Subject: RE: [Asrg] Re: Disaster looming: SPF

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 7 Dec 2004 10:39:02 -0800

My concern about SPF is that it is now a legacy system and that people need
to understand that they cannot play with it as much as they would like. SPF
has seen extensive deployment and despite the issues that broke up MARID is
still backed by all the major ISPs and every major industry thought leader -
here including OSS as industry.

The only place SPF and Sender-ID are still disputed is in the academy.
Frankly my opinion on that quarter is the same as that of Dentrassi cooks on
subjects other than cuisine and mixing drinks.

The point about authentication is not that it will stop spam but that
providing an authentication mechanism is a pre-condition for deployment of
any scheme that moves beyond content filtering and blacklists.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Stephane Bortzmeyer
> Sent: Tuesday, December 07, 2004 3:35 AM
> To: Barry Shein
> Cc: [email-masked]
> Subject: [Asrg] Re: Disaster looming: SPF
> 
> 
> On Mon, Dec 06, 2004 at 06:57:10PM -0500,
>  Barry Shein <[email-masked]> wrote 
>  a message of 23 lines which said:
> 
> > "if it's so great why do we only hear about it in these tiresome 
> > take-on-all-comers arguments but never seem to see it achieve any 
> > progress per se?"
> 
> What sort of progress do you want?
> 
> Active mailing lists? We have, they are even too active sometimes :-)
> 
> Working implementations. There are at least three (counting 
> only free software). http://spf.pobox.com/downloads.html
> 
> Domains publishing SPF: this is something that is in the 
> hands of the domain holders, of course. But when aol.com, 
> hotmail.com, gnu.org, pobox.com, amazon.com and freebsd.org 
> use something, you can safely say it has significant deployment.
> 
> Domains checking SPF: this is something that is in the hands 
> of the mail servers managers. Trackers
> (http://spf.idimo.com/how_to-s/how_to_track.html) seem to 
> indicate that many sites already do it.
> 
> A RFC: well, this one is on the TODO list...
> 
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Tue, 7 Dec 2004 17:23:42 -0500

> any scheme that moves beyond content filtering and blacklists.

My point is that I think there needs to be a lot of flesh put on that
bone, otherwise it's like a salesman's pitch, ``it'll do all these
great things for you -- you're not against great things are you???''
(generic 'you').

I'd agree that it would be good to move beyond content filtering and
blacklists, I'm just not convinced that SPF is that.

Again, good goal, questionable means, don't ask me (again, not you
especially) to sign off on the goal and ignore the means.

I guess what I'm saying is that if there's some grand vision of an
authenticated e-mail future maybe we should lay that out rather than
throwing another half-baked idea on the fire (to mix metaphors!) with
the defense "well, it's better than nothing!"

Which isn't obvious to me.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*