Subject: [ietf-dkim] Processing SSP issues in January using jabber/concalls....

From: Stephen Farrell <[email-masked]>
Date: Tue, 11 Dec 2007 15:37:25 +0000

Hi All,

I just spoke with Barry on the phone and we'd like to
schedule a set of concalls & jabber sessions so that
we can progress the SSP issues from the tracker.

As before, all conclusions reached will have to be
confirmed on the list.

We're looking at scheduling 1 hour calls each Thursday
in Jan (i.e. 3rd, 10th, 17th, 24th and 31st) at 1700 UTC.

We'll want a scribe for each session so that people who can
only connect to the jabber room can follow what's going
on and so we can use the logs to produce meeting minutes.

Cisco (thanks Eliot) have agreed to setup the calls
and can support local dial-in numbers in a range of
countries.

So, if you're interested in this, can you send me
(offlist, I'll summarise back to the list) answers
to the following by December 19th.

- I <<do/don't>> want to participate in these sessions
- I <<can/cannot>> participate on those dates
- I will call in from <<country>>
- I <<can/cannot>> use jabber
- I <<can/cannot>> act as jabber scribe for some of the
  sessions
- I would prefer if the calls were on <<day>> at <<time&TZ>>
  or <<day>> at <<time&TZ>>... (a list is fine here)

Thanks,
Stephen.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave Crocker <[email-masked]>
Date: Tue, 11 Dec 2007 08:09:20 -0800

Stephen Farrell wrote:
> schedule a set of concalls & jabber sessions 
...
> in Jan (i.e. 3rd, 10th, 17th, 24th and 31st) at 1700 UTC.

When will a session end?

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 11 Dec 2007 16:25:33 +0000

>> in Jan (i.e. 3rd, 10th, 17th, 24th and 31st) at 1700 UTC.

Sorry, I meant one hour sessions, so ending at 1800 UTC.

Last time, some people thought longer sessions were
good, we can see as we go,

S.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 11 Dec 2007 08:49:05 -0800

> in Jan (i.e. 3rd, 10th, 17th, 24th and 31st) at 1700 UTC.

<http://www.ietf.org/IESG/STATEMENTS/Interim-meetings.txt>
imposes some requirements on this.

d/

-- 

   Dave Crocker

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 11 Dec 2007 17:03:00 +0000

> imposes some requirements on this.

Yes. I've let the ADs know.

Only place we're a bit off is the 30 day notice period.
If we want to be strict about that then I guess we can
push the dates further forward, but if everyone's ok with
starting early in the new year, then I think we should be
ok. Given that we successfully used this modus operandi
before I'd hope the ADs are ok with it.

We'll see what they say.

S.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 11 Dec 2007 09:11:08 -0800

> starting early in the new year, then I think we should be

Who is the 'everyone' that you are relying on to vet the decision to do a 
variance?

d/

-- 

   Dave Crocker

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 11 Dec 2007 17:17:53 +0000

Dave Crocker wrote:
> Who is the 'everyone' that you are relying on to vet the decision to do
> a variance?

I'm assuming the people subscribed here and the ADs.

Say if you think we should be doing something else (in which
case a suggestion would be appreciated).

Thanks,
S.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 11 Dec 2007 09:35:47 -0800

> I'm assuming the people subscribed here and the ADs.

For a working group that has repeatedly received complaints about being 
exclusive, it would make sense to be particularly careful to follow procedures 
that encourage participation.  Sufficient advanced notice seems a natural part 
of that.

d/
-- 

   Dave Crocker

---

From: Michael Thomas <[email-masked]>
Date: Tue, 11 Dec 2007 09:36:28 -0800

> case a suggestion would be appreciated).

Well I for one think that many of these issues can be resolved
on the list. For example, I don't see much if any support for
changing the valid first party signature consensus from rfc 5016,
and I've seen a whole lot of -1's.

		Mike

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 11 Dec 2007 12:46:11 -0500

On Tuesday 11 December 2007 12:35, Dave Crocker wrote:
> exclusive, it would make sense to be particularly careful to follow
> procedures that encourage participation.  Sufficient advanced notice seems
> a natural part of that.
>
> d/

I'm not aware of any such complaints.  Would you please provide references for 
this assertion?

Scott K

---

From: <[email-masked]>
Date: Tue, 11 Dec 2007 12:49:47 -0500

Such complaints would naturally be offlist from non or part time
participants at industry meetings, commercial contacts and other venues
Thanks, 

Bill Oxley
Messaging Engineer
Cox Communications

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Scott Kitterman
Sent: Tuesday, December 11, 2007 12:46 PM
To: [email-masked]
Subject: Re: [ietf-dkim] Processing SSP issues inJanuary using
jabber/concalls....

> procedures that encourage participation.  Sufficient advanced notice
seems

I'm not aware of any such complaints.  Would you please provide
references for 
this assertion?

Scott K

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 11 Dec 2007 12:57:14 -0500

> participants at industry meetings, commercial contacts and other venues

So complaints from people who can't be bothered to subscribe to a mailing list 
and send a message should control how we run the group?

Personally, I'm not aware of any such complaints and I think in an open entity 
such as the IETF, secret complaints should get no weight.

Scott K

---

From: "Frank Ellermann" <[email-masked]>
Date: Tue, 11 Dec 2007 19:08:35 +0100

Michael Thomas wrote:

> I don't see much if any support for changing the valid 
> first party signature consensus from rfc 5016, and I've
> seen a whole lot of -1's.

