Date: Thu, 2 Aug 2012 09:21:20 +0200
From: Stefano Zacchiroli <zack@upsilon.cc>
To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Subject: Re: notmuch-mutt: support for duplicate message removal
Message-ID: <20120802072120.GB16678@upsilon.cc>
References: <1343808582-9519-1-git-send-email-zack@upsilon.cc>
	<87pq7aam8n.fsf@nikula.org> <20120801162605.GA6012@sid.nuvreauspam>
	<50196548.3030504@fifthhorseman.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <50196548.3030504@fifthhorseman.net>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: notmuch@notmuchmail.org, Andrei POPESCU <andreimpopescu@gmail.com>
Precedence: list

On Wed, Aug 01, 2012 at 01:20:08PM -0400, Daniel Kahn Gillmor wrote:
> The proposed feature could also exacerbate the previously-discussed
> attack vector [0] whereby a malicious Message-ID collision can be used
> to hide messages from the victim's mailstore.
> 
> [0] id:87k42vrqve.fsf@pip.fifthhorseman.net

I didn't find the reference above but, if you're speaking about the
proposed patch only, I don't think it's the case. The proposed patch
only deduplicate file-identical (up to checksums, that is) messages in
maildirs: a Message-ID collision is not enough to hide a message.

But your comment is very interesting anyhow, as deduplicating on the
basis of Message-ID is indeed something I've discussed with Kevin as
future work. You just provided an extra argument not to enable that by
default.

Cheers.
-- 
Stefano Zacchiroli     zack@{upsilon.cc,pps.jussieu.fr,debian.org} . o .
Maître de conférences   ......   http://upsilon.cc/zack   ......   . . o
Debian Project Leader    .......   @zack on identi.ca   .......    o o o
Ť the first rule of tautology club is the first rule of tautology club ť