Subject: Motion to abandon Sender ID

From: Jonathan Gardner <[email-masked]>
Date: Wed, 1 Sep 2004 15:31:36 -0700

I will argue here for abandoning Sender ID. I make some assumptions which 
could be refuted, but I believe that they are correct based on my 
experience. I encourage those who respond negatively to attack the 
particular points I am making and refute the facts I claim.

We already agree to the fact that most Open Source licenses, especially the 
GPL, are not compatible with the terms of the Sender ID license. However, 
additional software could be downloaded and installed on existing platforms 
to run with software that is licensed under incompatible terms. For 
instance, a sendmail milter, or a perl script to filter all mail, or any 
number of possibilities.

I would like to inform the chairs that the distribution of the technology in 
Linux and BSD distributions is critical for the widespread adoption of the 
technology among the open source community. Most people who use Linux or 
BSD do not add software to their installation. They expect everything to be 
tightly integrated together within the distribution. When software is 
released as part of the distribution, it shows that a certain amount of 
testing and work has gone into making it a part of the distribution. Adding 
additional software to an installation generally brings instability and 
requires additional resources. This is why people generally don't install 
additional software to their installation. Experience within the community 
shows that software that is not part of the major distributions is not 
considered standard, supporting this claim. Therefore, I claim it as a fact 
that software that is not distributed as part of the major distributions is 
not standard, and can never be a standard unless it finds a way to be 
included within the major distributions.

If Sender ID technology cannot be distributed under the same terms by which 
most Linux and BSD distributions are distributed, then to include it the 
terms of the distributions must be modified. I don't believe it will be 
possible to convince the major Linux and BSD distributors to comply with 
Microsoft's Sender ID License in order to integrate the Sender ID 
technology in the distribution. I claim it as a fact that the Linux and BSD 
distributors will not modify their distribution terms to satisfy the Sender 
ID license.

Therefore, since the terms of the license prevent it from being distributed 
under the terms of most Linux and BSD distributions, combined with the fact 
that changing the terms of distribution will not be possible, and combined 
with the fact that generally people don't include software on their 
machines that are not part of the distribution, the logical conclusion is 
that Sender ID will not be adopted as a standard by the open source 
community.

In short, Microsoft's License for patent claims made on Sender ID prevent it 
from being a standard in the open source sommunity.

Can we recommend a standard we know will not be a standard in the open 
source community? Open source software dominates the internet landscape, 
especially in the MTA realm. If the proposal cannot become a standard in 
the open source community, can it be a standard in the community as a 
whole? It cannot. Our efforts will be in vain unless we propose a standard 
that can be adopted by the open source community.

If Microsoft would like to propose a different license, or surrender their 
claims to unspecified IP in Sender ID, then I believe that Sender ID could 
become a standard in the open source community. However, Microsoft has very 
little time to propose a new license, and judging by past experience with 
their legal department, I don't think they will be able to do so within a 
reasonable time frame. Perhaps Microsoft will immediately surrender their 
patent claims, but I doubt that.

Therefore, I move that Sender ID be removed from the MARID recommendations 
because it can never be a standard in the open source community due to its 
licensing terms and the uncertainty of pending patent claims. In its place, 
we should recommend SPF version 1, or SPF "classic", as currently adopted 
and implemented by over 70,000 recorded domains.

- -- 
Jonathan M. Gardner

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 01 Sep 2004 19:28:32 -0400

> and implemented by over 70,000 recorded domains.

A few comments. First of all, we do not know whether the IPR claims 
extend to SPF classic or not. While the IPR disclosure does not mention 
the SPF draft, I have contacted Microsoft's legal department several 
times in the past 9 months to obtain a clear answer as to whether all of 
the drafts produced in the ASRG as input to MARID including RMX, SPF and 
others, are in fact covered or not covered. To date, I have not received 
an answer, and we have not heard directly from the legal department. 
However, it does happen often that IPR claims are submitted even after 
the standard is published as mentioned in RFC 3669, so SPF classic might 
not be any better than Sender-ID. Here is a copy of the email I sent and 
a reply I received:

