Update 10/29/08: Microsoft says they'll fix this in Outlook 2007 Service Pack 2! The waiting begins…

I hate Outlook 2007 with the white hot heat of a thousand suns.

Why?

Because I've just exposed my email address to thousands of spam harvesting little fucks.  I've gone out of my way to not use this address for anything other than corresponding with friends and trusted business partners.  If I don't know you, you get a throwaway email.

And is where the story begins.

I have a catch-all address configured that I use for signing up for for websites, and it works great.  The downside is it gets a staggering amount of spam.  3 years worth of messages and I've got 2758 messages in my inbox.  And there are 10,041 pieces of spam in the past 30 days.

That's fine though, because I've only had a few false-positives that I care about (or at least noticed), and I don't even look in the Spam folder unless I'm expecting something.  To make my life easier I've been POPing my mail into Outlook, the one downside being that it doesn't synchronize reads or deletes.  When I upgraded my desktop last week I decided to switch to IMAP, because who doesn't want more synchronization, right?

It turns out there is an incredibly nasty bug in Outlook 2007.  Scream and pull your hair out and pray for testicular cancer in all of the male developers bad.  Not data loss, no, that's manageable if you backup regularly.  No, it's not emails not being delivered either.

No, the problem is that Outlook doesn't honor your "Read Receipt" option.  If Outlook has synchronized with the server and downloaded messages, and then you delete the message elsewhere, Outlook will send the Read Receipt the next time it synchronizes with the server.

And because every shit eating kid with a botnet and a list of email addresses to sell wants proof that an address is alive, spam almost always is sent with a Read Receipt requested.  This means that if you're using some relatively unknown webmail service like GMail along with Outlook, you're in for a world of hurt.  The next time you (or GMail) deletes spam messages a slew of read receipts will be sent out to wonderful people like Monty Savage or Данила Алексеевич.

That's not the worst part though. The worst part is that if you're using Exchange, that address will be exposed. Presumably it's whatever your primary email address is. That email address that you've kept secret, cherished, coddled and protected for years will be ravaged and exposed to the world.

Steps to reproduce:

1. Add an IMAP account to Outlook
2. Send a message to the IMAP account email address with Read Receipt Requested from a different email account.
3. Send/Receive until the message appears in Outlook
4. Delete the IMAP message from a different client (eg, GMail). Make sure to completely delete the message (check the Trash folder on GMail).
5. Send/Receive in Outlook again.
6. Return to the sending account to see the unexpected read receipt.

The read receipt will be similar to:

Your message

To: primary_email@address.com
Subject:

was deleted without being read on 10/27/2008 4:20 PM.

Where primary_email@address.com is not necessarily the address you sent the email to.

It doesn't matter if you set your options to always send a read receipt, never send a read receipt or prompt before sending a read receipt. Outlook does what Outlook wants, and Outlook wants you to suffer and drown in a flood of spam.

Did I mention that this bug was reported around 15 months ago?

In closing, if you are one of the developers who decided that this wasn't something worth fixing, I hope you die in a fiery car crash.

 

Tags: a wee bit annoyed, bugs, Outlook, Spam

Posted on Monday, October 27th, 2008 at 8:05 pm | Filed under Personal, Software, Technology
You can follow any responses to this entry through the Comments feed.
Post a Comment | Trackback URL | Permalink URL