Re: Return Receipts

[Simon Josefsson <jas@extundo.com>]

hammond@csc.albany.edu (William F. Hammond) writes:

> Doesn't it pose risks if a user inadvertently opens spam?

DSN opens up to all kind of privacy threats, so it shouldn't be
enabled by default.  OTOH I think it might be useful in some
situations (especially if you are in a Windows environment where
someone expects you to return a receipt).

> The least of these might be a spammer who queues the user for more
> spam every time a return-receipt comes in.

There are some (limited) discussion about sanity checks that should be
performed in RFC 2289 (section 2.1).

> Alternatively, it's very easy for a user to wire a keystroke to a
> boiler-plate acknowledgement by writing a little elisp.  So maybe that
> could be provided for users who want to be able to use a keystroke to
> honor a return-receipt request.  If so, the request needs to be made
> plain to the user, but, pretty please, no prompt, or, at worst, a
> user configurable return-receipt-request display-mode like 0=hide,
> 1=show, 2=prompt.

Yes, a prompt like this could work.  A prompt is quite obtrusive
though, maybe just a button that says the sender requested a
notification, and you can press the button to send it.

One point of DSN is that the receipt is in machine readable format,
multipart/report, a boiler-plate acknowledgement wouldn't achieve the
same thing.