                      
                      <cook@cookreport.        To:       [email-masked]                                                                 
                      com>                     cc:                                                                                     
                      Sent by:                 Subject:  Re: Adding SpamAssassin Headers to IETF mail                                  
                      [email-masked]                                                                                                
                      rg                                                                                                               

                      17/12/03 07:35                                                                                                   

>[email-masked] wrote:
>>...we are planning to turn on SpamAssassin on all IETF mail...
>
>

good

would it be asking too much to add [ietf]  to the subject line of each
message?
--
=============================================================
The COOK Report on Internet Protocol,  609 882-2572 (PSTN) 703 738-6031
(Vonage) Subscription info & prices at
http://cookreport.com/subscriptions.shtml
Googin on real time global corp. http://cookreport.com/12.11.shtml
Purchase 10
years of back issues at http://www.cafeshops.com/cookreportinter.6936314
E-mail [email-masked] or use [email-masked] Free World Dial up 17318
=============================================================

---

From: Dave Aronson <[email-masked]>
Date: Wed, 17 Dec 2003 09:45:22 -0500

On Tue December 16 2003 22:35, Sujit Menon wrote:

 > Subject line should have only: (IETF Mailing List)

Do you mean only as in, that should be the entire subject line, or as 
in, that should be all that should be in the tag prepended to the 
subject line?  As a tag, it's still much longer than need be, so I'll 
ass-u-me you mean that that should be the entire subject line.

 > and by adding an
 > example of GNU SIP mailing list Sent by: [email-masked]
 > in the mail from header.

Do you mean the data sent in the "MAIL FROM" part of the first SMTP 
exchange, which IIRC shows up as the Return-Path: header, or the 
user-set From: header?  Since you didn't use caps, and wrote header, I 
will ass-u-me you meant the From: header.

 > This will make it easier to set rules in our mail boxes

Uh, no, in fact quite the opposite, if I understand you correctly.

Your proposed Subject line would destroy the usefulness of the subject 
line, aside from telling that it's from this list.  You wouldn't be 
able to scan through the list and pick out the ones that are on 
specific topics you want to read about (and read them), or that aren't 
(and delete them), let alone do any automatic filtering on the subject, 
whether based on interest or spamminess.

Your proposed From line would make it much harder for us to filter out 
people we don't want to hear from (whether done manually or 
automatically, and whether to authors who are legit, kooks, or 
spammers), and to send replies directly to the author.

Long story short, here's my proposal:

- Tag the stuff [ietf]. Six chars, seven with a space.  Big fat hairy 
deal!

- Keep the author in the From.

- Keep NOT putting the list in a Reply-To, so people have to purposely 
intend to send to the list in order to add to its traffic.

- Don't filter spam.  We can do it ourselves, and spam seems to be a 
negligible proportion of this list's email.  The extra headers added by 
SpamAssasin and so forth would waste far more bandwidth than the spam!

- Make the archives munge addresses.  I *have* been getting spam at 
addresses I've used only here, and the public archives are the most 
likely explanation.  (They're much too useful for me to ask to make 
them private, but if "privatize the archives" is the concensus, then 
I'd go along with it.)

-- 
Dave Aronson, Senior Software Engineer, Secure Software Inc.
(Opinions above NOT those of securesw.com unless so stated!)
Email me at: work (D0T) 2004 (@T) dja (D0T) mailme (D0T) org
Web: http://destined.to/program http://listen.to/davearonson

---

From: John Stracke <[email-masked]>
Date: Wed, 17 Dec 2003 09:55:49 -0500

Dave Aronson wrote:

>- Tag the stuff [ietf]. 
Modifying the Subject: line is a Bad Thing; it invalidates digital 
signatures.  We're never going to get widespread use of signed email as 
long as we have pieces of mail infrastructure munging messages to make 
signatures useless.

-- 
/================================================================\
|John Stracke      [email-masked]                         |
|Principal Engineer|http://www.centive.com                       |
|Centive           |My opinions are my own.                      |
|================================================================|
|Never underestimate the power of human stupidity. --I forget who|
\================================================================/

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Wed, 17 Dec 2003 09:49:01 -0800

At 9:55 AM -0500 12/17/03, John Stracke wrote:
>Modifying the Subject: line is a Bad Thing; it invalidates digital signatures.

Which digital signatures are you talking about? Neither S/MIME nor 
OpenPGP sign the headers in messages, only the bodies.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: John Stracke <[email-masked]>
Date: Wed, 17 Dec 2003 12:47:08 -0500

Paul Hoffman / IMC wrote:

>> signatures.

S/MIME can sign the Subject: header (see RFC-1848, section 6.3), and 
probably should, since some people write messages where the subject is 
part of the meaning--change the subject and you change the meaning of 
the message.

