Subject: RE: Obstacles between us and the finish line

From: "Gordon Fecyk" <[email-masked]>
Date: Thu, 1 Jul 2004 01:03:13 -0500

> Ok, I said DMP isn't being pushed by anyone, but I'll list it anyway
> 
> 1) solid I-D:  Yes
> 2) working code:  Yes
> 3) testing:  Yes
> 4) IP Licensing:  No problems
> 5) gratuitous incompatibilities:  None.
> 
> I think that DMP is in far better shape than most of the other
> proposals that appear to be much more likely to advanced by this
> working group.  *boggle*

In some anti-spam mailing lists this would warrant a "C&C" warning. :-)

But thanks for bringing this up.  I was thinking about adding support for
marid-submitter and portions of marid-core (notably the RFC2822 Resent-From:
header) as I've asked about earlier.  The end result will be fewer lookups
per message - a minimum of one and maximum of two, compared to a maximum of
*four* - thanks to the information provided through the above drafts.

How about I throw that on the table and see who pokes at it?

-- 
PGP key (0x0AFA039E): <http://www.pan-am.ca/[email-masked]>
Sometimes it's hard to tell where the game ends and where reality bites,
er, begins. <http://vmyths.com/resource.cfm?id=50&page=1>

---

From: "Gordon Fecyk" <[email-masked]>
Date: Tue, 13 Jul 2004 23:08:37 -0500

> > 3) Proposals must have been tested on real world data
> 
> Like 2), there is *still* zero published data on how effective the PRA
> algorithm is on real world data.  I know that it would create a false
> positive on the only email account that I have forwarded to my main
> email address.  I know that it will break on many mailing lists.  I
> don't know much more than that.

How about trying the information I was lent by the IMS Users mailing list?
There's over a year and a half of real world data on real and fake sender
domains, HELO identities, message sizes, IP addresses and so on.  I'll bet
others can come up with similar logs.

Sure there isn't any DOR/Submitter information or headers or whatever.  Some
of this could be synthesized for the purposes of testing, like setting some
bogus rule like, "if [host] has [domain] in part of its name, treat it like
[something]." It would be enough to do inital testing before putting it on a
live server.

I'll yank out the Access database and leave the raw plain text log in a
separate archive.  I can provide separate domain and host information in a
different archive if it's difficult to separate it all out.

http://www.pan-am.ca/smtp.zip

In addition, the Win2K event sink shell I've asked to have coded up is being
worked on.  The event sink itself will call an external library, which
actually implements MARID.

---

From: "Harry Katz" <[email-masked]>
Date: Thu, 15 Jul 2004 14:27:36 -0700

On Wednesday, July 14, 2004 9:43 PM (close enough to midnight), wayne
wrote:

> I have every reason to believe that folks like Harry, Jim and 
> Bob have the best of intentions to try and get a license that 
> is acceptable to all parties.  

Thank you, Wayne.

> My layman reading of the Caller-ID license raises the following
> issues:
> 
> 1) In Section 2.1, the license granted by MS is nontransferable and
>    non-sublicensable.  So, it is my understanding that if I create a
>    hunk of software that implements SenderID, I must license it.  Now,
>    if I upload this hunk of code to sourceforge and source forge
>    starts to distribute it, do they have to go get a license also?
>    What about all the linux/*BSD distributions, will each of them have
>    to obtain a license if they bundle my code?  Does each ftp server
>    that mirrors one of these distribution have to get a license?
> 
>    These kinds of issues are not as much of a problem for commercial
>    products since there would be contracts and such saying that these
>    folks are acting as my agent and that these other distributers
>    aren't creating a new product.  However, in the open-source world,
>    I would expect many of these distributers to change the code, fix
>    bugs, or add features.
> 
> 2) In Section 2.2, the Caller-ID license requires *adding* a term to
>    the existing licenses.  Sorry, but I don't think anyone is going to
>    want to change the BSD or GPL.  
> 
> 3) In Section 6.3, in order to obtain a license, I must either use
>    certified snail mail, or a fax machine to request a license.  I
>    don't have a fax machine, so I'm stuck trying to send certified
>    mail and waiting for a reply.  So, if you find a bug in my
>    open-source implementation of SenderID, you can't just fix it and
>    put a new version up on your ftp site, you have to go running
>    around getting licenses and wait until you get a response back from
>    MS.

These are good questions.  I've added them to the list I'm working on
with our attorneys.