Re: Summary of Issues Raised to date

   From: Laird Breyer <[email protected]>

[...]

   I agree it's safe, but it's insidious for filter chains. Suppose a
   paranoid user has crm114, bogofilter, ifile chained together (or maybe
   those sit at three mail servers along the way).

   If crm114 adds the ADV: subject tag, then afterwards, bogofilter can't
   trust this tag itself. Maybe it agrees with crm114, maybe it's one of
   those rare cases where they differ. What's a bogo to do? If it removes
   the tag, maybe ifile down the line adds it again. However, if any
   filter is known to remove the ADV: tag, then spammers will realize
   that it's more of a shoot-yourself-in-the-foot-and-maybe-miss kind of
   tag.

   I don't know what all the possible solutions are. I've argued in
   another thread that the filter can automatically remove all known
   tags first, then replace them with its own.

   For example, crm114 first removes the ADV: tag if it finds it, then
   adds it if it's appropriate. bogofilter does the same, ifile does the
   same. This way, spammers can't control the filter decisions by
   spoofing. The drawback is that there's no integration or cooperation
   between filters, and the last one in the chain is the authoritative one.

Yep- and all prior ones are disregarded.

   Another way could be for crm114 to leave a message for subsequent
   filters inside the headers. The subsequent filters would read the
   message, and know what crm114 did, then add their own stuff
   nondestructively. For this it must be impossible for spammers to spoof
   crm114's message to other filters. The mechanics of this are up for grabs.

Two things:

1) if each filter specifies not only that it's found spam, but it's
own identity, then later filters can use that information as 
significant but not definitive.

For example, CRM114 uses:

    X-CRM114-Status: SPAM and
    X-CRM114-Status: Good

If the your later filters toss all 'X-CRM114-Status: Good" headers,
but consider "X-CRM114-Status: SPAM" headers as significant but
not definitive, then the last filter in the chain _can_ use the
CRM114 result without fear of spoofing.

2) CRM114 does have a fairly secure way of creating a nonspoofable
header; either the inbuilt fast string hashing or MD5 callout can
be used to create a one-way authentication that later processes can
easily check.

       -Bill Yerazunis