Created attachment 1939 [details]
Email showing the use of plain/text by Norton Antivirus

Subject: Re:  New: Recognize plain/text as a textual attachment

I'll need you to attach an example email to have any idea of what you're
talking about.  Please use the attachment link on the bug page, please
don't cut and paste or email the example.

Subject: Re:  Recognize plain/text as a textual attachment

thanks

In the meantime, the following rule can be used to filter virus notifications 
from Norton Antivirus:

rawbody VIRUS_WARNING_NAV /\[skipped plain\/text attachment\]/

Of course, this rule matches any mail with this incorrect Content-Type.

Now why Norton does that is beyond me

1. nitpicky: It's illegal. I'm assuming they haven't registered that mime type, 
so expecting anyone to recognize it is silly
2. the meat:e one assumes that in fact they don't want anyone to recognize 
this, that they've somehow "defanged" it. But IIRC, the DEFAULT treatment of an 
unrecognized mime type is to treat it as text/plain! So it's worthless

A few things.

1) If standard MUAs deal with "plain/text", we should figure out something.

2) The RFC (1521) specifically states:

   When a mail reader encounters mail with an unknown Content-type
   value, it should generally treat it as equivalent to
   "application/octet-stream", as described later in this document.
[...]
Appendix A
[...]
      5.  Upon encountering any unrecognized Content- Type, an
      implementation must treat it as if it had a Content-Type of
      "application/octet-stream" with no parameter sub-arguments.  How
      such data are handled is up to an implementation, but likely
      options for handling such unrecognized data include offering the
      user to write it into a file (decoded from its mail transport
      format) or offering the user to name a program to which the
      decoded data should be passed as input.  Unrecognized predefined
      types, which in a MIME-conformant mailer might still include
      audio, image, or video, should also be treated in this way.

   A user agent that meets the above conditions is said to be MIME-
   conformant.

3) I've searched the hundreds of thousands of messages in my corpus area.  0 ham hits, 2 spam hits, 
which upon review are actually Norton bounce messages from joe-jobbed worm mails.

I don't think this is an issue for us.  Either the Norton folks should change to using text/plain, or by 
RFC we are supposed to treat their MIME part as a binary.


I vote for closing WFM.

BTW: if you want to catch these messages, you can write a simple plugin for 3.0 which looks for parts 
that have a "plain/text" content-type, it would be about 1 line of actual code. :)

move bug to Future milestone (previously set to Future -- I hope)

Outlook: presents the message's text as a ".dat" attachment, instead of
presenting it inline.

marking WORKSFORME.