Re: plus addresses

Sam Varshavchik <[email protected]> Thu, 25 Jul 2024 19:10:59 -0400
Newsgroups	gmane.mail.imap.courier.general
Message-ID	<[email protected]>
Alessandro Vesely writes:

> On Thu 25/Jul/2024 14:23:52 +0200 Sam Varshavchik wrote:
>
>> I don't think it's wise to do this by default. This should be doable  
>> already, with a .courier-default, and some scripting, so if someone were to  
>> do it, themselves, they'll be responsible for all the consequences.
>>
>> I do use folders, myself, and with a carefully-tuned .mailfilter that drops  
>> mail into specific folders, that have specific purposes. Mail shouldn't go  
>> there just because of the delivery address.
>
>
> I'd be curious to learn the reasoning behind that point.  Both creating an  
> address and creating a folder need a bit of thought...  What unintended  
> consequences could happen?

To add to what Aidas wrote: it is not entirely unreasonable to have some  
automation in place that verifies PGP-signed mail and then they get dropped  
into a folder, for some further processing that presumes that the email is  
properly signed.

Substitute any reasonable validation mechanism, in place of pgp signatures.  
Sending IP address, for example.

Or even something less ironclad, like sorting mail from their bank into a  
folder, based on nothing more than the sending IP address.

Now, someone deduces that the recipient can have mail delivered to a  
specific folder, directly. And the actual folder is deduced too. Now this  
can be easier to bypass.

Of course, this isn't really different from ordinary phishing and spoofing.  
But I can see someone can reasonably assume that mail ends up in a folder  
solely as a result of some, perhaps minimal, validation steps which are now  
easily bypassed.

>
> The script I use for List-ID-to-folder is so ugly that only a couple of  
> users include it.  I guess an extension-to-folder would be similar:
>
> if (/^List-ID:[^<]*<([-_A-Za-z0-9]*)/:H)
> {
>         DEST=`sed -nr 's/^INBOX(\\.'"$MATCH1"')$/ 
> \\1/ip' ./Maildir/courierimapsubscribed`
>         if ("$DEST")
>         {
>                 `test -d "./Maildir/$DEST"`
>                 if ($RETURNCODE == 0)
>                         to "./Maildir/$DEST";
>         }
> }
>
> Isn't that ugly enough?

Yes, it's ugly, and perhaps something can be done to clean this up, but not  
just automatically do it for everyone.

_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
signature.asc (application/pgp-signature, 228 B)