(As an extreme case: at this company, people sometimes send messages 
with no body at all.  It's so common that they have a convention for it: 
they put "(eom)" in the subject line, for "end of message".)

-- 
/==========================================================\
|John Stracke      [email-masked]                   |
|Principal Engineer|http://www.centive.com                 |
|Centive           |My opinions are my own.                |
|==========================================================|
|"Collect call from reality, will you accept the--" *click*|
\==========================================================/

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Wed, 17 Dec 2003 10:15:52 -0800

At 12:47 PM -0500 12/17/03, John Stracke wrote:
>S/MIME can sign the Subject: header (see RFC-1848, section 6.3)

RFC 1848 is for MOSS, not S/MIME or OpenPGP. MOSS had no significant 
implementation.

--Paul Hoffman, Director

---

From: John Stracke <[email-masked]>
Date: Wed, 17 Dec 2003 13:20:46 -0500

> RFC 1848 is for MOSS, not S/MIME or OpenPGP. MOSS had no significant 

Oh.  Sorry.

-- 
/==============================================\
|John Stracke      [email-masked]       |
|Principal Engineer|http://www.centive.com     |
|Centive           |My opinions are my own.    |
|==============================================|
|"Fate just isn't what it used to be." --Hobbes|
\==============================================/

---

From: James M Galvin <[email-masked]>
Date: Wed, 17 Dec 2003 13:43:57 -0500 (EST)

On Wed, 17 Dec 2003, Paul Hoffman / IMC wrote:

Two things.  First, MOSS had *a* significant implementation that was
complete and freely available.  I know because it was my group that
wrote it in a previous life.  It just never had any significant usage or
deployement, but that's a different issue.

Second, John is correct in theory although not in practice.  Section 6.3
of RFC1848 describes how security multiparts (RFC1847) can be used by
MOSS in particular but in practice by any secure email protocol to
protect selected headers of a message.  This is done by signing a
message/rfc822 body part, not just the text/plain (or whatever) content
body part.

S/MIME and OpenPGP can both use security multiparts.

Jim

---

From: David Morris <[email-masked]>
Date: Wed, 17 Dec 2003 11:47:20 -0800 (PST)

> S/MIME and OpenPGP can both use security multiparts.

Even so, any point of sending signed mail to a public list should be to
allow the list to process the signed mail. If signed mail ever becomes
part of the ietf list process, let the server process the signature and
mark the mail appropriately with the result of that processing and then
sign the mail itself before distribution.

---

From: [email-masked]
Date: Wed, 17 Dec 2003 15:09:08 -0500

> sign the mail itself before distribution.

Now think carefully about the presentation - if I signed the Subject: line,
and then the list processor munged and re-signed it, how do you display
that to the end user in a sane manner?

---

From: John Stracke <[email-masked]>
Date: Wed, 17 Dec 2003 15:15:56 -0500

David Morris wrote:

>allow the list to process the signed mail.
>  
>
That is not the only point by a long shot.  A much more important goal 
would be to help the recipients trust that the message was sent by the 
person it claims to be from.

-- 
/===============================================================\
|John Stracke      [email-masked]                        |
|Principal Engineer|http://www.centive.com                      |
|Centive           |My opinions are my own.                     |
|===============================================================|
|"Call me a Nervous Nellie, but I am concerned about the sale of|
|nuclear arms in my general neighborhood." -- Dave Barry        |
\===============================================================/

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 17 Dec 2003 19:39:37 -0600

Thus spake "John Stracke" <[email-masked]>
> long as we have pieces of mail infrastructure munging messages to make

Signed email already gets mangled by the ietf mail servers (AFAICT), so
what's one more bad idea in the mix?  </advocate class=devil>

I can't believe this topic is even being debated.  Filtering has been a
standard feature of every MUA I've used for over 10 years, including my
current PDA and webmail systems.  IMHO, the problems (listed by others) with
this proposal grossly outweigh the complaints of a couple people who refuse
to use a modern MUA or can't figure out how to configure said MUA to filter
on the Sender header.

S

Stephen Sprunk         "God does not play dice."  --Albert Einstein
CCIE #3723         "God is an inveterate gambler, and He throws the
K5SSS        dice at every possible opportunity." --Stephen Hawking

---

From: Doug Royer <[email-masked]>
Date: Thu, 18 Dec 2003 13:24:49 -0700

>what's one more bad idea in the mix?  </advocate class=devil>
Mine seems to make it. This one is (at least was) signed - I hope :-)

-- 

Doug Royer                     |   http://INET-Consulting.com
-------------------------------|-----------------------------
[email-masked]                 | Office: (208)520-4044
http://Royer.com/People/Doug   |    Fax: (866)594-8574
                               |   Cell: (208)520-4044

               We Do Standards - You Need Standards

---

From: John Stracke <[email-masked]>
Date: Wed, 17 Dec 2003 09:55:49 -0500