> -------- Original Message --------
> Subject: RE: Caller ID license
> Date: Mon, 1 Mar 2004 15:58:00 -0800
> From: Dawna Hoerle (LCA)
> To: Yakov Shafranovich
> CC: Microsoft Standards Inquiries <[email-masked]>
> 
>  
> Thank you for your inquiry. I will route your request to the appropriate
> persons, who will respond to you as quickly as possible. 
> 
> Dawna
> -----Original Message-----
> From: Yakov Shafranovich 
> Sent: Monday, March 01, 2004 2:27 PM
> To: Microsoft Standards Inquiries
> Subject: Caller ID license
> 
> I co-chair the Anti-Spam Research Group (ASRG) of the IRTF
> (www.irtf.org/asrg/). My question is regarding the Caller ID proposal
> that Microsoft has recently published (www.microsoft.com/spam/). I want
> to know whether you are going to be claiming similar IP claims on the
> following IETF drafts:
> 
>     MTAMARK - draft-stumpf-dns-mtamark-01.txt
>     DRIP - draft-brand-drip-02.txt
>     RMX - draft-danisch-dns-rr-smtp-03.txt
>     DMP - draft-fecyk-dmp-01.txt
>     SPF - draft-mengwong-spf-00.txt
>     FSV - draft-levine-fsv-00.txt
> 
> Yakov

Second point - at this time Microsoft has no patent or any other IP 
relevant to this and is not forcing anyone to take out a license. 
Therefore, no license is required as of today. We are talking about a 
*possible* patent that *may be* approved in the future. As Microsoft 
states in their FAQ:

> Q4: When do you need to execute a license with Microsoft?
> A: At this time Microsoft is only aware of pending patent application claims that cover its
> submission of the Sender ID specification. Because Microsoft is not aware of any issued patent
> claims, Microsoft does not require any one to sign a license with Microsoft to implement the
> Sender ID specification or any part of it that is incorporated into IETF working drafts.

Third point - as others and I posted before, there is serious doubt as 
to whether this patent is actually valid or enforceble in light of 
possible prior art. As of today, this technology is not encumbered by 
any patents and may stay that away if the patent application is not 
approved. Additionally, it is feasible that at least some of the claims 
if not all are deriving from the discussions in the ASRG and other 
groups, and therefore may be complete frivilous. The IDN WG faced that 
situation before as described in RFC 3669 and chose to ignore the claims.

Yakov

---

From: <[email-masked]>
Date: Wed, 1 Sep 2004 20:18:06 -0400

On Wed, 01 Sep 2004 19:28:32 -0400, Yakov Shafranovich
<[email-masked]> wrote:
> extend to SPF classic or not.

You are correct that we don't know whether SPF or SPF2 is covered by
pending patent claims from Microsoft.  However, we *do* know that any
such claims are *not* covered by Microsoft's license agreement.  Thus,
even if we were to adopt Sender ID as the standard, should Microsoft
subsequently be granted a patent covering the SPF2 record format, it
would no longer be possible to deploy Sender ID without a new license
from Microsoft.

If, at this point, sender ID were derailed by a patent from Microsoft
over SPF, I think this would pretty clearly demonstrate bad faith on
Microsoft's part.  Since we have been instructed to assume good faith
on the part of all parties, I think this means operating under the
assumption that:

1) The pending patent rights granted by Microsoft's Sender ID
agreement are sufficient to deploy Sender ID (at least for the subset
of software authors who find the conditions of the agreement
acceptable), and therefore

2) Microsoft does not have any pending claims over the SPF record format.

So yes, anybody, even Microsoft, might have patent claims that might
prohibit just about any recommendation of the MARID working group. 
But we still have to make progress, and the best we can do is deal
with the most likely scenario, which is that Microsoft probably has
applied for patents, that the patents probably cover the portions of
Sender ID they have offered to license--namely the pra and or core
documents--and finally that until we have more information, none of
the MARID proposals is any more or less likely to be affected by
third-party patent holders.

David

---

From: George Mitchell <[email-masked]>
Date: Wed, 1 Sep 2004 18:22:09 -0700 (PDT)

> particular points I am making and refute the facts I claim.

I second Mr. Gardner's motion.                     -- George Mitchell

---

From: wayne <[email-masked]>
Date: Wed, 01 Sep 2004 21:13:57 -0500

In <[email-masked]> Yakov Shafranovich <[email-masked]> writes:

> relevant to this and is not forcing anyone to take out a
> license. Therefore, no license is required as of today. We are talking
> about a *possible* patent that *may be* approved in the future. As
> Microsoft states in their FAQ:

This just makes the SenderID license requirement a time bomb waiting
to go off.  For all I know, the patent was granted 5 minutes ago.

(I would address the other things that Yakov said, but
[email-masked] did a great job already.)

-wayne

---

From: "Harold A'Hole" <[email-masked]>
Date: Wed, 1 Sep 2004 19:47:07 -0700

> to go off.  For all I know, the patent was granted 5 minutes ago.

