Subject: DEPLOY: microsoft SenderID wizard seriously flawed, unusable

From: Koen Martens <[email-masked]>
Date: Thu, 9 Sep 2004 08:48:23 +0200

All,

Microsoft has sponsored a 'wizard' to create SPF records, it's online
here:

http://www.anti-spamtools.org/SenderIDEmailPolicyTool/Default.aspx

However, the wizard is seriously flawed. For example, it suggests you to
enter ip adresses to be used with the a mechanism, producing for example:

v=spf2.0/pra a:1.2.3.4 ~all

this obviously should be 

v=spf2.0/pra ip4:1.2.3.4 ~all

There are further flaws in the programming. Surely, microsoft
programmers are not _this_ stupid, so I cannot understand otherwise than
this is a deliberate stalling move to frustrate development of SenderID. 

This wizard should be taken off-line immediatelly! It should not come
back online until after all the bugs have been fixed. This wizard is bad
for deployment, making people publish bad records.

Koen Martens

-- 
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

---

From: AccuSpam <[email-masked]>
Date: Thu, 09 Sep 2004 15:29:10 +0800

Is this perhaps the first example of "embrace and extend"?, as I have warned:

http://www.imc.org/ietf-mxcomp/mail-archive/msg04536.html

As I have written twice already today in spf-discuss, IMHO we need structural validation feedback written into the spec to prevent other de facto standards from monopolies:

AccuSpam wrote:
>Again I want to re-iterate my opinion that there needs to be some structural 
>enforcement/incentive for validation in the spec, else spf syntax errors 
>have no incentive to be fixed.  (unlike for a web page) If the e-mail still gets through, and since 
>we know that most senders are not currently experiencing problems from 
>forgery, and since recipients have no incentive to notify the sender of 
>error, (then sender is not aware and thus) I see structural incentive is currently to encourage proliferation of 
>errors (or de facto extensions).

For example, possibly the spec could ask errors to be reported to "postmaster@domain".

---

From: Mark <[email-masked]>
Date: Thu, 09 Sep 2004 07:11:44 GMT

Koen Martens wrote:

> However, the wizard is seriously flawed. For example, it suggests you
> to enter ip adresses to be used with the a mechanism, producing for
> example: 
> 
> There are further flaws in the programming.

Here is another:

http://archives.listbox.com/[email-masked]/200409/0263.html

- Mark

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 09 Sep 2004 09:55:55 -0400

> for deployment, making people publish bad records.

A quick WHOIS check determines that the domain belongs to "Aditi 
Technologies" which is an outsourcing company in India.

Yakov

---

From: Koen Martens <[email-masked]>
Date: Thu, 9 Sep 2004 16:55:31 +0200

On Thu, Sep 09, 2004 at 09:55:55AM -0400, Yakov Shafranovich wrote:
>	[....]

A quick glance at the web-site determines that the site is sponsored by microsoft. Why is microsoft sponsoring a wizard that creates invalid spf records? If microsoft is not indeed sponsoring this site, why has the 'sponsored by microsoft' banner up there for months now?

Koen

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 09 Sep 2004 11:00:00 -0400

Koen Martens wrote:

>>> Microsoft has sponsored a 'wizard' to create SPF records, it's
>>> online here:
>>> 
>>> However, the wizard is seriously flawed. For example, it suggests
>>> you to enter ip adresses to be used with the a mechanism,
>>> producing for example:
>> 
>> 
>> [....]
>> 
> A quick glance at the web-site determines that the site is sponsored
> by microsoft. Why is microsoft sponsoring a wizard that creates
> invalid spf records? If microsoft is not indeed sponsoring this site,
> why has the 'sponsored by microsoft' banner up there for months now?

It sounds like they outsourced the work to India and the outsources 
botched it up. I don't see any malicious intent here, simply lack of 
foresight. But we can always ask Jim and Harry...

Yakov