Re: Summary of Issues Raised to date

On Mar 18 2004, Bill Yerazunis wrote:
> 
> Yes- but it is clear that ADV: in the subject line
> is _always_ an indicator of spam.
> 
> That one (and only that one) appears to be safe.
> 

That's an example of a shoot-yourself-in-the-foot tag. Along those
lines, spammers aren't going to add [spam] to the subject either ;-)

I agree it's safe, but it's insidious for filter chains. Suppose a
paranoid user has crm114, bogofilter, ifile chained together (or maybe
those sit at three mail servers along the way).

If crm114 adds the ADV: subject tag, then afterwards, bogofilter can't
trust this tag itself. Maybe it agrees with crm114, maybe it's one of
those rare cases where they differ. What's a bogo to do? If it removes
the tag, maybe ifile down the line adds it again. However, if any
filter is known to remove the ADV: tag, then spammers will realize
that it's more of a shoot-yourself-in-the-foot-and-maybe-miss kind of
tag.

I don't know what all the possible solutions are. I've argued in
another thread that the filter can automatically remove all known
tags first, then replace them with its own.

For example, crm114 first removes the ADV: tag if it finds it, then
adds it if it's appropriate. bogofilter does the same, ifile does the
same. This way, spammers can't control the filter decisions by
spoofing. The drawback is that there's no integration or cooperation
between filters, and the last one in the chain is the authoritative one.

Another way could be for crm114 to leave a message for subsequent
filters inside the headers. The subsequent filters would read the
message, and know what crm114 did, then add their own stuff
nondestructively. For this it must be impossible for spammers to spoof
crm114's message to other filters. The mechanics of this are up for grabs.

-- 
Laird Breyer.