But the worst case is that you'd then need to fax in the license.  I'd bet
MSFT would be willing to allow software containing it to be distributed as
long as those who deploy it get a license.  And what would MSFT really do if
you didn't get a license?  I mean, would they really prosecute a user of an
international standard over IP that they freely give away to anybody who
sends in a fax (or I'd bet even signing online would be offered soon
enough) -- with the IP implemented in many SenderID implementations?

But there's also a chance that the IP claimed won't be patented for a long
time, if at all.

Harry

---

From: "Michael R. Brumm" <[email-masked]>
Date: Wed, 1 Sep 2004 21:39:32 -0600

>I second Mr. Gardner's motion.                     -- George Mitchell

I third Jonathan Gardner's motion. Not just because of Sender ID's license
and patent problems, but also due to Sender ID's various forged DSN
injection security problems. SPF "classic" (AFAIK) has none of these
problems, has had much greater testing and experimentation, and has several
working MTA implementations.

Michael R. Brumm

---

From: "Mark C. Langston" <[email-masked]>
Date: Wed, 1 Sep 2004 21:40:58 -0700

> to go off.  For all I know, the patent was granted 5 minutes ago.

it won't make any difference, but I had dinner tonight with a friend of
mine who's a partner in a fairly substantial and rather well-known IP
law firm.  I described the current situation to her, and the terms of
the MS license.  Granted, she hasn't read the actual license terms (I'm
going to send them to her later this evening), but she stated that,
given the circumstances of the license and the undisclosed claims, she
would advise against going forward with Sender ID.  Her wording was a
bit stronger than "advise against".

-- 
Mark C. Langston            GOSSiP Project          Sr. Unix SysAdmin
[email-masked]   http://sufficiently-advanced.net    [email-masked]
Systems & Network Admin      Distributed               SETI Institute
http://bitshift.org       E-mail Reputation       http://www.seti.org

---

From: "Michel Bouissou" <[email-masked]>
Date: Thu, 2 Sep 2004 07:37:09 +0200 (CEST)

Jonathan Gardner a écrit :
>
> Therefore, I move that Sender ID be removed from the MARID
> recommendations because it can never be a standard in the open source
> community due to its licensing terms and the uncertainty of pending
> patent claims. In its place, we should recommend SPF version 1, or SPF
> "classic", as currently adopted and implemented by over 70,000 recorded
> domains.

I strongly support this motion.

- -- 
Michel Bouissou <[email-masked]> OpenPGP ID 0xDDE8AC6E

chronophage : qui vous bouffe du temps

---

From: <[email-masked]>
Date: Thu, 2 Sep 2004 07:51:19 -0400

I also second the motion.

Terry Fielder
Manager Software Development and Deployment
Great Gulf Homes / Ashton Woods Homes
[email-masked] 
Fax: (416) 441-9085

> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of George Mitchell
> Sent: Wednesday, September 01, 2004 9:22 PM
> To: [email-masked]; [email-masked]
> Subject: Re: Motion to abandon Sender ID
> 
> 
>

---

From: Chip Mefford <[email-masked]>
Date: Thu, 02 Sep 2004 08:13:02 -0400

Yakov Shafranovich wrote:
|  there is serious doubt as
| to whether this patent is actually valid or enforceble in light of
| possible prior art. As of today, this technology is not encumbered by
| any patents and may stay that away if the patent application is not
| approved.

Maybe.

I'm not betting on it. There is a lot of vagueness in your statement.
Their lawyers are bigger than my lawyers.
No thanks.

---

From: Mark <[email-masked]>
Date: Thu, 02 Sep 2004 12:16:08 GMT

Jonathan Gardner wrote:

> patent claims.

> In its place, we should recommend SPF version 1, or
> SPF "classic", as currently adopted and implemented by over 70,000
> recorded domains.

I am very much in favor of this.

Perhaps MARID could further recommend the use of SUBMITTER/RFROM, in
conjunction with "classic" SPF, as an elegant alternative to using SRS1.

- Mark

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 2 Sep 2004 14:44:47 +0200

Interesting point, I agree with you.

And you gave me some inspiration:

Is it possible that this all was meant as an attack
against the Linux/GPL-World? That this was meant to 
undermine the GPL-based Linux distributions and to 
abuse a technology, which would surely be deployed
very fast and widely, everyone would have to use it, 
to piggyback some anti-GPL-antidote, to start softening
the pure-GPL world? 

