Duplicate message ids

[Mark Walters]

Hi

A concern for notmuch is some form of attack via someone sending a
message with a duplicate message id. I think I have seen it asserted
that it is not so much of a problem as the first message received by
notmuch will have priority.

However, I believe that this is not the case. The script below gives a
demonstration (on my system at least). I have written it as a "test" so
(I hope) it doesn't mess up the system. It should work if you put it in
the test directory and execute it.

It adds a message, runs notmuch new, adds a message with the same id,
runs notmuch new, and then runs notmuch search <id> and notmuch show
<id>. The former shows the subject of the first message, and the latter
the subject of the second message.

Best wishes

Mark

-------------- next part --------------
A non-text attachment was scrubbed...
Name: T710-duplicate-id.sh
Type: text/x-sh
Size: 602 bytes
Desc: not available
URL: <http://notmuchmail.org/pipermail/notmuch/attachments/20170827/8d8b2c27/attachment.sh>