Subject: RE: The SSL license offer.

From: "Ryan Malayter" <[email-masked]>
Date: Thu, 2 Sep 2004 17:12:59 -0500

[wayne]
>Since I believe that there are unencumbered alternatives 
>to the PRA algorithm that are *better*, the cost of the 
>license would have to be negative.

Please share them... I haven't read all of the non-sender-ID MARID
drafts, and a lot of the list posts. The volume is just too high. 

What algorithm out there would be more effective than PRA at validating
the true sender of an email from the headers? And is not covered by the
MS IP?

Thanks,
	Ryan

---

From: "william(at)elan.net" <[email-masked]>
Date: Thu, 2 Sep 2004 16:04:15 -0700 (PDT)

Alternatives are in fact available, but those who know about it can not 
share it right now since WG chairs have requested that until last call is
completed that people on this list evaluate current drafts that are based
on Sender-ID proposal. And I believe we should respecct WG chairs and IETF
process if we want to produce solution that IETF will be able to adopt as 
standard, though what has been going on here for last week, really does 
not look anything close to "last call" and that is not good for this WG.
But be assured that SenderID algorithm and PRA is not the only DNS based 
client ip authorization system that can be used to authenticate email 
origin as listed in RFC2822 headers. 

However please do respect the hard work that has been done by all members 
of this WG (no matter what company they work for) for last several months
and evaluate the proposed drafts based on technical elements and not 
merely on the IPR issues. Besides, your technical evaluation may also 
proove quite usefull for any other future WG proposal as well.

> the true sender of an email from the headers? And is not covered by the

---
William Leibzon, Elan Networks:
 mailto: [email-masked]
Anti-Spam Research Worksite:
 http://www.elan.net/~william/asrg/

---

From: wayne <[email-masked]>
Date: Thu, 02 Sep 2004 18:53:51 -0500

In <[email-masked]> "william(at)elan.net" <[email-masked]> writes:

> on Sender-ID proposal.

I have given Ryan a short answer offlist, but this restriction on
discussing alternatives kind of puts us in a catch-22.

I can understand the reasons why the co-chairs don't want the extra
destractions, but RFC3669 talks about comparing with alternatives.  If
I discuss alternatives, I will get in trouble with the co-chairs.  If
I don't discuss the alternatives, people who have come in late to the
game will likely think that there is no choice but to accept SenderID.

-wayne

---

From: Andrew Newton <[email-masked]>
Date: Thu, 2 Sep 2004 20:16:32 -0400

> the true sender of an email from the headers? And is not covered by the

Wayne has been very politely obeying the wishes of the co-chairs not to 
wonder in that direction.  Do not hold it against him.  If you think 
the volume is high now, adding this to the mix will certainly not help. 
  Besides, at this moment I doubt such a conversation would end in 
agreement.

-andy