Subject: RE: [Asrg] 6. Proposals - CRI Draft - 4.1 Loop Avoidance

From: "Peter Kay" <[email-masked]>
Date: Fri, 3 Oct 2003 06:05:14 -1000

Clearly I'm confused and beg forgivness due to ignorance related to the
following questions:

Isn't CRI about getting various CR systems to interoperate?    

If something make sense for CR, how can it not make sense for CRI?

> The problem I have with the original sender's 
> email address is that I now have to inspect EVERY email 
> 821,822,and MIME to look for CRI headers. 

This statement confuses me even further. If CRI systems don't use the
original sender's email address, they DEFINITELY have to inspect every
email for CRI headers because they don't know if a given email is a
challenge or not. 

I submit to you that keeping the original sender's email address
SIGNIFICANTLY reduces overhead, because:
1. Challenge transmissions are ALWAYS a reactive step, (CRI draft, 2b)
2. This implies that the sender has already sent an email (CRI draft,
2a)
3. And if we ASSUME  that the original sender has automatically
whitelisted the recipient email address (a safe assumption)
4. Then a CRI system only needs to inspect email whose MAIL-FROM is
present on the whitelist, otherwise the CRI needs to inspect everything.

Please help me out of this black hole of cluelessness.

> 
> I would recommend that we either strike the statement or 
> leave as is. The problem I have with the original sender's 
> email address is that I now have to inspect EVERY email 
> 821,822,and MIME to look for CRI headers.  That sucks.
> 
> For CR, your statement makes sense...for CRI...it does not.
>  
> > "For CRI systems that issue challenge messages, it is also 
> recommended 
> > that each CRI system use the original sender's email address for
> issuing
> > challenges to reduce unecessary overhead."
> 
> 
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric Dean" <[email-masked]>
Date: Fri, 3 Oct 2003 12:18:32 -0400

> Isn't CRI about getting various CR systems to interoperate?

CR requires human intervention...CRI is automated.
 
> email for CRI headers because they don't know if a given email is a

Hmm...either way you have to inspect all headers.  I was thinking of
inspecting responses...but I still need to fully inspect 821,822,MIME
for challenges as well...unless there was a preemptive message by a CRI
challenging server requesting from the destination MX if they support
CRI...then the CRI message could go to a local system user rather than
the end-user...but that seems too complicated at this point.

However, I am thinking of a potential conflict whereby I may use CRI
client software via a CRI server...I need to think about this a bit
more...but if the CRI server uses my email address...then it may break
my client CRI software.

> whitelisted the recipient email address (a safe assumption)

This makes sense when a computer is not automatically responding...when
a human is involved...whitelists matter...when it's a computer
maintaining state on the human's behalf...whitelists don't come into
play

---

From: david nicol <[email-masked]>
Date: 03 Oct 2003 18:59:47 -0500

not if CR headers are only in initial headers instead of within MIME
blocks.

> Hmm...either way you have to inspect all headers

---

From: "Eric Dean" <[email-masked]>
Date: Fri, 3 Oct 2003 21:00:04 -0400

You mean within 821 headers?  Go ahead and send me CRI headers
there...see what my SMTP server does...also using 821 prevents the use
of multi-tiered SMTP architectures unless they all are CRI
compliant...won't happen.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
david
> nicol
> Sent: Friday, October 03, 2003 8:00 PM
> To: Eric Dean
> Cc: 'Peter Kay'; 'Yakov Shafranovich'; 'Kee Hinckley'; anti-spam
research
> group; 'Brad Knowles'
> Subject: RE: [Asrg] 6. Proposals - CRI Draft - 4.1 Loop Avoidance
> 
> 
>