Subject: Re: [Asrg] Message Level Authentication

From: "Bill Mcinnis" <[email-masked]>
Date: Fri, 7 May 2004 08:49:10 -0400

Matthew,

Point 1 - What part of what andy said? We cant make ip claims about
similarities because you have come up with nothing so far as a group.

Point 2 - As far as an expert review of what we have developed, 
unfortunatley the experts formed the asrg a long time after we came up 
with this.

Point 3 - Yes we did get feedback and we answered everything anyone
asked. Next.

Question 1 - does everything have to be in a draft form?  I have seen a
lot of things hashed through without those (CID and YDK).  Most of them
seem to be ideas about things to try and not about things already built?

Question 2 - Is the patent piece of this a non starter in terms of 
working with this group?  I know you all are considering other patent 
pending ideas, what makes this one so different and what is with the 
hostile remarks to us popping our heads up?  

We are not trying to create a hostile environment, we just created 
something we know works and want to have it flushed out as an option
as it is the most secure form of authentication (no pki, no publishing
specific ips dns, not rebranding of old ideas into something new),
it provides the level of accountability required before any e-postage
scheme is possible and actually works.

Is the job of this group to find something that works, or find something
that nobody else came up with? 

Thank you

Bill McInnis
---------- Original Message ----------------------------------
From: Matthew Elvey <[email-masked]>
Date:  Thu, 06 May 2004 21:04:11 -0700

>On 5/6/2004 6:16 PM, Bill Mcinnis sent forth electrons to convey:
>
>>Hello,
>>
>>We started this thread over in the MARID board only to be
>>asked to move over here, which we can understand.
>>  
>>
>What Andy said applies equally here:
>
>Bill,
>>
>>If you are asking for expert review of your proprietary anti-spam 
>>system, please do it elsewhere.
>>
>>If you are seeking to contribute to this IETF standardization effort, 
>>please submit an Internet Draft complete with proper intellectual 
>>property notices.  And remember, MARID is about a DNS authorization 
>>solution for MTAs.
>>
>>If you believe that input documents to MARID are in conflict with your 
>>own intellectual property, please specify which methods are in 
>>conflict.
>>
>>-andy, co-chair
>
>?
>
>It looks like you already got a bunch of feedback on the MARID list:
>http://www.imc.org/ietf-mxcomp/mail-archive/msg00940.html
>
>>...
>>Thank you,
>>
>>Bill McInnis
>>  
>>
>.
>
>----
>This message has been verified as authentic by MessageLevel.
>Guarantee the authenticity of your email @ http://www.messagelevel.com.
>

----
This outgoing message is guaranteed to be authentic by MessageLevel users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Matthew Elvey <[email-masked]>
Date: Fri, 07 May 2004 13:58:03 -0700

>seem to be ideas about things to try and not about things already built?
CID and YDK got a lot of hostility for not submitting stuff in draft 
form too.  (And the former for being based on unspecified proprietary 
IP, and simply being from a company that's a convicted predatory 
monopoly, etc.)
Here's one way likely to get rid of much of such hostility: 
https://www.redhat.com/legal/patent_policy.html.  An irrevocable offer 
to license at a specified price would be another idea...

>hostile remarks to us popping our heads up?  
The IETF doesn't flatly reject anything that's patented or patent 
pending, AFAIK, but it's a big hit, because patents usually make broad 
adoption more difficult.

In terms of techno-social merit, ML seems to potentially accomplish 
about what SPF does, while requiring more work from adoptees, and less 
incentive to early adopters, hence being less likely to achieve its 
potential.  E.g. I'd have to set up and run  an ML server for my domain 
(or pay someone to).

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 07 May 2004 17:25:22 -0400

...
> pending, AFAIK, but it's a big hit, because patents usually make broad 

The ASRG's IPR policy can be found here:

http://asrg.sp.am/about/ipr.shtml

The basic thrust is that you should disclose your IPR upfront. However, 
as Mathew stated, patents make adoption more complicated.

Yakov
--
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"And this too shall come to pass"

---

From: John Levine <[email-masked]>
Date: 7 May 2004 22:13:28 -0000

>Is the job of this group to find something that works, or find
>something that nobody else came up with?

The former.

Patents aren't an insurmountable problem, although unless your
patented scheme is vastly, enormously, better than all of the
alternatives, people are going to use schemes that are either P.D. or
where patent owners offer free licenses as Microsoft says they're
going to do with Caller ID.

The lack of a formal Internet Draft isn't insurmoutable either,
although lack of a concrete technical spec is.  Microsoft has
published a Caller ID spec with as much detail as you'd find in an
I-D, and there's one coming shortly for Domain Keys.

The basic problem with per message callback verification is that it's
not a very good way to authenticate messages.  It's an idea that's
come up from time to time and has never garnered much enthusiasm.

It's very expensive for recipients, since it requires a database
lookup over the net for each message, and unlike any of the LMAP
proposals or Domain Keys, the looked up data can't be cached for other
messages from the same domain.  It's a disaster for senders if their
domain is even moderately spoofed, since they'll be hammered with
lookups for every spoofed message.  (My abuse.net domain, for example,
sends under 10K messages a day, but there's up to a million daily
forged abuse.net spams from about two Russian spammers.)

It also seems to me utterly implausible that a high volume mailer like
AOL or Hotmail would be able to maintain a database of every message
they send, and process queries in real time.  Unlike mail sending and
receiving, this cannot be farmed out to multiple independent parallel
servers, since the domain's database has to know about all the mail
sent from that domain and respond to all the queries.

If you had a concrete description of your system, we could probably
identify other problems with forwarded mail, roaming users, one-way
forwarders like computer.org and pobox.com, and "frankenmail" with the
head of a legit mail and the body of a spam.  But given how
fundamental the performance and scaling issues are, I doubt you'll get
much more feedback here even if you did have a spec.

Several ASRG participants run e-mail consultancies, so if you really
wanted a more detailed critique, you could doubtless hire someone to
help perform one.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: Matthew Elvey <[email-masked]>
Date: Fri, 07 May 2004 18:33:59 -0700

On 5/7/2004 11:13 AM, John Levine sent forth electrons to convey:

> [P]eople are going to use schemes that are either P.D. or
>
My reading of the license was that I need permission from Microsoft to 
use CID, and that they may withhold it.
That's not free!  (Besides which, as Jeff Silverman just said on ASRG:

> The system cannot rely on the sender to do the right thing.  As I 
> understand the caller ID protocol, it relies on the sender. )

---

From: John Levine <[email-masked]>
Date: 8 May 2004 02:13:01 -0000

>That's not free!  (Besides which, as Jeff Silverman just said on ASRG:

Contacts at MS have informally told me that the intention with the
CLID patents is to provide free permanent licenses to everyone.  They
realize that the current license doesn't say that, so presumably at
some point they'll revise the license to say what it's supposed to.
We'll see.

In any event, that was an example.  I think we all agree that a scheme
is much more likely to be adopted widely if people who use it don't
have to negotiate patent licenses.

Regards,