[Pkg-dspam-misc] Bug#401623: Confirmation

[Daniel Kahn Gillmor]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

At 2006-12-04 23:21, tsr-debian at achos.com said:

> When receiving mail with X-DSPAM headers already present,
> local dspam adds its own to the bottom. 

I just confirmed this: dspam does not replace already-present X-DSPAM
headers on a functioning dspam 3.6.8 installation for me either.

> This could be used by spammers to trick people filtering on Result:
> Innocent

Yup.  That's a problem.  As a general principle, I'd suggest that it's
better to filter based on the presence of any non-Innocent results (as
opposed to the lack of an Innocent result), but the difference is a
subtle one, and your scenario is probably not uncommon.

> But it also prevents error learning as the provided signature
> is not found in the local database (and dspam quits on the
> first signature found). It's quite a problem for resent
> messages (mutt's bounce).

This is a good point, and a potentially serious problem for dspam.

> I see no reason to keep externally generated X-DSPAM headers,
> but would suggest to overwrite them with the local data.

I tend to agree that this is the right solution.  Would someone with
more experience with MTAs care to weigh in on whether replacing
received headers is a legitimate thing to do?

	--dkg
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
Comment: Processed by Mailcrypt 3.5.8+ <http://mailcrypt.sourceforge.net/>

iD8DBQFFdu1CiXTlFKVLY2URAqL/AKCHHLYl0hgQ7y3zG5VKnakE8FfUXACfc4+G
WXXxbNQcNn9E+x5eICa5hx8=
=lK0O
-----END PGP SIGNATURE-----