Subject: Re: spoofing email addresses

From: Paul Vixie <[email-masked]>
Date: Fri, 28 May 2004 18:42:27 +0000

> As the AD who sponsored this work, I have to disagree.   ...
> The recent interim meeting resulted in an agreement to work on
> a converged spec taking ideas from SPF and Caller-ID.

Why?  These are latecomers to the field.  Or is it because of this:

<http://www.internetwk.com/breakingNews/showArticle.jhtml?articleID=21100498>

	Microsoft To Merge Caller ID With SPF Anti-Spam Scheme 

	Microsoft on Tuesday agreed to blend its Caller ID for E-mail
	anti-spam proposal with another of the leading domain
	authentication schemes, Sender Policy Framework (SPF).

	The company reached the agreement with Meng Wong, the author of
	SPF, to merge the two proposals into one specification that will
	be presented to the Internet Engineering Task Force (IETF)
	standards body in June.

	...

> I do believe there are some tractable pieces here we can pull
> off of the problem and solve, and I believe the working group
> is committed to that task, no matter who proposes the solution.

I think the working group is committed to the appearance of relevance,
and now that there's a moving juggernaut, it's become important to get
out in front of it somehow and appear to be leading.  From [ibid]:

	Both Caller ID, which Microsoft chairman Bill Gates first touted
	in February, and Wong's SPF would confirm the sender's domain.

	...

	"We're pleased to see Microsoft and the SPF community working
	together on a unified specification," said Andrew Newton,
	co-chair of the IETF working group that handles domain
	identification issues, in a statement.

If there's a more blatant example of rubber stamping in the history of
IETF, then I hope a better historian than I can share the archives with
me.  Right now there's an elephant in the room with us and it's called
"fully verified opt-in" and this elephant is somehow invisible.  Microsoft
has been doing verification for years now, so it's not as if they would
increase their costs or lose revenue if they just came out and told the
world to do the same.  Even Yahoo recently sent me a verify-o-gram, so
the tide is turning.  But still, the elephant remains invisible, and we
have a federal anti-spam law that allows unverified opt-out.

It's as though we want to stop forgery and make everybody run
nonexecutable stack segments in XP to prevent a bazillion bots from
relaying spam to us, so as to prevent "wild spam" and yet, by dint of
ignoring the invisible elephant, ensuring that it will always be
possible for "reputable" companies to spam like crazy.  Which always
made sense to me during the years when Microsoft wasn't doing
verification, but it doesn't make any sense to me any more.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Ted Hardie <[email-masked]>
Date: Tue, 1 Jun 2004 11:39:11 -0700

>	be presented to the Internet Engineering Task Force (IETF)

I think you are confusing cause and effect.  Of course, the trade press's
view of this and a participant's are likely to be different.  I may be confused
by my actual attendance at these meetings and reading of the mailing list.

>IETF,

Since the converged spec is still in development and the discussion
has involved all of the parties (at least at the interim meeting) recognizing
that they would have to compromise fairly major pieces of their
existing proposals, this doesn't look like rubber stamping to me.
Eric Allman, who has kindly agreed to take on editing one of the
forthcoming drafts was also never a party to any of the proposals.

I invite those interested in forming their own opinions to participate
in the mailing list for MARID.  I do not think rubber stamping will
come to mind, but perhaps you should also read the trade press,
just in case you would like a different view.
					Ted Hardie

---

From: Andrew Newton <[email-masked]>
Date: Wed, 2 Jun 2004 02:00:15 -0400

On May 28, 2004, at 2:42 PM, Paul Vixie wrote:
> me.

If there's a more blatant example of mischaracterization in the history 
of IETF....

-andy

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 2 Jun 2004 09:06:42 -0600 (MDT)

> From: Andrew Newton <[email-masked]>
> To: Paul Vixie <[email-masked]>

> If there's a more blatant example of mischaracterization in the history 

Whether it is an example of rubber stamping can't be determined until
we see the I-D.

Besides, the implication that rubber stamping by the IETF is a bad
thing is wrong.  When the IETF has worked well, it has applied its
stamp of approval to things developed, tested, and initially deployed
outside the IETF.  IETF working groups that try to design things
never do better than can be expected of standards committees, and
that's a step below the sad results of ordinary committees.  The
IETF is often competent to determine and publish the choice of the
market; it is incompetent at inventing.

MARID will provide good service.  For years, the unthinking and snake
vapor oil vendors insisted that "redesigning" SMPTP with authentication
would solve the spam problem.  Now that we have SMTP-TLS, SMTP-AUTH,
S/MIME, and PGP, they have changed their songs to praise sender
authorization.  Sender authorization cannot fix the spam problem, but
MARID will soak up a lot of their noise for months (or years).
When an official sender authorization protocol fails to end spam by
the Sept. 2004 (see http://ietf.org/html.charters/marid-charter.html),
maybe we'll get to hear a new chorus.  Maybe a few will stop praying
for the salvation of business models that depend on abusing the commons
and switch business models.  (e.g. actually deal with abusive users)

Vernon Schryver    [email-masked]