Subject: Sender-ID and free software

From: Richard Stallman <[email-masked]>
Date: Sat, 24 Jul 2004 15:43:21 -0400

(Michel, I am not a member of this list, so would you please
forward my message if it does not go through?)

Microsoft's Sender-ID license is directly incompatible with free
software regardless of which free software license is used.  Free
software means users are free to run it, study and modify the source,
and to redistribute it with or without changes.  Free to do so means
there is no requirement to ask or tell anyone that you are doing so.

The Microsoft license for Sender-ID directly forbids release of
software with all these freedoms, so it is impossible for any program
to be free software under Microsoft's regime.

I've been expecting to see something like this ever since Gates
started talking about spam.  This license is an example of Microsoft's
strategy for killing off free software as an alternative to Windows.
Microsoft first patents something, then incorporates it into a format
or protocol, then tries to make it de rigueur while excluding those it
wishes to exclude.  In the absence of resistance, Microsoft has a good
chance of imposing whatever standards it likes.  Let us, therefore,
resist it here and now.

---

From: "Douglas Otis" <[email-masked]>
Date: Sat, 24 Jul 2004 14:23:54 -0700 (PDT)

> chance of imposing whatever standards it likes.  Let us, therefore,

Richard,

In the case of the PRA proposal, proponents have difficultly explaining
why this concept is better.  PRA ensures there is NO relief with respect
to network overhead, even if messages are rejected.  PRA ignores the
primary motivation for which identity is being spoofed, being a means to
avoid accreditation filtering, the RFC 2821 MAIL FROM.  If accreditation
is allowed to become more effective with CSV, this oversight is
significant.  A rather weakly supported claim is this will end phising. 
Support for PRA checks overlooks the identity significant to the user, and
that many techniques still exist to allow phising, some without the need
to publish DNS records by the entity committing the fraud.

There is also a potential for network instability caused by early
termination of a series of DNS queries, that both allow accumulation of
outstanding UDP traffic and necessitate the resending of the messages.  A
serious flaw made far worse with PRA.  As PRA has been isolated, envision
rejection of both the Submitter and PRA draft.  Take the BATV draft of
Dave Crocker and add a mode using an address based technique to include
the SPF record sets.  This would allow Forwarding and List Servers for the
most part to continue working, without the use of Submitter.  (EzMLM may
be an exception for signatures, but would still work with the SPF mode.)

Submitter and PRA should be rejected as being highly disruptive. Combine
SPF with BATV. Submitter and PRA fail to provide the most basic goal of
the MARID charter.  That is to authenticate (and authorize) the MTA domain
(responsible for policy as implied with DNS), as compared to CSV that
ignores filtering objectives of messages, but accomplishes the basic goal
of the charter.

-Doug

---

From: Michel Bouissou <[email-masked]>
Date: Sat, 24 Jul 2004 23:53:08 +0200

Le samedi 24 Juillet 2004 21:43, Richard Stallman wrote :
> software regardless of which free software license is used.
[...]
> Let us, therefore, resist it here and now.

Thus He Spoke.

-- 
Michel Bouissou <[email-masked]> OpenPGP ID 0xDDE8AC6E

---

From: Andrew Newton <[email-masked]>
Date: Sun, 25 Jul 2004 19:08:06 -0400

First, I do not think this message says anything that has not already 
been stated on this list already.  In fact, there have been messages on 
this list with a far better description of the legal nature of this 
issue than this one.

While on the subject of things stated previously on this list:

> chance of imposing whatever standards it likes.  Let us, therefore,

We have asked repeatedly that this type of behavior be stopped.

See http://www.imc.org/ietf-mxcomp/mail-archive/msg02079.html

You are no exception to the rule.  Do not do it again.

-andy

---

From: Michel Bouissou <[email-masked]>
Date: Mon, 26 Jul 2004 01:47:58 +0200

Andy,

Please let me respectfully reply in regard to your message to RMS.

> this list with a far better description of the legal nature of this

Richard's message was rather short, to concentrate on the main aspects of the 
issue, and give his conclusions, without entering again in the technical and 
legal details that have, as you state, already been exposed in detail on this 
list.

However, Richard's opinion on the matter is highly respected and weights for a 
number of people, me included, he being the leader of the Free Sofware 
Community.

I think he was completely in his rights expressing here the general views of 
this community regarding the licensing issue of the Sender-ID proposal.

I don't expect Richard to express himself often on this list, much less to 
pollute it. So please let him express once for all the valid concerns of the 
Free Software Community.

> You are no exception to the rule.  Do not do it again.

I suppose that you refer to this extract of the archive message (from 
yourself) that your refer to:

<<<
> * Because all the participants are individuals and represent no corporation,
> government or other type of organization, intimations and message subtext
> regarding the motives and/or hidden agendas of other participants will no
> longer be tolerated.
>>>

I perfectly understand this and wish to conform. Nevertheless, it is to be 
noticed that the licence imposed on Sender-ID is not the property of any 
"individual" participating in the works of this group, but the alledged 
property of a (rather big) corporation.

This being, the attitude of this corporation and its intentions regarding the 
license it wishes to impose are perfectly relevant subjects as they influence 
much of the global availability and usability of the concerned technology.
Please note that Richard didn't make any statement regarding the motives 
and/or hidden agendas of members of this working group, as, per your own 
definition, the concerned corporation is not, as such, a member of this 
group.

Furthermore, let me citate anoter extract from your mail of June, 17:
<<<
> * Above all else, participants should concentrate their energies on creating
> an interoperable standard. 
>>>

I strongly believe that the license issue is one of the major roadblocks 
towards "creating an interoperable standard", and this opinion seems to be 
shared by many others.

