Subject: Re: [Asrg] where the message originated

From: Franck Martin <[email-masked]>
Date: Tue, 13 Jan 2009 11:15:30 +1200 (FJT)

I'm not sure that http://en.wikipedia.org/wiki/Sender_Signing_Policy has a correct definition? 

spamassassin, DNSBL, DCC are well known, so we know how they behave with different emails, what we don't know is what the google, yahoo, microsoft and others are doing to classify their emails (this is the part about security by obcurity). 

----- Original Message ----- 
From: "Robert Barclay" <[email-masked]> 
To: "Anti-Spam Research Group - IRTF" <[email-masked]> 
Sent: Tuesday, 13 January, 2009 10:37:52 AM (GMT+1200) Auto-Detected 
Subject: Re: [Asrg] where the message originated 

On Mon, Jan 12, 2009 at 1:51 PM, Franck Martin < [email-masked] > wrote: 

I'm curious when you say ADSP is always keyed of the real live From address? You talk about the From: and not the Mail From: (Return-path)? 
Yes, the A is for Author. ADSP is built on top of DKIM and allows domain owners to specify that they sign some or all mail using a specific domain in the From: address 

as a side note, all this SSP/ADSP processing looks like a blackbox (or black magic) to me. There is no recommended practices and no one explain what they do to filter mail. like in the statement "AOL will use DKIM to do build reputation based on domain", what does it mean? 

It means they are going to start establishing reputation for DKIM domains based on the DKIM signed mail passing through their systems. This isn't any more of a black box than their existing reputation systems. 
As for recommended practices I'm not sure there's enough operational experience is most situations to have anything useful to recommend yet. I would be pleased to be wrong here but suspect that we may be starting to get there for some uses of DKIM and are a long way away from that with ADSP. 

We know well about spamassassin, DNSBL, DCC but this is about it. I thought security by obscurity was a bad idea? ;) 

Not sure this qualifies for security by obscurity. It's pretty straightforward how all these technologies work. How people make use of the data these technologies provide, that only seems obscure because people are still figuring it out themselves. Compare this to how people use IP addresses there's a pretty wide variety there and a lot of those uses would qualify as "obscured" from outside users too. 

_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 13 Jan 2009 00:07:07 -0000

>I'm not sure that http://en.wikipedia.org/wiki/Sender_Signing_Policy has

If you're wondering what SSP/ADSP does, how about reading the draft
that actually defines it:

http://tools.ietf.org/html/draft-ietf-dkim-ssp-08

---

From: Dave CROCKER <[email-masked]>
Date: Mon, 12 Jan 2009 16:14:36 -0800

> that actually defines it:

john,

you simply have *no* sense of adventure...

RTFS (spec) is such an unimaginative approach to life.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: Franck Martin <[email-masked]>
Date: Tue, 13 Jan 2009 16:26:12 +1200 (FJT)

John,

It sounds like "read the code, luke!" ;)

I like to read wikipedia summaries of RFC, it gives me the essential points, but here I think I'm more lost than by reading the draft, I went to read the draft, but I think it would be helpful if someone could fix the wikipedia entry, so nayone can understand what is all about.

----- Original Message -----
From: "Dave CROCKER" <[email-masked]>
To: "Anti-Spam Research Group - IRTF" <[email-masked]>
Sent: Tuesday, 13 January, 2009 12:14:36 PM (GMT+1200) Auto-Detected
Subject: Re: [Asrg] where the message originated

john,

d/
-- 

   Dave Crocker

---

From: Robert Barclay <[email-masked]>
Date: Tue, 13 Jan 2009 10:31:41 -0700

> I'm not sure that http://en.wikipedia.org/wiki/Sender_Signing_Policy has a

I think what you're referring to is this statement "Instead of the
*From*header, ADSP can also be used for publishing that all mails of
the
*MAIL FROM*, *Sender*, *Resent-Sender* and *Resent-From* headers have a
corresponding DKIM <http://en.wikipedia.org/wiki/DKIM> signature." which as
far as I know is not correct. John, Dave, Steve can any of you guys verify
this? I admit some of the debates managed to throttle me into zombie-ism so
I may have missed something major somewhere.

