Subject: Re: DMARC methods in mailman (off-topic)

From: S Moonesamy <[email-masked]>
Date: Thu, 22 Dec 2016 08:09:48 -0800

Hi Ted,
At 07:12 21-12-2016, Theodore Ts'o wrote:
>Given that the DMARC "specifcation" isn't even being treated as a
>standard that must be obeyed in all of its particulars by its
>proponents --- the fact that this is being used by its propoonents to
>twist mailers of the IETF --- a standards body --- into knots because
>it is enforcement is random and *not* standardized is, quite frankly,
>amazing to me.

According to a blog article written by Mr Woodcraft, Senior Technical 
Adviser, Government Digital Service, DMARC is "almost an internet 
standard listed as 'Informational' at the The Internet Engineering 
Task Force (IETF), although it's already widely used particularly by 
the larger, consumer-facing email providers".  There was an 
announcement from the Paypal Product and Ecosystem Security Team in 
which there is the following: "the Internet Engineering Task Force 
(IETF) published RFC 7489 for Domain-based Message Authentication 
Reporting and Conformance (DMARC)".  According to the RFC Editor the 
specification was published in the Independent Stream [1], i.e. the 
specification was not been published by the IETF.

The current discussion, as the previous ones, is about whether there 
is a problem affecting IETF mailing list subscribers, and if so, what 
to do about it.  Is that similar to the one discussed in the thread 
at https://lkml.org/lkml/2016/10/24/794 ?

Regards,
S. Moonesamy

1. https://www.rfc-editor.org/about/independent/

---

From: Hector Santos <[email-masked]>
Date: Thu, 22 Dec 2016 16:12:04 -0500

Hi,

Is that the new modus operandi within the IETF, that extremely weak, 
poorly engineered Informational Docs can be fast tracked as a 
"standard" in the IETF?

I hope not. Especially when a proposed standard ADSP rfc5617 was 
officially abandoned for the 100% same issues and problems its 
replacement "Super ADSP" a.k.a. DMARC has.   So if we abandoned ADSP 
for reason X and DMARC suffers the same exact X problem, shouldn't it 
be abandoned as well?

-- 
HLS

On 12/22/2016 11:09 AM, S Moonesamy wrote:
> to do about it.  Is that similar to the one discussed in the thread at
> https://lkml.org/lkml/2016/10/24/794 ?
>
> Regards,
> S. Moonesamy
>

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 23 Dec 2016 10:30:29 +1300

> poorly engineered Informational Docs can be fast tracked as a 

No, that's just standard marketing lies. If anybody actually reads the
RFC in question, it says:

   This document is not an Internet Standards Track specification; it is
   published for informational purposes.

   This is a contribution to the RFC Series, independently of any other
   RFC stream.  The RFC Editor has chosen to publish this document at
   its discretion and makes no statement about its value for
   implementation or deployment.  Documents approved for publication by
   the RFC Editor are not a candidate for any level of Internet
   Standard; see Section 2 of RFC 5741.

Regards
     Brian

---

From: S Moonesamy <[email-masked]>
Date: Thu, 22 Dec 2016 14:46:28 -0800

Hi Hector,
>poorly engineered Informational Docs can be fast tracked as a 

The way to publish an IETF Proposed Standard or IETF Informational 
document has been the same for over a decade.  I don't think that the 
IETF has changed its way of doing that.

Regards,
S. Moonesamy

---

From: Hector Santos <[email-masked]>
Date: Thu, 22 Dec 2016 21:55:09 -0500

> IETF has changed its way of doing that.

Well, for a while now, there has a number of efforts to fast track 
items using Informational Status submissions which has, no doubt, been 
leveraged as a means to bypass critical IETF reviews.  DMARC is most 
definitely one of them.  Lets not fool ourselves.

For all intent and purposes, DMARC has been pushed as a "standard" 
work item within the IETF working group(s).  Additional add-ons and 
higher overhead mail altering suggestions are being proposed to 
address problems it causes.  The same problem ADSP was abandoned for.

We might call it a "pseudo-standard" because of wide usage but in 
reality it is still an informational status document.  That should 
change so it can get the proper status and wider and more complete 
engineering reviews, and frankly more serious considerations. Since 
ADSP was abandoned, a large investment was lost. I have a problem of 
fully committing to a Informational Status DMARC protocol that has the 
same problems ADSP had.  Why should I further invest in it?

I support an IETF standardization effort of DMARC with a charter that 
includes development of additional options we need in order to support 
3rd party Authorization method with the expansion of policy options 
and plus relaxation of any reporting requirements.

If we had completed this work when ADSP was the proposed standard, we 
would of been done with this issue long ago or at least completed to 
the point where List systems would be in a better position to adjust 
with a simpler policy DNS lookup protocol.   Its been over 10 years 
now. Something has to give with this work already.

Thanks

-- 
HLS

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 24 Dec 2016 08:58:15 +1300

Hector,
On 23/12/2016 15:55, Hector Santos wrote:
> leveraged as a means to bypass critical IETF reviews. 

Please read up on the Independent Submission stream of RFCs, how they
work, and what they are for: https://www.rfc-editor.org/about/independent/
It isn't a matter of fast tracking; actually I suspect that it's significantly
slower than the IETF track in many cases.

> DMARC is most 
> work item within the IETF working group(s).

Whether or not it was pushed, it was not accepted and did not gain
IETF consensus, as Informational or anything else. The fact that marketing
managers and journalists can't read plain English is no surprise, but
not something that the IETF can fix. Among ourselves, we should read the
"status of this memo" section of every RFC we consult.

    Brian

> Additional add-ons and

---

From: S Moonesamy <[email-masked]>
Date: Wed, 28 Dec 2016 03:47:14 -0800

Hi Hector,
At 18:55 22-12-2016, Hector Santos wrote:
>items using Informational Status submissions which has, no doubt, 
>been leveraged as a means to bypass critical IETF reviews.  DMARC is 
>most definitely one of them.  Lets not fool ourselves.

Did you mean "Independent Stream" instead of "Informational 
Status"?  If so,  RFC 4846 discusses about the latter.

>fully committing to a Informational Status DMARC protocol that has 
>the same problems ADSP had.  Why should I further invest in it?

I doubt that I could provide an adequate answer to the question as 
our considerations are different.  From my end it is a matter of 
which technical specifications I have to comply with for email to be 
usable.  There is also a policy [1] about IPR which determines 
whether a technical specification is acceptable or not as a standard.

Regards,
S. Moonesamy

1. This is not directly related to the IETF.