Subject: In support of SenderID

From: "Craig Taylor" <[email-masked]>
Date: Thu, 2 Sep 2004 14:09:09 -0700

It might be worth bringing back into the discussion that the standard
consists of 4 parts.  The framework (core) and the SPF record definition
provides benefits for everyone and we should encourage their adoption by
the IETF.  The PRA algorithm is one of many schemes that receivers might
choose to authenticate a sender.  Receivers can decide what
authentication schemes work and are reasonable to license.  The PRA
algorithm is specifically targeted at phishing.  If Microsoft changes
the rules of the game for the PRA, receivers can and will move to a new
scheme. Yahoo's domainkeys attack the same problem with a solution that
is ultimately better but requires more effort to deploy.  SenderID is a
good first step, it is the core and the record definitions that will out
live the individual authentication schemes that use them.  If people
feel the core is too encumbered then we might need to restart with the
original work done by Meng and Mark.  It would be unfortunate if we
can't use the current momentum.
 
At Ironport we support 5 out of the top 10 ISP and many of the F500.
These companies want additional layers of defense.  We will support our
customers and implement some kind of receiver side authentication, based
on SPF records.  SenderID is just a first step, Meng has proposed a
unified SPF where the PRA is just one of the authentication schemes in
the stack.
 
Getting the framework and the record type standardized should be the
focus of the working group.  As both Philip Hallam-Baker and Yakov
Shafranovich have eloquently discussed, the larger philosophical issues
should be debate in a broader community forum.
 
Craig Taylor
VP, Technology
Ironport System

---

From: "Mark C. Langston" <[email-masked]>
Date: Thu, 2 Sep 2004 14:18:39 -0700

> should be debate in a broader community forum.

Then let's approve just -core and -protocol and ditch the PRA document.
Since Microsoft's IPR is supposedly only for the combo of -core AND
-submitter, there should be no encumbrance on -core or -protocol in
isolation.

I'd be fine with that.

...unless the argument then becomees that -core and/or -protocol may
also be encumbered, at which point I say scrap them all and start over
with SPF-Classic.

-- 
Mark C. Langston            GOSSiP Project          Sr. Unix SysAdmin
[email-masked]   http://sufficiently-advanced.net    [email-masked]
Systems & Network Admin      Distributed               SETI Institute
http://bitshift.org       E-mail Reputation       http://www.seti.org

---

From: Paul Iadonisi <[email-masked]>
Date: Thu, 02 Sep 2004 17:36:50 -0400

On Thu, 2004-09-02 at 17:09, Craig Taylor wrote:

[snip]
 
>   As both Philip Hallam-Baker and Yakov Shafranovich have eloquently
> discussed, the larger philosophical issues should be debate in a
> broader community forum.

  Disagree with this final statement, but only insofar as it implies
that it *shouldn't* be discussed here.  Yes, those larger issues should
be discussed in a broader community forum, but we have a problem here:
this WG is in its last call stage.  These issues need to be discussed
here at least with respect to how they relate to these proposals and the
IPR problems embedded in them.
  And given that last call is only two weeks, I have to believe that if
the co-chairs haven't put a stop to this discussion by now, (with the
period more than half over), then they have spoken simply by their
silence.  The co-chairs have put a stop to this type of discussion
earlier, but now that we are in last call, I've seen no such postings
from them asking that the discussion be taken elsewhere.
--
-Paul Iadonisi
 Senior System Administrator
 Red Hat Certified Engineer / Local Linux Lobbyist
 Ever see a penguin fly?  --  Try Linux.
 GPL all the way: Sell services, don't lease secrets