Subject: Re: Yahoo breaks every mailing list in the world including the IETF's

From: "Doug Ewell" <[email-masked]>
Date: Mon, 19 May 2014 15:57:28 -0700

I'm still working on the logic of a post with Yahoo in its subject line,
which calls out Yahoo 26 times and Google 19 times, then concludes out
of left field that all of this is the fault of Evil Microsoft.

--
Doug Ewell | Thornton, CO, USA
http://ewellic.org | @DougEwell

---

From: Douglas Otis <[email-masked]>
Date: Mon, 19 May 2014 16:23:34 -0700

> of left field that all of this is the fault of Evil Microsoft.

Dear Doug,

Agreed.  This problem had little to do with a client's OS.  They had other issues also unrelated to the client OS. According to the AP, Yahoo claimed the last major loss of passwords occurred because of a security breach by a third-party's database.

However, I can relate to the kickstarter jumpshot ad. There are so many dubious browser plug-ins and free software packages people still foolishly install and it is hard to completely blame that on the OS, even though it offers many applications that only run with administrative privileges, but this limitation has changed with their more recent offering.

Regards,
Douglas Otis

---

From: Ted Lemon <[email-masked]>
Date: Mon, 19 May 2014 21:24:39 -0400

> of left field that all of this is the fault of Evil Microsoft.

I'm trying to figure out why the people who keep posting to this thread have so little consideration for their fellow IETFers.  (Not trying to single you out, Doug—I don't think I've seen you post anything before on this thread, although I will admit that I've pretty much tuned it out.)

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 19 May 2014 22:07:54 -0400

> of left field that all of this is the fault of Evil Microsoft.

They do reject DMARC fail, which is part of the problem.

Scott K

---

From: Douglas Otis <[email-masked]>
Date: Mon, 19 May 2014 20:18:44 -0700

> They do reject DMARC fail, which is part of the problem.

To reject or not to reject...

Doing what Yahoo! and AOL requests seems appropriate.  Not doing so may carry some risk. The DMARC specification is fairly clear about the expected action to be taken. If someone is harmed because a message was not rejected, although similar messages for other domains are, then who would be at fault? 

DMARC combines both SPF and DKIM to limit the number of erroneous results.  Of course, Yahoo! and AOL should have notified their users to unsubscribe from mailing lists giving them feedback, otherwise messages sent to these lists might impair subscriptions for other users of different providers.

It is difficult to understand why they selected reject rather than quarantine.  Are they attempting to be ultra safe with respect to follow-on liabilities?   By now their support costs dealing with real harm must have them hemorrhaging such that complaints about not being able to use a church mailing list has fairly low priority.  Why should anyone else care when the domain making seemingly erroneous alignment assertions doesn't?

Regards,
Douglas Otis

---

From: Hector Santos <[email-masked]>
Date: Mon, 19 May 2014 23:32:53 -0400

Incredible, eh?

-- 
HLS