Subject: RE: How do I send EDI file securely over Internet via FTP or HTTPS?

From: "Rishel,Wes" <[email-masked]>
Date: Sat, 1 Jun 2002 14:16:27 -0400

A lot of people confuse the theoretical characteristics of SMTP when used entirely in well-configured, well built SMTP servers and the general state of e-mail, with a lot of corporate mail servers coming from products that are not solely SMTP servers and for which administration is a high art sometime practiced in less than perfect human beings.

Real e-mail service has occasional failure to delivery, for which a notification is usually, but not always sent back to the sender, occasional duplication, and very inconsistent transit times. There is no guarantee that batches sent in separate e-mails would arrive in order. And very few servers configured to support real e-mail users can swallow a large batch without choking. 

You could achieve reliable transmission of batches using dedicated, well-built, well-administered SMTP servers, and AS1 but that is beyond the skill and organizational complexities of many users. There are a few vendors that help here, but not enough that you can be assured that a trading partner has a compatible product.

Even if you are lucky and have the skills or common products with your trading partner to do AS1, there is still a problem for large batches. In order to transmit an encrypted or compressed batch using real-email you have to expand it to 133% or more of its original size depending on the scheme you use to represent binary data as a stream of printable characters.

If you are going to set up a special server, as you must for e-mail, why not set up a special HTTP server instead, and use AS2 or ebXML?

Even without AS2 there is certainly a lot of EDI being sent over HTTPS now, using ad hoc specs prepared by channel master trading partners and consortia such as the GISB and AIAG. It seems to take less technical skills to submit batches using HTTPS than using SMTP.

-----Original Message-----
From: Carl Hage [mailto:[email-masked]]
Sent: Friday, May 31, 2002 3:17 PM
To: [email-masked]
Subject: Re: How do I send EDI file securely over Internet via FTP or
HTTP S?

From:           	"Pae Choi" <[email-masked]>
[RE: SMTP/email]
> Of course, that is why it's called "Store-&-Forward" mechanism.
> But it does not guarantee "How soon it will get there!"

Store-and-Forward comes from the old days when people had dialup 
modems. The best guarantee is to deliver directly without forwarding. 
Of course, if you want to send a message but can't reach another 
server you have a problem-- same as if you used http/ftp

I wonder why spammers are the only ones to figure this out. The 
tragedy is that a good way to get rid of junk mail is to delete mail that 
doesn't appear to be store-and-forward.

> Maybe we need new email service that guarantee the delivery
> within a given time, e.g., Fedex or UPS style guarantee delivery. :-)

You can use Fedex to send a package to your neighbor, but it's more 
reliable to walk over and give it to them personally. Same for smtp 
email.

I suppose there could be a business that runs high availabliity, 
geographically isolated redundant servers that can perform an assured 
delivery with store and forward if needed, plus archiving. In theory it 
could be more reliable than your own computer, which could crash and 
corrupt it's files. But a backup-only service is just as good and maybe 
better in some ways.
...
> > Ever received an email 30 days later than sent?

No, but I've received very delayed email, as have friends. At least I've 
received it!

Ever tried accessing a web site and got a connection timed out?

The real issue is how do you deal with the situation when a direct 
delivery can't be made.

---

From: "Dick Brooks" <[email-masked]>
Date: Sun, 2 Jun 2002 17:55:21 -0500

I concur with Wes.

Additionally, standard SMTP(RFC821) implementations also lack other key
features, such as an access control mechanism. Energy industry organizations
I've worked with require access control, authentication, authorization,
confidentiality and deterministic, auditable delivery of business
transactions.

EDIINT AS2 and ebXML's Message Service come closer to meeting all of these
requirements than standard SMTP or AS1.

Dick Brooks
Systrends, Inc
7855 South River Parkway, Suite 111
Tempe, Arizona 85284
Web: www.systrends.com <http://www.systrends.com>
Phone:480.756.6777,Mobile:205-790-1542,eFax:240-352-0714

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Rishel,Wes
Sent: Saturday, June 01, 2002 1:16 PM
To: [email-masked]
Subject: RE: How do I send EDI file securely over Internet via FTP or
HTTPS?

A lot of people confuse the theoretical characteristics of SMTP when used
entirely in well-configured, well built SMTP servers and the general state
of e-mail, with a lot of corporate mail servers coming from products that
are not solely SMTP servers and for which administration is a high art
sometime practiced in less than perfect human beings.

Real e-mail service has occasional failure to delivery, for which a
notification is usually, but not always sent back to the sender, occasional
duplication, and very inconsistent transit times. There is no guarantee that
batches sent in separate e-mails would arrive in order. And very few servers
configured to support real e-mail users can swallow a large batch without
choking.

