Subject: Re: clarification on consensus call for compromise

From: Danny Angus <[email-masked]>
Date: Fri, 10 Sep 2004 09:21:17 +0100

> Under such a system, it would be up to the zone maintainer to determine
> which scopes to provide data on.
> It would be up to the MTA running
> the check to determine which checks to run.

Sadly this doesn't promote interoperability in any practical way, it is
only half a proposal.
If everyone can participate in a basic mandatory scope then
life-in-the-wild can evolve new scopes.

> No single scope would
> be mandatory to provide or check;

I think that one unencumbered scope should be mandatory.

d.

***************************************************************************
The information in this e-mail is confidential and for use by the addressee(s) only. If you are not the intended recipient (or responsible for delivery of the message to the intended recipient) please notify us immediately on 0141 306 2050 and delete the message from your computer. You may not copy or forward it or use or disclose its contents to any other person. As Internet communications are capable of data corruption Student Loans Company Limited does not accept any  responsibility for changes made to this message after it was sent. For this reason it may be inappropriate to rely on advice or opinions contained in an e-mail without obtaining written confirmation of it. Neither Student Loans Company Limited or the sender accepts any liability or responsibility for viruses as it is your responsibility to scan attachments (if any). Opinions and views expressed in this e-mail are those of the sender and may not reflect the opinions and views of The Student Loans Company Limi!
 ted.

This footnote also confirms that this email message has been swept for the presence of computer viruses.

**************************************************************************

---

From: Benjamin Franz <[email-masked]>
Date: Fri, 10 Sep 2004 06:47:06 -0700 (PDT)

On Fri, 10 Sep 2004, Danny Angus wrote:
> Andrew Newton wrote:
> >
> > No single scope would be mandatory to provide or check;
>

I concur. Trying to slide PRA around the non-consensus wall by making it 
one of several optional scopes is not a good answer. There needs to be at 
least one unencumbered mandatory scope so that deployment does not 
degenerate into non-interoperable closed source 'PRA supporters' and F/OSS 
based 'SPF supporters' camps. Which is precisely what will happen if 
passed along in this form.

-- 
Benjamin Franz

---

From: "Michel Bouissou" <[email-masked]>
Date: Fri, 10 Sep 2004 16:28:28 +0200 (CEST)

> passed along in this form.

I agree with this. For the time being, only non-encumbered
scopes/algorithms should be considered for validation by MARID, and the
modular structure that allows adding future scopes/algorithm is good for
we can later consider adding currently encumbered algorithms/scopes in the
event that they become non-encumbered.

But the "modular" approach must not serve as an excuse for approving
"among other possibilities" a scope/algorithm for which a massive number
of WG participants (read : a clear majority) have expressed that they
disapprove of because of the IPR encumbrance issue.

-- 
Michel Bouissou <[email-masked]> OpenPGP ID 0xDDE8AC6E

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 10 Sep 2004 11:06:45 -0400

> disapprove of because of the IPR encumbrance issue.

What about the scope idea itself? Do you agree with it?

Yakov

---

From: "Michel Bouissou" <[email-masked]>
Date: Fri, 10 Sep 2004 17:33:00 +0200 (CEST)

> What about the scope idea itself? Do you agree with it?

Well, I must admit that I haven't have much time to spend thinking of this
issue since it has been raised, but there are a number of reasons that
make me feel quite uncomfortable with it :

It seems to me to be in contradiction with the "keep it simple, stupid"
paradigm. We have to take into consideration that these protocols are
being discussed and designed by e-mail experts, but will have to be used
by "average-skill" sysadmins, and the procotol should avoid to create
unnecessary complexities that would cause one to wonder what can be the
differences between a 2821 or a 2822 scope on a practical standpoint, what
differences it may cause in the system behaviour depending upon which kind
of scope they want to publish in their records, or check in their MTA.

The current SPF system record syntax is "a bit" complex, but yet
straightforward enough to allow easy understanding. I'm afraid that if we
have to add different scopes, and possibly different DNS records for a
domain depending on the scopes, it may create complexity beyond the
average sysadmin's understanding (or will to spend the necessary time for
understanding and testing different possibilities).

I'm also not sure that possibly multiplying DNS records for different
scopes would be such a good idea, as it will, again, add complexity in DNS
maintenance (and possibly multiply queries, cause TCP answers and add to
DNS load).

Lats but not least, I'm afraid that this could result in a mess, with the
sender publishing records for one given scope, where the recipient MTA
would be configured to check only for another scope, which would result in
no checks being performed.
The more complex we make it, the more chances we have to find ourselves in
situations that may product "unpredictable results" between unrelated
sending and receiving domains.