Just a thought... 

regards
Hadmut

---

From: Kevin Peuhkurinen <[email-masked]>
Date: Thu, 02 Sep 2004 09:04:34 -0400

I concur.

It appears to me that the only thing that could save Sender-ID right now 
is if Microsoft immediately announces that they are dropping the 
licensing requirements and will donate their patent directly to the IETF 
or the FSF or some such.   Even a simple promise from them that they 
will revise their license isn't going to work; they've known for too 
long now about the problems with it and we have hearsay that MS Legal 
would rather let it die than back down on the provisions that make it 
hostile toward open source.

The notion that this WG can decide that Microsoft's pending patents will 
be invalidated by prior art and obviousness and therefore push the 
standard forward is mistaken.   Nobody is going to simply ignore MS's 
claims and their license on the basis of the opinion of the IETF.

I therefore recommend that the chairs elect to move ClassicSPF forward 
as an experimental standard and let Sender-ID die.   I would hope that 
if this is the case that Microsoft accepts the decision and backs the 
standard without attempting to assert any further IP rights over it or 
"embracing and extending" it.   Doing so would be graceful on their part 
and would go a long way in alleviating the deep misgivings that many 
techies and developers have about Microsoft.

Kevin Peuhkurinen

---

From: "Michel Bouissou" <[email-masked]>
Date: Thu, 2 Sep 2004 15:50:31 +0200 (CEST)

Kevin Peuhkurinen a écrit :
> as an experimental standard

Yes.

> and let Sender-ID die.

It is already dead and has been for long <BBG>. The only thing is that is
took some time for some folks to realize it.

I'm always amazed to see how hard and long is learning for some obvious
lessons...

---

From: "Guillaume Filion" <[email-masked]>
Date: Thu, 2 Sep 2004 10:02:07 -0400

"Jonathan Gardner" <[email-masked]> wrote:
> licensing terms and the uncertainty of pending patent claims.

I agree with the motion.

I still think that Sender-ID is technically superior to SPF classic, but as
Wayne said, it's a ticking bomb and I'm not willing to sit on it hoping that
it won't blow off. I'm not against proposing a "last" deadline to Microsoft
to come with a new license if it has a spirit similar to:
    We are going to trash Sender-ID on September 15th if Microsoft does
    not offer a license fully compatible with the major Open Source
licenses,
    including the GNU Public License, before that date."

> In its place,

I would rather go with SPF Unified (http://spf.pobox.com/unified/). In any
way, if we decide to trash Sender-ID, we'll clearly miss the deadline and we
should take the time to discuss and test an alternative solution. I'd rather
have an unencumbered final draft by Christmas than Sender-ID as it is right
now.

My 2 cents,
GFK's
-- 
Guillaume Filion, ing. jr
Logidac Tech., Beaumont, Québec, Canada - http://logidac.com/
PGP Key and more: http://guillaume.filion.org/

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 02 Sep 2004 11:07:02 -0400

> to piggyback some anti-GPL-antidote, to start softening

I am sure that we can come up with multiple conspiracy theories for 
this. For now, lets stay above the fray and assume that perhaps 
Microsoft was acting in good faith. Descending into conspiracy theories 
will not make this any better, and quite the opposite, will make the 
entire discussion appear unprofessional.

Microsoft knows what the issues are, they are receiving comments from 
multiple people and sources. The decision on  the license is upto them. 
The decision on the standard on the other hand is upto the us.

Yakov

---

From: "Jeremy T. Bouse" <[email-masked]>
Date: Thu, 2 Sep 2004 09:13:22 -0700

I would concur with this motion as well. I see no further point
in trying to continue with Sender-ID with it's licensing issue which
make it unusable with GPL or other OSS licenses. I think SPF classic can
be adopted and if needed modified to meet the goals of MARID without the
inclusion of Sender-ID.

	Regards,
	Jeremy

---

From: Jonathan Gardner <[email-masked]>
Date: Thu, 2 Sep 2004 10:59:40 -0700

> entire discussion appear unprofessional.

I agree. Let's leave the conspiracy theories for Slashdot. We shouldn't 
attribute to malice what can be attributed to ignorance, or in this case, 
inexperience with the open source community.

> The decision on the standard on the other hand is upto the us.

The only problem I see is time constraints. I doubt that Microsoft will be 
able to come up with a new license and still give us time to examine and 
debate it. That's why we should hold off on Sender ID until we get a 
license that will allow it to become a standard.

The other alternative is for Microsoft to abandon their pending patent 
application. I highly doubt Microsoft will do that, but that is their 
decision.

- -- 
Jonathan M. Gardner