Subject: RE: So here it is one year later...

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 31 Jan 2005 12:02:51 -0800

> [mailto:[email-masked]] On Behalf Of wayne

> Despite asking several times on the MASS mailing list, I have 
> yet to see any data on the false positive rates for DK, IIM, 
> William's DK-IIM merged system, CSV, or SES.  So far, all 
> I've seen is people claiming that their systems work better 
> than SPF, with no data to back it up. (Often, there is data 
> to back up the claim that SPF has false positives, but we 
> *do* know that.)

They certainly work better in certain circumstances, but at this point I
would not want to publish any data because I don't know how typical those
circumstances and in any case the issue is irrelevant.

DK and SPF have different failure modes. I don't think this is a competition
situation. A system with both schemes is much more effective than either on
its own.

Sure if we started from scratch we would only have one auth scheme. We are
retrofitting a legacy system so expect some pain and duplicated effort.

Both systems can do much better if we present them as a coherent integrated
plan than if we make the mistake of having a standards war. If you think
that is a good idea then Jon Callas and I can tell you just how great the
PGP/SMIME standards war was for both of our companies.

	Phill

---

From: wayne <[email-masked]>
Date: Mon, 31 Jan 2005 14:53:01 -0600

In <[email-masked]> "Hallam-Baker, Phillip" <[email-masked]> writes:

>> William's DK-IIM merged system, CSV, or SES.  [...]
>

I can certainly believe this.

> situation. A system with both schemes is much more effective than either on

I completely, 100% agree and I can not emphisized this enough.  I see
things like SPF and crypto systems as complementary systems, not
competing systems.  I'm sorry I forgot to mention that.

-wayne

---

From: "Hector Santos" <[email-masked]>
Date: Mon, 31 Jan 2005 16:42:54 -0500

----- Original Message -----
From: "wayne" <[email-masked]>
To: "IETF MARID WG" <[email-masked]>
Sent: Monday, January 31, 2005 3:53 PM
Subject: Re: So here it is one year later...

> competing systems.  I'm sorry I forgot to mention that.

Vendors with a suite of solutions know this already.  No one system is good
enough, especially if its all half-baked into a legacy SMTP system.

We made our system "hook" ready at each state of the SMTP state machine.
That way, if someone invents something new tomorrow, its plug in plug.

MARID should of focused on the generic security aspect of the transport
system rather than just to force one or more of the half-based,
semi-proprietary proposals down our throats.

Sincerely,

Hector Santos, CTO
Santronics Software, Inc.
http://www.santronics.com
305-431-2846 Cell
305-248-3204 Office

---

From: "william(at)elan.net" <[email-masked]>
Date: Mon, 31 Jan 2005 14:22:59 -0800 (PST)

On Mon, 31 Jan 2005, wayne wrote:

> > DK and SPF have different failure modes. I don't think this is a 
> > competition situation. A system with both schemes is much more 
> > effective than either on its own.
> 

The are complimentary but they work and protect different parts of email
message. That means each one must be able to work on its own independant 
of the other one and authentication should work properly on each layer.
You can not have failure scenario of one system being depdending on the
authentication in another layer - this is just a bad security architecture.

That means if we want to use SPF and mail signatures for anything other 
then whitelisting (i.e. to get rid of actual bad messages and find bad
senders), we must find ways to deal with SPF forwarding problems on the 
SMTP session layer and must have MASS signatures that work with mail lists. 

-- 
William Leibzon
Elan Networks
[email-masked]