Moving forward ...

Perhaps we should start framing the problem we'd like to solve.  Here
are some important issues as I see 'em ...  I'm looking for additions /
comments / criticisms / jokes.  I'll try to gather up any feedback into
a "situation" document outlining the problems we'd like to work on.


* spam filtering isn't the only potential filter running.  A filter
header specification should be extensible to other filtering types.

* an administrator may opt to have their filtering framework assign a
label with the outcome of a specific filter.  These labels have no
standard meaning, requiring that configuration of the clients requires
more offline work.

* The definition of spam isn't universal and filtering technologies may
have subtle differences in their implementation of spam detection.  To
this end, labelling a message as spam may not be consistent. (unwanted
vs. UCE or some combination thereof)

* filters all have different methods of labelling messages, resulting in
no common way to configure MUAs to identify filter labels in incoming
messages

* filtering decisions are dependant on the state of the filtering (virus
definitions, software version) at the time of message scanning resulting
in different results for the same message at different times.  It is
important for filters to be able to add meta data to the label.

* some filters develop a confidence as well as a label, allowing later
processing to be tuned to reduce errors.  Some filters are unable to
parse these confidence levels.  A common format for confidence is also
required.

* MUAs and MDAs have varying rules capabilities from simplistic to
complex and not all labelling methods respect this.  It takes work for a
recipient to configure their filters to deal with labels added by a
trusted spam filter.

* Labels may be added to the message prior to gateway filtering (on the
outgoing MTA?) and may not be trusted.  How to tell if a label was added
by the trusted MTA?  What should an MTA do if it receives an incoming
labelled message?
	- this message was virus scanned by ...

* Recipients may believe that a message was labelled in error and want
to provide as a defect to the administrator.  This administrator (or the
filter vendor) will need more meta data about the filtering than a
single judgement label.  More state data will be required to diagnose
and adjust/reject the feedback.

--
Jesse Dougherty
Director of Development, Sophos
Email: [email protected]
Direct: 604 484 6434
Web: www.sophos.com
Sophos - protecting businesses against viruses and spam