Subject: [Bimi] Concerns regarding draft-blank-ietf-bimi-00

From: "Kurt Andersen (b)" <[email-masked]>
Date: Fri, 8 Feb 2019 14:06:17 -0800

These are first-pass concerns. In some cases they echo some points cited by
Seth in his announcement of the I-D posting to the list, but I'm including
them here too.

The document strikes me as problematic in the shifting back and forth
between MUA and MTA that happens frequently within the text.

The "basic structure of BIMI" seems somewhat out of place in this document
which is simply focused on the DNS "announcement" of the logo.

Why are two URIs required in the BIMI record? As a potential publisher, my
URI already resolves to over 30 globally load-balanced CDN targets. Adding
another URI will end up pointing to the same repositories.

8.2 talks about some sort of unspecified hash

8.6 is attempting to dictate to mail stores (rMS) how to do their business
- seems like we should stay out of that space. It also ignores JMAP as a
retrieval protocol.

Conflating MTAs with "their" MUAs works for webmail providers or walled
gardens, but not for general use cases (such as Yahoo! mail (or Verizon
Media aka Oath aka ?) or practically any mobile client fetching mail from
an arbitrary rMS).

Appendix B talks about recording BIMI information in the A-R, but there is
nothing in the document to suggest such activity.

Based on this somewhat cursory review, I'm sure that a deeper reading would
highlight more discrepancies and problems.

--Kurt Andersen

---

From: "Kurt Andersen (IETF)" <[email-masked]>
Date: Fri, 8 Feb 2019 14:10:44 -0800

(Resending from the right source address)

--Kurt Andersen

---

From: Seth Blank <[email-masked]>
Date: Fri, 8 Feb 2019 14:20:41 -0800

On Fri, Feb 8, 2019 at 2:09 PM Kurt Andersen (b) <[email-masked]> wrote:

> These are first-pass concerns. In some cases they echo some points cited
> by Seth in his announcement of the I-D posting to the list, but I'm
> including them here too.
>

Agreed. The intent had been to keep conversation around display
implications (MUA) separate from evaluation/validation ones (MTA), but I
think that got lost and a single term is needed to simplify and be
comprehensive, especially since this separation isn't true all the time.

> another URI will end up pointing to the same repositories.

Honestly, this was cribbed from DMARC when we first started writing the
BIMI spec and the mechanisms were far more complex; it may no longer be
relevant.

This mistake is on me :-/ How would you suggest it be cleaned up?

> Media aka Oath aka ?) or practically any mobile client fetching mail from

Agreed, per above.

> nothing in the document to suggest such activity.

Not true!

https://tools.ietf.org/html/draft-blank-ietf-bimi-00#section-8.3

---

From: "John Levine" <[email-masked]>
Date: 10 Feb 2019 00:05:48 -0500

>- seems like we should stay out of that space. It also ignores JMAP as a

No kidding.  I know how to put flags on messages with IMAP and
probably with JMAP, but there's no such thing in POP.