>
>
> spamassassin, DNSBL, DCC are well known, so we know how they behave with
> different emails, what we don't know is what the google, yahoo, microsoft
> and others are doing to classify their emails (this is the part about
> security by obcurity).
>

First I think you're talking about a different issue than DKIM/ADSP here.
Your complaint appears to be that you don't know generally what the software
these guys use to evaluate email does or what they mean when they use the
term reputation. This isn't a new issue. It's just sort of the state of the
world and I would say it's not limited to these guys. In general unless
someone on the receiving end has told you specifically how they evaluate
emails then really all you can tell is (sometimes) whether the email got
there or not.

Second I think you're confusing knowledge of what data a piece of technology
provides you with knowledge of how people use that software. Knowing what
spamassassin does generally still doesn't give you anything better than a
guess at what that might mean to the systems of spamassassin users. In the
case of DKIM you at least know that two people running compliant software
will come to exactly the same decision on whether a piece of mail passes.
You just don't know what either of those people will do with that
information.
Since that's exactly the case now with every other piece of information
people extract from an email you're certainly not any worse off.

Robert

> On Mon, Jan 12, 2009 at 1:51 PM, Franck Martin <[email-masked]> wrote:
>
>> I'm curious when you say ADSP is always keyed of the real live From
>> address? You talk about the From: and not the Mail From: (Return-path)?
>
>  Yes, the A is for Author. ADSP is built on top of DKIM and allows domain
> owners to specify that they sign some or all mail using a specific domain in
> the From: address
>
>
>>
>>
>> as a side note, all this SSP/ADSP processing looks like a blackbox (or
>> black magic) to me. There is no recommended practices and no one explain
>> what they do to filter mail. like in the statement "AOL will use DKIM to do
>> build reputation based on domain", what does it mean?
>
>
> It means they are going to start establishing reputation for DKIM domains
> based on the DKIM signed mail passing through their systems. This isn't any
> more of a black box than their existing reputation systems.
> As for recommended practices I'm not sure there's enough operational
> experience is most situations to have anything useful to recommend yet. I
> would be pleased to be wrong here but suspect that we may be starting to get
> there for some uses of DKIM and are a long way away from that with ADSP.
>
>
>
>>
>>
>> We know well about spamassassin, DNSBL, DCC but this is about it. I
>> thought security by obscurity was a bad idea? ;)
>
>
> Not sure this qualifies for security by obscurity. It's pretty
> straightforward how all these technologies work. How people make use of the
> data these technologies provide, that only seems obscure because people are
> still figuring it out themselves. Compare this to how people use IP
> addresses there's a pretty wide variety there and a lot of those uses would
> qualify as "obscured" from outside users too.
>
>
>
>

---

From: John Levine <[email-masked]>
Date: 13 Jan 2009 20:47:16 -0000

>the >*MAIL FROM*, *Sender*, *Resent-Sender* and *Resent-From* headers have a
>far as I know is not correct.

Wow, is that wrong.  I'll see if I can fix it.

R's,
John

---

From: Robert Barclay <[email-masked]>
Date: Tue, 13 Jan 2009 13:52:52 -0700

Thanks for the confirmation. I was pretty sure that was the case but figured
someone with more expertise (like say one of the authors of the draft) would
let me know otherwise.

---

From: Dave CROCKER <[email-masked]>
Date: Tue, 13 Jan 2009 12:53:38 -0800

i modified the text this morning.

d/

-- 

   Dave Crocker

---

From: John Levine <[email-masked]>
Date: 13 Jan 2009 20:56:52 -0000

>Wow, is that wrong.  I'll see if I can fix it.

Looks like Dave already did.  Thanks.

R's,
John

---

From: Dave CROCKER <[email-masked]>
Date: Tue, 13 Jan 2009 13:03:01 -0800

I view the changes as a quick hack.

The section needs do its tutorial business more cleanly, explaining the purpose 
of ADSP and its means of accomplishing it.  I suggest that all references to 
other work be relegated to a separate section rather than, for example, showing 
up in the Introduction.

d/

-- 

   Dave Crocker