[Pymilter] exploding messages

[Stuart D. Gathman]

On Fri, 23 Apr 2004, Eric S. Johansson wrote:

> As I described earlier, in camram, there can be either individual or 
> aggregate filters.  a mail message may hit multiple individual or 
> aggregate filters.  The message must be compared to each filter and will 
> get a different rating as to whether or not it is spam.  At this point, 
> the message will get different additional headers and therefore create 
> multiple, almost identical, copies of the same message.

The dspam filter creates a "TAG" that is filter (dictionary) specific and
is used to lookup a token stats record (signature) to change the status
of a message.

Rather than copy the entire message, I simply add all the tags to the
message.  If the user changes the status (marks as spam), the tags
not belonging to them are simply ignored.  This way, there
is only one message delivered.  For smart message stores (like Exchange -
but don't buy it, it sucks in too many other ways), the message is
only stored once as well.

If you simply make it easy to recognize which headers go with a 
filter/individual (perhaps by including a filter id), you can add 'em all and
not duplicate the entire message.  If you are worried about users finding
out about Bcc recipients due to information leakage in the extra headers,
then only duplicate the message for Bcc recipients.  I suppose you
might also be concerned that officemates getting the same email would see each
others spam score ("Your spam score for than pr0n spam is 0.00??"), but
that wouldn't bother me.

-- 
	      Stuart D. Gathman <stuart at bmsi.com>
    Business Management Systems Inc.  Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flamis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.