Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 533280 - Filter non-standard email tracking headers
Summary: Filter non-standard email tracking headers
Status: RESOLVED WONTFIX
Alias: None
Product: Gentoo Infrastructure
Classification: Unclassified
Component: Mailing Lists (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Infrastructure
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-22 12:47 UTC by Branko Grubic
Modified: 2015-01-27 21:19 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Branko Grubic 2014-12-22 12:47:24 UTC
I see on 'gentoo-user' mailing list some people use non-standard headers: 
'Return-Receipt-To'
'X-Confirm-Reading-To'

Which can potentially cause privacy issues for people subscribed to mailing lists, depending on how their mail client handles this, some ignore it by default, some ask to return receipt, but some of them can silently just reply which is not good. On gentoo mailing list page[1] there is a link to 'rfc1855'

"Note: For general email list etiquette[2], these guidelines are an excellent primer." 
(Page ~8/9) Where these issues are described. 

Also you can find some info on wikipedia page[3].

[1] - http://www.gentoo.org/main/en/lists.xml 
[2] - http://www.ietf.org/rfc/rfc1855.txt
[3] - https://en.wikipedia.org/wiki/Email_tracking#Read-receipts 

Reproducible: Sometimes




There are probably multiple solutions to this problem, one of them is to ask sender not to include those, but that takes a lot of time if not automated, and can be ignored.

I think best solution if possible is to filter it on mailing list server.
Comment 1 Alex Legler (RETIRED) archtester gentoo-dev Security 2015-01-27 21:19:58 UTC
I feel like not filtering the headers and educating offenders as well as potential 'victims' is a better choice than filtering and effectively just ignoring the issue. I'm also not sure why it should happen selectively on -user.

Repeat offenders should be reported of course and will be appropriately dealt with.