Subject: [Asrg] BATV and mailing lists

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 17 Mar 2005 14:14:31 -0800

A while back I put in a proposal for a BATV like scheme to allow consent to
receive to be expressed in mail headers. The basic idea was that if I
subscribe to [email-masked] then I could give the ietf.org mail server a
token which it would return to me with every message and this would prove
that I asked for the message (see the internet drafts for details).

I suddenly realised that this is the wrong approach. What we should do
instead is to have a BATV like solution, one that does not require any party
but the email user's server and possibly their client application to support
the new scheme.

In standard BATV messages sent BY [email-masked] have the bounce address:
prvs=alice/[email-masked]

So the basic idea here is that she would subscribe to [email-masked] using an
address such as:

mlprvs=alice/asrg.ietf.org/[email-masked]

The mailing list does not need to make any changes to support this but it is
much easier to make the scheme seamless if there is a way to recognize
subscription requests

So the basic plan here would be an option in the email client 'subscribe to
mailing list' that would cause the appropriate BATV (OK RATV since this is
the receiver) to be calculated and the subscription set up.

Thoughts?

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Seth Breidbart <[email-masked]>
Date: Thu, 17 Mar 2005 17:54:13 -0500 (EST)

> mlprvs=alice/asrg.ietf.org/[email-masked]

And post to the list using what address?  And what if someone attempts
to reply to her offlist?  And what if a spammer finds the list archive
on the web?  (How do you distinguish between the latter 2 cases?  Or
are they treated like ordinary email to the base account, with only
the list mail being whitelisted?  How is _it_ distinguished?)

Seth

---

From: Dave Crocker <[email-masked]>
Date: Thu, 17 Mar 2005 16:02:46 -0800

>  the list mail being whitelisted?  How is _it_ distinguished?)

these are the right questions.

the prvs scheme in batv works because only the original administration needs to understand the convention.  for the reasons you are citing -- namely that the mailing list needs to know which bits really are for addressing and which are for validating, and it needs to keep the validation ones hidden from other list members -- the mailing list needs to support the scheme.

  d/
  ---
  Dave Crocker
  Brandenburg InternetWorking
  +1.408.246.8253
  dcrocker  a t ...
  WE'VE MOVED to:  www.bbiw.net

---

From: John Levine <[email-masked]>
Date: 18 Mar 2005 01:57:11 -0000

>So the basic plan here would be an option in the email client
>'subscribe to mailing list' that would cause the appropriate BATV (OK
>RATV since this is the receiver) to be calculated and the
>subscription set up.

This is just the familiar trick of subscribing to mailing lists with a
per-list address.  I suppose you could encode the list name into the
address and a checksum to save the effort of remembering what lists
you've subscribed to, but in practice I suspect that it makes more
sense for the MUA to remember the lists and addresses along with other
info like how to unsubscribe.

The issue of when to use the per-list address and when to use your
normal address is already a pain when I subscribe with unique
addresses (see return address above), and so far there's no good way
to deal with it unless you're the kind of person who thinks it's fun
to wrap his MUA with perl scripts.  With some list managers I can tell
it that my normal address is an alias for the unique address, so I can
post with my normal address and get the mail back to the unique
address, but that's not widely supported (only mj2 as far as I know)
and it's kind of hard to explain to civilians how to set it up.

I agree that we could use a more robust want to manage both ends of
list subscriptions, but I don't see a funky subscription address in
isolation as being very useful.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"I shook hands with Senators Dole and Inouye," said Tom, disarmingly.

---

From: Dave Crocker <[email-masked]>
Date: Fri, 18 Mar 2005 00:25:58 -0800

On 18 Mar 2005 01:57:11 -0000, John Levine wrote:
>  I suppose you could encode the list name into the
>

the purpose of batv is to record some state into the return address, so the origination site does not have to maintain a list of sent messages.

the purpose of the current proposal is the same thing, albeit for a different bit of state, namely providing a means by which the mailing list can 'prove' that the addressee did subscribe.

so it seems a reasonable idea, although the fact that it requires changing mailing lists (to accept a From field that differs from the subscription address) is a non-trivial hurdle.

  d/
  ---
  Dave Crocker