Thus, in my humble opinion, the remarks that Richard made on this subject were 
perfectly relevant.

Respectfully.

---

From: Marshall Rose <[email-masked]>
Date: Sun, 25 Jul 2004 19:22:44 -0700

michel - the plain fact is that the contents of rms' posting, 
specifically the last paragraph, is directly contrary to the 
admonition, repeatedly given by the co-chairs, with respect to the 
content of messages sent to the list.

he has been given a warning. if he continues to misbehave, then the 
chairs will invoke bcp83 and ask the iesg to ban him from the mailing 
list.

there is an expression in western society that goes like this "rule of 
law, not rule of men". the rules apply equally to everyone, and so i 
simply don't care who we're talking about. if 
some-other-important-person sends a similarly offending message, then 
he too will get a warning, and if he does it a second time, he too will 
get at bcp83 timeout.

if you feel this unfair, unappreciative or otherwise unhelpful then i 
suggest you straight to the iesg right now.

andrew and i have been tasked to chair this working group according to 
the charter approved by the iesg and consistent with the ietf process. 
one of the more distasteful aspects of that is having to remind people 
of the admonition cited earlier.

/mtr

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 26 Jul 2004 11:12:31 +0200

On Sun, Jul 25, 2004 at 07:08:06PM -0400,
 Andrew Newton <[email-masked]> wrote 

> We have asked repeatedly that this type of behavior be stopped.

Excuse me but it seems that legal or political issues should be openly
discussed *before* the standard is cast in stone. Otherwise, the fine
RFC writers would have work for nothing if the resulting technology is
so patent-encumbered that it cannot be implemented or distributed.

I've already seen that sort of behavior at IETF: dismissing in a few
sentences any legal or political issues because "we are a technical
body" and "we should not get involved in non-technical issues". Very
often, the dismissed issue just come back later and time and effort
were wasted. It happened with NSEC zone walking in DNSsec, for
instance, when the worries about invasion of privacy were not taking
into account, forcing the issue to pop up again during the last call.

So, because MARID records are useful only if *many* sites use them,
deciding in advance to be blind to patent issues is a bad
decision. And using personal remarks against the persons who happen to
raise these issues will not help, either.

[Woh, I managed not to mention Microsoft once :-)]

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 26 Jul 2004 11:21:13 +0200

On Sun, Jul 25, 2004 at 07:22:44PM -0700,
 Marshall Rose <[email-masked]> wrote 
 a message of 26 lines which said:

> chairs will invoke bcp83 and ask the iesg to ban him from the
> mailing list.

The RFC 3683 was discussed mostly to deal with people like Jim Fleming
who are clearly engaged in "what amounts to a "denial-of-service"
attack to disrupt the consensus-driven process.  Typically, these
attacks are made by repeatedly posting messages that are off-topic,
inflammatory, or otherwise counter-productive." Pure trolls are easy
to spot.

I presume (but you probably know it better than me :-) that it is the
reason why the BCP 83 talks more about "A Practice for Revoking
Posting Rights" (procedure, delay, etc) than about a precise
definition of the reasons for being revoked.

Using RFC 3683 to stop someone to express unpopular views or to raise
annoying issues is a bad move, IMHO. I specially wonder what rule
could be applied to rms' posting. The only one I see is
"unprofessional commentary" which is never defined.
 
> if some-other-important-person sends a similarly offending message,
> then he too will get a warning, and if he does it a second time, he
> too will get at bcp83 timeout.

I'm not important so I assume the risk :-)

---

From: Andrew Newton <[email-masked]>
Date: Mon, 26 Jul 2004 08:29:50 -0400

> so patent-encumbered that it cannot be implemented or distributed.

The IETF is not a policy-making body nor a political party.  If it 
were, its technical work would be held as partisan and in far less 
regard.  So politics have little to do with the IETF.

> into account, forcing the issue to pop up again during the last call.

The NSEC issue is a case of ignoring requirements not making policy or 
political statements.  There is a large difference between saying "it 
is a requirement of MARID to adopt license X" vs. "Microsoft is using 
MARID to stop all free software the world over."

-andy

---

From: Richard Stallman <[email-masked]>
Date: Mon, 26 Jul 2004 10:30:24 -0400

The important issue here, the one that people's attention must focus
on, is to thwart the attempt to exclude free software operating
systems from full participation in email.

"Rule of law" is an admirable concept; it means that governments'
actions towards the public are limited by laws.  Would that the US
government followed this principle.  It is not applicable to the
present situation, both because we are not talking about limiting the
actions of a government, and because mere rules are not laws.

Since you mention laws, please note that even laws carry no automatic
moral authority; they have to earn it.  It is often morally justified
for individuals to break laws.  It wasn't wrong to get an abortion in
1960, or to flee to evade the draft, even though both were illegal in
the US.  It wasn't wrong for mixed-race couples to marry, or live
together, even though that was illegal too in some states.  Even the
law recognizes that breaking laws is justified, when necessary to
prevent something worse from happening.  If we were to misapply the
standards of laws to mere rules, this would be such a case if ever
there was one.

The members of the IETF surely cannot want petty matters to preclude
the thorough and proper consideration a potential serious problem that
would affect all of society.

Most of the technical questions a standards committee deals with are
purely technical; they make systems function better or worse in
various cases.  Finding the right decision in those questions is
purely a technical matter.

Not every technical question is purely technical in its consequences.
Some have social implications.  One of the lessons society learned
after some bad experiences in the 40s and 50s was that scientists and
engineers must take account of the social consequences of their work.
To bury one's head in engineering and ignore its impact is socially
irresponsible.

Surely no one will advocate that the IETF make its decisions in such a
manner.  Let us therefore make sure that this standard is not
restricted.