Subject: [Slim] multipart/multilingual spam filtering

From: Nik Tomkinson <[email-masked]>
Date: Sat, 1 Aug 2015 13:56:54 +0100

Hi all,

there were a couple of things I wanted to discuss at the lunch meeting in
Prague, but we ran out of time. In the interests of clarity I will keep
them to individual list posts. Here is the first:

On the M3AWG senders list, a situation was discussed whereby a spam subject
may be able to get through a spam filtering service. The situation would
need to be as follows:

 - a non-conforming spam filtering service combined with a conforming email
client

A spam filter service that is not aware of multipart/multilingual might use
the top-level subject header field ONLY to determine if the email is spam,
which passes through. The email client (which IS aware of
multipart/multilingual) would render the lower-level translated subject
field (in the matched language message part) in a message listing to be
seen by the recipient.

For all other combinations of conforming/non-conforming status for email
client and spam filter, a multipart/multilingual message would be fine as
the spam subject would either be checked correctly or not displayed.

If the spam filter service checks the whole message content, the message is
likely to be rejected unless it is ONLY the subject that could cause
offence.

So the question is, how should this be represented in the I-D for
multipart/multilingual email?

Can it be seen as an edge case and that it will only be an issue until spam
filtering checks lower-level subjects too? Therefore could it just be
mentioned in the security considerations section? or should there be some
rework to close this small hole?

Thanks in advance,

Nik.

---

From: Eric Burger <[email-masked]>
Date: Sat, 1 Aug 2015 18:35:51 -0400

I’m not on the M3AWG list, but I would be shocked if a spam filter called itself a spam filter by reading only the subject line of the message. I think the market would bankrupt such a vendor. So, we do not need to worry about it.

> On Aug 1, 2015, at 8:56 AM, Nik Tomkinson <[email-masked]> wrote:
> 
> Hi all,
> 
> there were a couple of things I wanted to discuss at the lunch meeting in Prague, but we ran out of time. In the interests of clarity I will keep them to individual list posts. Here is the first:
> 
> 
> On the M3AWG senders list, a situation was discussed whereby a spam subject may be able to get through a spam filtering service. The situation would need to be as follows:
> 
>  - a non-conforming spam filtering service combined with a conforming email client
> 
> A spam filter service that is not aware of multipart/multilingual might use the top-level subject header field ONLY to determine if the email is spam, which passes through. The email client (which IS aware of multipart/multilingual) would render the lower-level translated subject field (in the matched language message part) in a message listing to be seen by the recipient.
> 
> For all other combinations of conforming/non-conforming status for email client and spam filter, a multipart/multilingual message would be fine as the spam subject would either be checked correctly or not displayed.
> 
> If the spam filter service checks the whole message content, the message is likely to be rejected unless it is ONLY the subject that could cause offence.
> 
> So the question is, how should this be represented in the I-D for multipart/multilingual email?
> 
> Can it be seen as an edge case and that it will only be an issue until spam filtering checks lower-level subjects too? Therefore could it just be mentioned in the security considerations section? or should there be some rework to close this small hole?
> 
> Thanks in advance,
> 
> Nik.
> 
> _______________________________________________
> SLIM mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/slim