Part of the chat with upstream

chat-excerp (text/plain), 1.88 KB, created by Fedja Beader on 2015-11-09 12:30:47 UTC

...
<@claws> the de-dupe feature checks message-ids
< specing> what is a message-id?
<@claws> it's a standard header
<@claws> Message-ID: xxxxxxx
< specing> claws mail shows me no such header
< specing> mostly only To From Subject and Date
<@claws> even when you use 'show all headers'?
< specing> opening the MH message in vim only adds content-type
<@claws> what created those msgs?
< specing> claws
<@claws> it has nothing to do with opening in vim
< specing> COPY filtering rule from IMAP/INBOX
<@claws> /view/show all headers
< specing> so claws only checks message-ids, not checksum?
< specing> show all headers shows message IDs
<@claws> if the Message-ID matches, it's a duplicate, and only one msg will be left when you delete duplicates
< specing> I just manually checked two message ids in same mails and they are identical
< specing> can't message-IDs be faked?
<@claws> any header can be faked
< specing> so does claws check checksum if it matches?
<@claws> send me both those msgs, using fwd-as-attachment
< specing> if message ID matches?
<@claws> no
< specing> this is dangerous!
<@claws> no
< specing> <@claws> any header can be faked
<@claws> what is dangerous about it?
<@claws> if you think that is dangerous then stop using email
< specing> so someone could send my a message with a faked message ID resulting in a message from backups being deleted by claws!
<@claws> read up on Message-ID headers
< specing>  <@claws> any header can be faked
<@claws> well, of course it can
< specing> Why do I have to audit every single piece of software?!!??!
<@claws> you must trust the mail servers you use
< specing> Why?
<@claws> because your mail passes through them
< specing> why would claws-mail trust the message id?
<@claws> why would it not?
< specing> checking checksums is cheap compared to losing important mail!
<@claws> PATCHESWELCOME
< specing> do you accept Ada?
<@claws> write your own MUA in Ada