Subject: RE: [Asrg] DCC and IP checksums

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 12 Mar 2003 18:23:36 -0800

> > [Off list there has been enough noise there already]
> 
> I'm think I'm going to be able to overcome the temptation to forward
> your note to the list, but it's going to be a close thing.  I consider
> veiled threats as deserving of and expecting no privacy.  I don't
> think much more of private flames.

I made no threats, your claims that I did only further discredit you.

Arguing with you is like fighting with a chimney sweep, one inevitably 
ends up getting soiled in the process.

For the record, the value in separating authentication and authorization
is uniquely a function of an environment where there is a great variation
in the rights which individuals may hold. In environments where there is
no such variation in rights there is not an intrinsic value in 
authentication as a distinct step.

If you can't learn to moderate your language could you possibly try
to understand that just because people don't observe the limitations 
the litterature may contain does not make them ignorant or 'frauds'.

	Phill
 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 12 Mar 2003 21:29:09 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> ...

That's right.  In an isolated corporate network where central
administrators are responsible for all of the computers in the network,
authentication and authorization are the same.  In that kind of network
is no difference between code the central operators sign (or is signed
on their behalf) and authorized code.

However, the Internet or even a large university is a different kind
of universe.  Microsoft or any outfit can be expected to sign some
code whose installation and operation is authorized by the owners of
some computers, not authorized, on other computers, and worse, only
partly authorized on still other computers.

The distinction is relevant to signed spam filtering code.  If it were
technically feasible, might the U.S. Dept. of Defense might ask a vendor
of spam filters to auto-update its customers filters to affect mail in
arabic to or from computers in a particular time zone or with other
characteristics?  How about a filter that affects mail about organizations
that the Chinese government does not like?  I think the answer to both
questions is "Of course!"  Such filters would be authenticated by the
shrink-wrap box vendor but entirely unauthorized.

> the litterature may contain does not make them ignorant or 'frauds'.

What better words are there for those who say by their words and
products that there is not "a great variation in the rights which
individuals may hold" in the Internet?  The decades of security problems
in DOS, Windows, and Windows XP/2000/NT as it is configured by default
are caused in large part by the [you pick the word] and entirely false
assumption that is no "great variation in the rights which individuals
may hold" on computers running Microsoft software.

No useful anti-spam system can ignore the fact the spamishness of a
message or class of messages cannot be centrally defined and that there
are those vast variations among individual email recipients and system
operators.

I've intentionally avoided the issue of whether that signed code has
been reviewed by Lampson and Needham instead of whoever has been
reviewing Microsoft products for the last 20 years.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Thu, 13 Mar 2003 00:05:52 -0500

> authentication as a distinct step.

Hmm.. Vern, he's got us there...

A truly sad state of affairs, but he *does* have us there...