Subject: DOC-BUG: Terminology: Purported Responsible Address

From: Roy Badami <[email-masked]>
Date: Sat, 4 Sep 2004 18:55:22 +0100

As a result of a recent post by Harry Katz, I've come to the
conclusion that the term 'Purported Responsible Address' may be a
mistake, and perhaps should be modified.

In the case of a Sender ID checker, the term makes sense.  The
identity is only purported; we don't know yet if the message is
forged.

But we need a name for this concept that is applicable in other
contexts, too, including those where the implications of the word
'purported' are inappropriate, since the senders identity is known by
other means. (eg SASL)

Harry's objection to using PRA= instead of SUBMITTER= in the MAIL FROM
command is, as I understand it, that at this point the address isn't
purported, it's known.

I therefore suggest that the term Primary Responsible Address would be
more appropriate.

    -roy

---

From: <[email-masked]>
Date: Sat, 4 Sep 2004 17:01:32 -0400

> I therefore suggest that the term Primary Responsible Address would be

I think the term Primary would be unfortunate, because in a lot of
settings, the PRA doesn't really equate to people's intuitive notion
of primary address.  Right now it just happens to be the only one you
can verify with sender ID.

It the long run, I hope future standards bring us a way to verify not
just the preceding hop, but multiple hops going back to the original
sender.

For example, say [email-masked] sends mail to me at [email-masked], and
this forwards to [email-masked].  The mail will probably arrive at NYU
with a PRA of "[email-masked]" or similar.  However, in
some sense, the primary responsible address for this email is really
[email-masked].

While Sender ID alone won't let me verify [email-masked], in the future
I hope there will be some automatic way of saying, "I trust the ACM as
a forwarder, tell me who is really primarily responsible for the
mail."

Can we choose a name name that implies going back one hop, but not
necessarily to the "primary" address.  How about "Preceding
Responsible Address" or better "Previous Responsible Address."

David

---

From: Roy Badami <[email-masked]>
Date: Sat, 4 Sep 2004 22:07:16 +0100

>>>>> "mazieres" ==   <[email-masked]> writes:

    mazieres> I think the term Primary would be unfortunate, because
    mazieres> in a lot of settings, the PRA doesn't really equate to
    mazieres> people's intuitive notion of primary address.

Agreed; it was just the best I could come up with that kept the
acronym PRA (not that that's essential)

    mazieres> How about "Preceding Responsible Address" or better
    mazieres> "Previous Responsible Address."

I like both of those.

Ultimately it's just a name, and I don't _really_ care what it is.  I
can happily live with 'purported responsible address' as long as we
accept that it is simply the name for this identity, and not just a
term we use to refer to an (as yet unnamed) underlying concept when
we're unsure of its accuracy.

       -roy

---

From: Roy Badami <[email-masked]>
Date: Wed, 8 Sep 2004 00:47:08 +0100

>>>>> "Roy" == Roy Badami <[email-masked]> writes:

    Roy> In the case of a Sender ID checker, the term makes sense.
    Roy> The identity is only purported; we don't know yet if the
    Roy> message is forged.

Well, no one followed up on this, and on reflection I think maybe
"Purported Responsible Address" isn't such a bad term.

It doesn't seem particularly inappropriate even in contexts where the
message is know to be authentic.  A message always purports to be from
someone; in the case of an authentic mesasge the purported sender may
be known to be the same as the actual sender (and in the case of a
well-intentioned sender this will typically be the case).

So I withdraw my proposal; I think "Purported Responsible Address" is
fine; but it should be clear that this is just the name for the result
of the PRA algorithm, without any implications as to the accuracy (or
otherwise) of the identity.

	   -roy

---

From: <[email-masked]>
Date: Wed, 8 Sep 2004 02:43:08 -0400

> "Purported Responsible Address" isn't such a bad term.

Of course, we could also just call it the "Patented Responsible Address"...

David