Date: 21 Mar 1998 16:57:00 +0100
From: mail-std-list@faerber.muc.de (=?ISO-8859-1?Q?Claus_Andr=E9_F=E4rber?=)
To: drums@cs.utk.edu
Message-ID: <6qJ1vGeocDB@faerber.muc.de>
In-Reply-To: <13798.890436639@foxharp.boston.ma.us>
Subject: Re: A different approach to the Reply-To problem
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
REFERENCES: <13798.890436639@foxharp.boston.ma.us>

Paul Fox <pgf@foxharp.boston.ma.us> schrieb:
>> Yep.  It's often the case that customers don't know what they're
>> talking about.
>
> if the recipient can't see the Sender header, it _is_ forgery.

No, it's blindness (or bad software design).

> MUA's in common use show one that header?  how many have a forgery
> detection assistance?  (e.g. alert me when Sender != From)

Sender is always not equal to From (or should be).

> it's exactly because changing the From header is just a little bit akin
> to lying that i use Reply-to as Personal-reply-to.  if i receive a message
> at address A, and reply to it, and set From to address B because that's
> where i want them to send the next reply, then i have (in some small sense)
> told them that i was reading mail addressed to B when i got their mail, since
> that's what "From" said.

No. If you change the From header to your primary address, you're just  
saying that the author was you with that primary address, nothing else.

If you change the From address to another person's address who used your  
account to send the message, than you're saying the person with this  
(primary) address was the author of the message.

You're only "lying" about the origin if you don't provide a correct  
Sender header, as this -- and not From -- indicates the account the  
message was sent with. Sender just defaults to From if not present.

> i may be implying that i was "somewhere else"
> when i read the original mail.  think of the postoffice analogy -- if i'm
> at my vacation home, and change the return address to my permanent home
> address, won't most people think that i was at my permanent home when i
> sent the mail?

To use your postoffice analogy: Consider you're sitting in the office  
writing a private letter (with your employers permission of course -- if  
you have one). Will you write the office's address or your private  
address on it? Presumably your private address, won't you? Or do you  
think that would be lying about the origin of the letter?

> i understand that From functions perfectly well as a Personal-reply-to

No, not personal-reply-to but reply-to-author. There's a difference:
I also consider replies-to-everyone personal, unless sent via a mailing  
list or newsgroup.

--
Claus "3247" Andre Faerber <http://www.muc.de/~cfaerber/> fax: +49-8061-3361
PGP: ID=1024/527CADCD FP=12 20 49 F3 E1 04 9E 9E  25 56 69 A5 C6 A0 C9 DC