<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.18.3">
</HEAD>
<BODY>
Directed at: Those using : Inline Spam Warning, %report-dir%/inline.spam.warning.txt<BR>
<BR>
Date first reported: May 17, 2010 (noticed one month earlier, delayed reporting in case kernel.org messed up)<BR>
Date subsequently reported: June 11, 2010<BR>
Initial response June 12, 2010<BR>
Response update June 12, 2010<BR>
Acknowledgment none received<BR>
<BR>
Severity: Moderate (IMO)<BR>
<BR>
Summary: "inline spam warning" report to multiple recipients, displays all recipients in the warning message that are sent to all users.<BR>
<BR>
Description: This lets other users know not only who else may exist on the system, but also on, for example this mailing list.<BR>
This must be a failure of the privacy mechanism.<BR>
Message headers in each delivered message received by the recipient (verified by my own and one other recipient of that list who was kind enough to forward full headers,) do not include the other envelope recipients, it is only contained in the MailScanner generated message.<BR>
<BR>
<BR>
<BR>
Example: <BR>
<BR>
Dear user1@domain, user2@domain, <A HREF="mailto:user3@domain">user3@domain</A> , ...<BR>
(This messages yielded 7 addresses in the Dear ... field all up in the one I personally got)<BR>
<BR>
MailScanner believes the attached message which was sent to you,<BR>
From : <A HREF="mailto:linux-kernel-announce-owner@removed">linux-kernel-announce-owner@removed</A> (but I'm sure most here are smart enough to know the domain)<BR>
<BR>
... (nothing else is relevant so is not included)<BR>
<BR>
<BR>
<BR>
I am posting this to make those using the same method aware of this privacy issue given no action has been taken (yes, I read the changelog, I have been keeping an eye on it often)<BR>
<BR>
</BODY>
</HTML>