Subject: [Fwd: DISCUSS: draft-ietf-sieve-notify-mailto]

From: Alexey Melnikov <[email-masked]>
Date: Mon, 01 Dec 2008 21:19:41 +0000

Subject: DISCUSS: draft-ietf-sieve-notify-mailto
From: Cullen Jennings <[email-masked]>
To: [email-masked]
Cc: [email-masked], [email-masked]
Date: Mon, 1 Dec 2008 13:18:47 -0800 (PST)

Discuss:
It seems like the draft should include a way for a recipricant of these notifies to tell the server to stop sending them. If someone accidentally fat fingers a phone number for a SMS notify in a sieve script, how will the poor users getting all the SMS ever stop them?

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Mon, 1 Dec 2008 23:27:10 +0100

Isn't this really a generic issue, not specific to sieve?

We can discuss how to solve it here and now, but IMO such a solution 
should not be be published in a document titled "Sieve So and So".

My suggestion for solving it would be to include some sort of key or 
hash in the Auto-Submitted field which uniquely identifies the 
(script,user,statement) triple.

Arnt

---

From: Michael Haardt <[email-masked]>
Date: Tue, 02 Dec 2008 08:50:44 +0100

> Isn't this really a generic issue, not specific to sieve?

It is.  If anything at all, it applies to any mechanism that sends
messages or asks to send them, that is not just Sieve notifications,
but mail, SMS services etc. in general.

In discussions, we observed (Sieve) notifications have some properties
of redirects and this topic is no exception.

How can I protect myself from misredirected mails? I have had that
problem a few times now, because some people simply can't spell their
main address right, redirect to [email-masked] and the like.
One time I answered and told a member of a political part their internal
reports were rather boring to me.  No answer, but the mails stopped. ;)
I called one admin and told him his perl installation lacked a specific
module and his cron job might work better if he installed it.  He took
it with humour once he knew I did not break into his system, and fixed
the mail address for cron mails, too.

The problem does exist already, but so far answering solved it, because
the messages were sent by mistake and people don't like violating their
privacy by mistake.  The message origin is usually quite clear and we
need to ensure it stays that way, that's why draft-ietf-sieve-notify-12
(the notification framework) says in section 3.3:

   In order to minimize/prevent forgery of the author value,
   implementations SHOULD impose restrictions on what values can
   specified in a ":from" parameter.  For example, an implementation may
   restrict this value to be a member of a list of known author
   addresses or to belong to a particular domain.  It is suggested that
   values which don't satisfy such restrictions simply be ignored rather
   than causing the notify action to fail.

Spam, including SMS spam, is a different thing, because the sender tries
to hide.

Michael

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Tue, 2 Dec 2008 11:48:28 +0100

Michael Haardt writes:
> The problem does exist already, but so far answering solved it, 
> because the messages were sent by mistake and people don't like 
> violating their privacy by mistake.

Yeah... do we have a reasonable probability that someone responsible can 
be reached by answering the notification, though?

We do for mailto and I think we do for XMPP, but Cullen mentioned SMS, 
and I'm not at all sure about SMS.

Arnt

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Tue, 2 Dec 2008 12:39:36 +0100

Alexey Melnikov writes:
> Arnt Gulbrandsen wrote:
>> We do for mailto and I think we do for XMPP, but Cullen mentioned 
>> SMS, and I'm not at all sure about SMS.
>
> SMS is out of scope for this document.

Good point.

I'm inclined to simply push back, then: notify-mailto includes 
Auto-Submitted with owner-email, that's good enough for mailto.

(Btw, I like the MUST for originator identification in notify-12.)

Arnt

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 02 Dec 2008 11:29:52 +0000

Arnt Gulbrandsen wrote:

> Yeah... do we have a reasonable probability that someone responsible 
> can be reached by answering the notification, though?
>

SMS is out of scope for this document. (And if there is a mail-to-SMS 
gateway, it is responsibility of such gateway to provide correct 
functionality)

---

From: Ned Freed <[email-masked]>
Date: Tue, 02 Dec 2008 08:57:15 -0800 (PST)

> be reached by answering the notification, though?

That's exactly the problem. The case where notify mailto:, redirect, or
whatever is used by an individual user in their Sieve script attached to their
primary email account doesn't concern me. The case that's a problem is where it
is some automated service of some sort, some kind of  folder-attached script
created as part of some LEMONADE setup, an autoforwarder setup, etc. Most of
these thngs can and usually do have addresses associated with then for
reporting problems, but they tend to be monitored sporadically if at all. And
there can be some, like a folder script, where the person responsible may not
be able to easily figure out where the problem is to correct it.

> and I'm not at all sure about SMS.

IMO notify sms: is out of scope. But a lot of SMS goes out using email
as an intermediary. That case is arguably in scope, although I suspect
that the gateway effects will be  impossible to overcome.

				Ned

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 2 Dec 2008 09:52:41 -0800

> that the gateway effects will be  impossible to overcome.

When I said SMS, I was actually thinking the example in document where  
an email is sent to a SMS gateway. From the end users perspective,  
they got an SMS and want to know how to stop it.