question regarding with trusted/exclusive sender

[casper tn]

Hi all,
I would like to use spamgourmet with jetable (jetable.org).
Jetable gives you an email address with a time-limited life (for example 24hours) that you can redirect (for example to jetable.z.x@spamgourmet.com) After time expires, all email sent
to whateveryouhad@jetable.org is trashed.

My issue is that I would like to have jetable comming mails considered as trusted/exclusive. But those come ... not from jetable.org but from the original sender. What I know is that the message is remailed from a machine called pelteuz.apinc.org (hosting organization of the jetable service). That is:
Received from pelteuz.apinc.org by gourmet.spamgourmet.com

Question:
doc tells about truted/exclusive sender address and domain.
That domain ... could be the "received from" domain? or is just related to the "from" domain?

Why I do want to use such jetable+spamgourmet setup?
Easy: just not to populate innecesarely expendable spamgourmet email addresses. To easy the jetable service use (I would always forward to the same spamgourmet box and account, until there is any spam problem ...)

Thanks!

[SysKoll]

This is not possible since SG does not look at the Received field for determining the trusted sender.

What you can do is add the sender to your disposable address' trusted senders list later. Could you do this?

[josh]

Why not use your forwarding (real) address with jetable.org? Just curious.

[casper tn]

@syskoll
no, adding the sender is not the option. Perhaps you understood the other way round. I would like to add jetable as the trusted sender, but jetable is just relaying the mail without changing the from, so what I receive is a mail from an untrusted sender ...

@josh
Good question, made me think.
It is not (mainly) a question of untrust on jetable.
I tended to thing that it was but a question of easy of use. I use spamgourmet for all, and I can change (what happens from time to time) of final email address. So what I have to do is just to change spamgourmet forwarding address to the new one, and presto!
But this are other things.
How would you send a reply to an email sent from jetable? I currently use in the advanced mode the mask email address of the sender, so, I can directly reply with confidence, no leakege of my final email address happens (well, just the smpt server that I use, but I am not worried about anonimity, use remailer and mixmailers and so on for that). Not quite sure how this will work with jetable.
I would be confortable being able to give always the same forwarding address to jetable.

Then, at the end, perhaps it is just a feeling of trust. I have used SG long time. I feel conformable. I like to have SG between my inbox and the rest of the world. (And between SG and me, there is my loyal spamassassin, just in case ...).

Really paranoic?

[josh]

I use spamassassin too -- I suppose I wouldn't if I never used my "real" email address publicly, but sometimes I do.

What this really goes back to is the probably the core issue affecting spamgourmet:

many users would like unconditionally unexpiring disposable addresses that can be established automatically or easily

vs.

the tendency of spamgourmet addresses to expire is not only a matter of convenience for the users, but also a "dead-man switch" that prevents the service from being overwhelmed by abandoned accounts, forwarding address bouncebacks, willful abuse, and the like. It's really the main reason why we're able to offer the service for free to so many people.

It's a numbers game -- it'd be fun to get more exacting than I have, but I can say that a) it's a lot more expensive to forward a message than to delete it, b) spamgourmet has consistently deleted about 90% of the messages that come to it. Play with the numbers and the server may go down.

That said, "trusting" jetable.org might not be so bad because it explicitly has an autoexpiring function of its own. We've thrown around adding date sensitive expiration to spamgourmet, but most times have stopped because of concerns about how confusing it would make things Maybe setting up through jetable.org would give a little of the best of both worlds. As you may know, we're swamped with development right now, but let's not forget about this.

[casper tn]

@josh

Regarding SpamAssassin
==================
I have to use my real email address, for example in the professional paper cards. Also seems not elegant refusing to give your "real" address to some working pal. More or less the same
with a friend. (There was also the problem when I could not easily and nicely send an email to a friend though a SG disposable address, had to lie to some SMTP, hopefully I have my own domain so I can forge from email address _only smtp after pop, no open relay ..._ Lets try new SG feauture!)

It is not a problem of (only) distrusting the pals. My sister will be sooner or later be catched by some kind of virus that sends email addresses to spammers ...

Regarding jetable
============

Well, my issue is not that jetable "autoexpiring function of its own" would not work, but that jetable perhaps can be hacked and the forwarding emails be leaked; should be a nice spammer dream just to use all those email addressess as forged from addresses for a big spam campaing ... I lost a semi-valuable email address after posting to spamassassin mailing list, as that address was later used by a spammer just to disturb people ...

Regarding the "erase disposable address" issue, it is a catch 22 situation. If the list of disposable addressess grows and grows ... will consume a lot of resources. If disposable addresses are erasable (either the user or by an scheduled process), then, ... spam will get throug ...
This is one of the reasons I miss a solution as jetable here. With that I will only need SG, and could forget about si20.com, jetable.org and so on (A unified solution!!!)
Autoexpiring disposable addresses will also reduce the overhead on SG.
A posible solution for erasable disposable addresses would be:
- either the user can mark a disposable as erasable in say x months after the last trial of an (unacepted) mail. This could be run in "low" system charge periods, perhaps once or twice a month.
- either an automated process that makes that for x=12. This could also be run in low system charge periods, perhaps every several months.

So, there would be a way to clean up sh*t.

Together with autoexpiring ones, would limit vegetative growth to SG.

A way to make autoexpiring addresses "easy" to understand:

- either via specific watchwords (the user could associate a given wathcword with a given expiry period)
- via prefix:
a) either free prefixes
if I set prefix as prq and 24h autoexpiry, let get only email for the next 24 hours to that disposable, i.e. prq.disposable.zen.mybox@... Time limit could be from the setting time of the prefix or from reception of the first email
b) either pre-defined prefixes conbinations: h24, d2, m3, etc.

Perhaps last is the easyiest to use way; pre-defined prefixes:
d, w, m, y

Just thanks again,
CT