Re: [secdir] SecDir review of draft-ietf-sieve-notify-presence-02

[Barry Leiba <[e-mail]>]

Thanks for the review, Stefan.

> One thing that strikes me as possibly relevant is if this in any way can be
> a means (in some variants of it's use) through which a spammer can gain
> information about the status of the recipient.

We had thought of that, but I thought enough was said.  Probably not,
so I intend to add this paragraph to the security considerations,
already in my working copy:
---
In some situations, scripts may act on some of the recipient's
presence information that the sender of the triggering message
is not allowed to see.  This can be a benefit to the recipient
in many cases, but it can also present an opportunity for a
sender to use messages to probe the recipient's presence (if,
for example, messages sometimes result in auto-replies, and
sometimes do not).  Script authors should take care in
considering this aspect of presence-triggered actions.
---

Does that address your concern adequately?

Barry