Re: [Evolution] options on download

[Jamie Zawinski <jwz jwz org>]

Tom Musgrove wrote:
> A new feature request that this thread spawned ...
>
> Some sort of filtration so that duplicate messages (say those that are cc'd
> to multiple lists that I'm on, or cc'd to me when I'm on the list...)

I'd love that, but it's hard to do without risking losing messages and
opening yourself up to "denial-of-message" attacks...

You really don't want to auto-delete a message unless you're sure it's
the same one, so in addition to checking the Message-ID and addresses in
To and CC fields, you'd want to compare an MD5 hash of the message body.
(This is really important because if you can figure out a way to send
someone a false message that replaces a legitimate message that they
have already received from another source, you can accomplish all sorts
of mayhem.)

These days, it's becoming more and more common for hateful mailing list
software to mess with messages after they have been sent -- look at the
categorically braindamaged behavior of the list we're on right now, for
example: you didn't type "[Evolution]" in your subject line, the list
software added that.  That means that if you had sent the initial
message to the list and CCed me, I would have gotten two copies of the
message with different subjects.

All this because someone decided that users on this mailing list would
be able to figure out how to filter on Subject, but wouldn't be able to
figure out how to filter on To/CC?  

Please.

Also, it's increasingly common for mailing lists to append a second
signature to every message, which is even more hateful than screwing up
the subject.

Basically, since so much modern software has no respect for the
bit-for-bit sanctity of users' messages, there's no way to win.

Hell, there's probably not even a way to send a verifiable
cryptographically signed message to most mailing lists these days, since
the list software is going to do *something* stupid to break the hash.

Yay.

-- 
Jamie Zawinski
jwz jwz org             http://www.jwz.org/
jwz dnalounge com       http://www.dnalounge.com/