[Bug 4137] New: SpamCop submission of entire emails

[bu...@bugzilla.spamassassin.org]

http://bugzilla.spamassassin.org/show_bug.cgi?id=4137

           Summary: SpamCop submission of entire emails
           Product: Spamassassin
           Version: 3.0.2
          Platform: HP
        OS/Version: HP-UX
            Status: NEW
          Severity: normal
          Priority: P2
         Component: spamassassin
        AssignedTo: dev@spamassassin.apache.org
        ReportedBy: rrauenza@cup.hp.com


I'm a bit concerned about a default setting of spamasassin with regards to
SpamCop.  I'm having problems finding complete documentation on this, but it
appears that spamassassin submits an entire email to SpamCop with the --report
flag.  Am I mistaken?

I have a big issue with this.  I've only been using the --report flag because
Razor only sends a fingerprint.  I automatically --report anything that gets
marked as SPAM by SpamAssassin.  Occasionally I get false positives.  Sometimes
these false positives are company internal email.

I certainly do NOT want potentially confidential email being sent to the SpamCop
repository.

What I'm concerned with is ...

   a) it does not appear that the spamassassin man page mentions that the entire
body of the message is submitted.
   b) there's not a flag to turn off spamcop reporting
   c) it's on by default with --report

Suggestions:

   Document what is sent with --report
   Add config option to turn off spamcop
   Maybe add different options for --report-signature and --report-body



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 4137] SpamCop submission of entire emails

[bu...@bugzilla.spamassassin.org]

http://bugzilla.spamassassin.org/show_bug.cgi?id=4137





------- Additional Comments From kcivey@cpcug.org  2005-02-14 13:23 -------
In the documentation, --report is listed as "Report this message as
manually-verified spam."  You shouldn't be using it on messages that you haven't
looked at and verified as spam.  Razor, Pyzor, DCC, and SpamCop don't want you
reporting things as spam just because your installation of SA has marked them as
spam.  If you don't have time to manually verify and remove false positives,
then don't use --report.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 4137] SpamCop submission of entire emails

[bu...@bugzilla.spamassassin.org]

http://bugzilla.spamassassin.org/show_bug.cgi?id=4137


quinlan@pathname.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |WORKSFORME




------- Additional Comments From quinlan@pathname.com  2005-02-14 23:47 -------
--report should only be used for messages manually verified as known spam, it
should never be used in an automated fashion!  I think that resolves your main
concern about legitimate mail being reported

The SpamCop FAQ has additional information on their privacy policy:

  http://www.spamcop.net/fom-serve/cache/168.html

Also, in 3.1, it will be possible to not load the SpamCop reporting plugin (it
is now a separate plugin) for your site.  I have added a note to the plugin
documentation that entire spam messages are reported as well.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.