You could achieve reliable transmission of batches using dedicated,
well-built, well-administered SMTP servers, and AS1 but that is beyond the
skill and organizational complexities of many users. There are a few vendors
that help here, but not enough that you can be assured that a trading
partner has a compatible product.

Even if you are lucky and have the skills or common products with your
trading partner to do AS1, there is still a problem for large batches. In
order to transmit an encrypted or compressed batch using real-email you have
to expand it to 133% or more of its original size depending on the scheme
you use to represent binary data as a stream of printable characters.

If you are going to set up a special server, as you must for e-mail, why not
set up a special HTTP server instead, and use AS2 or ebXML?

Even without AS2 there is certainly a lot of EDI being sent over HTTPS now,
using ad hoc specs prepared by channel master trading partners and consortia
such as the GISB and AIAG. It seems to take less technical skills to submit
batches using HTTPS than using SMTP.

-----Original Message-----
From: Carl Hage [mailto:[email-masked]]
Sent: Friday, May 31, 2002 3:17 PM
To: [email-masked]
Subject: Re: How do I send EDI file securely over Internet via FTP or
HTTP S?

---

From: "Robert E. Frank" <[email-masked]>
Date: Sun, 2 Jun 2002 21:34:13 -0700

From1984 to 1994, my teams used standard SMTP over
the open Arpanet, Milnet and Internet .  We moved many 
millions of EDI logistics and procurement transactions 
between (up to10,000) military and commercial trading 
parties.

Theoretically, we could have had some losses; but, we 
had none. We avoided problems by using quality hardware, 
quality software, trained administrators, SMTP experience, 
and common sense.

From 1995 until today, we have been using SMIME and
EDIINT products (such as Templar and Softshare Vista) 
to provide such features as "access control, authentication, 
authorization, confidentiality and deterministic, auditable 
delivery of business transactions."  Other products also
support these capabilities.

Of course, work on improving the standards should 
continue.  But, I could not lurk any longer without 
encouraging people to move ahead with one of the
excellent SMIME/EDIINT options available today.

Robert Frank
Open Commerce, Inc.
SAFExchange Services
925-846-1970

---

From: "Dick Brooks" <[email-masked]>
Date: Mon, 3 Jun 2002 11:58:28 -0500

Hello Bob,

It's been quite awhile since we last communicated (1992 I believe). I was
working at DEC and I believe you were working for the Government at one of
the National Labs (was it Sandia?). I recall we were both working with Dave
Crocker on what eventually became RFC 1767. We've been at this a long
time...

I find it troubling to see such deep division within the EDIINT workgroup.
We continue to experience skirmishes over SMTP and HTTP, S/MIME and OpenPGP.
I also expect a confrontation to breakout within the AS2 camp over the two
available packaging options, RFC2388 compliant versus the AS2 specific email
like packaging with AS2-To and AS2-From extension headers (as synonyms for
the RFC 822 To and From headers) at the HTTP level to identify
sender/recipient.

Now, we have a fairly well defined reliable, secure ebXML Message Service
(supported by DISA and UN/CEFACT) that, IMO, is a more cohesive, elegant and
better engineered framework for E-Commerce than either AS1 or AS2. ebXML's
Message Service is built on SOAP and supports a full range of web services
functionality as well as the standard EDI transport function.

Also, let's not forget the imminent competition coming from some of the
other alternatives, such as WS-Security [1] (Microsoft) and HTTPR [2] (IBM).

IMO, competition between these various "standards" is creating a  difficult
situation for implementers. A recent letter from Tim Thomasma of Ford Motor
Company and Co-Chair, XML/EDI Work Group, Automotive Industry Action Group,
to David Berlind at Cnet.com sums it up better than I, he states:

"The last thing we need is some sort of new "Sun + allies / ebXML" vs.
"Microsoft + allies / Web services" technology war. Competition is
wonderful, but can each vendor please implement reliable, secure XML
messaging over HTTP in such a way that it interoperates with everyone else's
implementation?"

In closing, I refer you to an article I wrote describing E-Commerce
standardization in the Energy industry that expresses concerns similar to
those expressed by Tim, ref:

"The Struggle for B2B Standards: A Tale of e-Commerce Standardization in the
Energy Industry"
http://b2b.ebizq.net/std/brooks_1.html

Tim, if you're listening - good letter.

[1]
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnglobspec/
html/wssecurspecindex.asp

[2] http://www-106.ibm.com/developerworks/webservices/library/ws-phtt/

Dick Brooks
Systrends, Inc