Since the beginning, I feel that the "good" solution IMHO for the first
MARID protocol, especially if we want to get something usable and deployed
in the shortest possible timeframe, would be to go for SPF-Classic
accompanied with SRS. And stick to it. Simple, that already has running
implementations and a wide real-world deployment.

I have also expressed here in the past that I feel that MARID should limit
itself to checking existing 2821-stage fields (which means MAIL FROM: and
HELO:) and leave alone the emails contents (2822 headers being "content").

Anyway this is just my personal opinion, regardless of other IPR issues.

 Qui peut m'expliquer comment fonctionne le fusible thermique sur les
 processeurs. Est ce que cela peut se configurer ?
 -+- DA in : <http://neuneu.mine.nu> : Neuneu pète un plomb -+-

---

From: "Michael R. Brumm" <[email-masked]>
Date: Fri, 10 Sep 2004 15:21:09 -0600

I agree with everything said here by Michel Bouissou. He saved me a lot of
typing by addressing every issue in the same way I would have.

I can see the utility in allowing multiple scopes, but I would prefer that
MARID define a "universal" scope which provides the foundation for
additional scopes.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Michel Bouissou
Sent: Friday, September 10, 2004 09:33 AM
To: [email-masked]
Subject: Re: clarification on consensus call for compromise

---

From: Mark Lentczner <[email-masked]>
Date: Fri, 10 Sep 2004 14:53:57 -0700

There has been quite a bit of discussion here about either removing 
scopes or allowing some sort of universal or wildcard scope.

I would not support such a concept because it lessens the strength of 
what a domain is saying by publishing records.  In particular, if a 
domain were to publish (making up a syntax...):

	example.com. IN A SPF2 "spf2.0/* +mx +a -all"

We have to wonder what this record says.  It authorizes a set of hosts 
to use the domain "example.com" as part of which identities in mail?  
All of them?  Including identities that we haven't named a scope for 
yet?

I certainly wouldn't publish such a record for my domain, as I don't 
know what I'm making such an assertion about.  While I might be willing 
to believe that the "+mx" and "+a" directives are going to be 
reasonable for any such identity (after all, the reference machines I 
presumably have control of), I can't make such a statement about 
"-all".  I don't know that there might be some notion of identity, as 
yet undefined, for which I'd need to include other hosts.

While other site owners might be willing to take such risks and publish 
such records, the ability to do so lesses the effectiveness for the 
whole scheme.  If domains are able to make claims like "We didn't know 
about that identity check when we published "spf2.0/*" - you can't ding 
our reputation based on that check." or " - you can't reject mail that 
doesn't pass", it means that the whole scheme is diminished.

In short, when we say "domains authorized the use of identity X by 
publishing an SPF record" we do so because we are going to hold them 
accountable if the authorization passes, and reject if it fails.  And 
for those actions to have any force, the declaration of authorization 
has to be incontestable.

	- Mark

Mark Lentczner
http://www.ozonehouse.com/mark/
[email-masked]

---

From: "Michael R. Brumm" <[email-masked]>
Date: Fri, 10 Sep 2004 17:01:47 -0600

> scopes or allowing some sort of universal or wildcard scope.

I'd like to clarify the terminology a little, just to make sure we are
talking about the same thing:

- universal/mandatory scope: A scope which is mandatory, universally
understood, and required for MARID compliant implementation. Basically, a
foundation scope which all domains must publish and MTAs must evaluate under
MARID.

- wildcard scopes/no scopes: A way of saying the MARID record applies to all
MARID scopes. (your made up example: "spf2.0/* +mx +a -all")

From the rest of your message, I am guessing that you are against wildcard
scopes, but not universal scopes?

If so, I would agree: I am against wildcard scopes. I would also say that
I'm for at least one universal/mandatory scope.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Mark Lentczner
Sent: Friday, September 10, 2004 03:54 PM
To: IETF MARID WG
Subject: Re: clarification on consensus call for compromise

	- Mark

Mark Lentczner

---

From: David Woodhouse <[email-masked]>
Date: Sat, 11 Sep 2004 00:19:59 +0100

On Fri, 2004-09-10 at 14:53 -0700, Mark Lentczner wrote:
>  I can't make such a statement about 

To cite an example: in today's world, you need to include other hosts
for both RFC2821 reverse-path and RFC2822 identities. 

> whole scheme. 

Indeed they might be willing to do that, and indeed it does lessen the
effectiveness of the whole scheme.

>  If domains are able to make claims like "We didn't know 

It does indeed mean that the whole scheme is diminished.

> for those actions to have any force, the declaration of authorization 

I agree.

-- 
dwmw2