I've seen a bunch of objections against the redefinition
of originator (i.e. more than Dave+me+Dave+me+Dave+me ;-)

Maybe a poll could help to get a clearer picture of your
"a whole lot of" and my "a bunch of".  If the Chairs like
the idea, Harald sometimes uses polls, but it's a matter
of taste.

 Frank

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 11 Dec 2007 18:19:28 +0000

Dave Crocker wrote:
> ...Sufficient advanced notice
> seems a natural part of that.

Just for information, we had the same issue when we used jabber
before (in March 2006) and the IESG were ok with not insisting
on the 30 day rule then. We'll see what the ADs say.

S.

---

From: Michael Thomas <[email-masked]>
Date: Tue, 11 Dec 2007 10:21:09 -0800

> the idea, Harald sometimes uses polls, but it's a matter

I'm all for that if it puts an(other) end to many of these.

	Mike

---

From: Dave Crocker <[email-masked]>
Date: Tue, 11 Dec 2007 10:27:39 -0800

> on the 30 day rule then. We'll see what the ADs say.

I guess my question is why you felt the need to post this, Stephen?

d.

-- 

   Dave Crocker

---

From: Dave Crocker <[email-masked]>
Date: Tue, 11 Dec 2007 10:30:31 -0800

> I'm all for that if it puts an(other) end to many of these.

Let's be clear:

    SSP is re-defining Originator, as compared with the established definition 
in RFC822/RFC2822.

    What I am trying to do is to avoid this conflict by having SSP use a 
different term that is constrained to the much narrower meaning that SSP needs.

d/

-- 

   Dave Crocker

---

From: Douglas Otis <[email-masked]>
Date: Tue, 11 Dec 2007 10:38:16 -0800

On Dec 11, 2007, at 9:36 AM, Michael Thomas wrote:
>
> Well I for one think that many of these issues can be resolved on  
> the list. For example, I don't see much if any support for changing  
> the valid first party signature consensus from rfc 5016, and I've  

Definitions used in SSP should not be limited to only those found in  
RFC5016.  This is important when following such definitions disrupt  
email services, and creates a series of false-positive detections of a  
non-existent misbehaviour.

RFC5016:
,---
|3.1. Problem Scenario 1: Is All Mail Signed with DKIM?
|
|After auditing their outgoing mail and deploying DKIM signing for all
|of their legitimate outgoing mail, a domain could be said to be DKIM
|signing complete.  That is, the domain has, to the best of its
|ability, ensured that all legitimate mail purporting to have come
|from that domain contains a valid DKIM signature.
'---

The description of the problem does not lead to only the From being  
signed "on-behalf-of" as per the definition found for a first party  
signature.  A first party signature is only one of many possible valid  
signatures being added by by a domain.  Limiting the consideration of  
valid signatures to only those "on-behalf-of" the From domain is  
clearly a mistake.

A domain that adds a signature to a message where the Sender header is  
indicated as being signed "on-behalf-of" while the signing domain is  
also valid for the From would be an indication of what type of  
misbehaviour?  What problem is prevented by requiring all signatures  
be signed "on-behalf-of" the From header?  Such a requirement will  
mean the signing domain is REQUIRED to lie about which header the  
message is being signed "on-behalf-of".  Twisted logic based upon a  
requirement for "on-behalf-of" From (first-party) breaks messages  
signed per DKIM base and does not prevent any abuse not already within  
the control of the signing domain. The only possible exception would  
be for restricted keys.

-Doug

---

From: Dave Crocker <[email-masked]>
Date: Tue, 11 Dec 2007 10:43:37 -0800

Stephen Farrell wrote:
> (Sigh.) For information. In the past, with this WG, the IESG
> were ok with us not strictly adhering to the 30-day notice
> requirement, i.e. they then considered that we were giving
> sufficient notice.
> 
> IMO we've thrashed this one enough.

Perhaps you missed the fact that you didn't answer my question, Stephen.

I didn't ask you to repeat the information that you had just supplied.  I 
asked why you chose to post it.

Saying "for information" doesn't answer the question.

Since you had already indicated you were querying the ADs, what was the 
purpose of responding to my note with a claim that precedent had already been 
established, particularly after I had noted why I thought the issue was 
sensitive now?

d/

ps. interesting that engineering precedents don't seem important to you, but 
process ones do.

ps. And thanks for the (sigh).  Very helpful.

-- 

   Dave Crocker

---

From: Barry Leiba <[email-masked]>
Date: Tue, 11 Dec 2007 14:28:15 -0500

> Who is the 'everyone' that you are relying on to vet the decision to do 

I should point out that we're off by ONE DAY on the 30-day notice issue.
If you think we should toss out the 9 Jan session on that basis, OK, we 
will.

Barry Leiba, DKIM working group chair
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave Crocker <[email-masked]>
Date: Tue, 11 Dec 2007 11:46:05 -0800

> If you think we should toss out the 9 Jan session on that basis, OK, we 

I'm lousy at arithmetic, but I think Jan 3 is short by about a week.

I wouldn't have posted the concern for a day, although that quickly after New 
Years could be a more general issue.

d/

-- 

   Dave Crocker

---

From: Jon Callas <[email-masked]>
Date: Tue, 11 Dec 2007 11:51:21 -0800

> and I've seen a whole lot of -1's.

I agree with Mike. I think we can handle it on-list.

	Jon

---

From: John Levine <[email-masked]>
Date: 11 Dec 2007 20:45:45 -0000

If we're taking objections, the 3rd and 30th are no good for me due
to travel.

R's,
John

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 11 Dec 2007 18:36:55 +0000

S.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 11 Dec 2007 18:38:49 +0000

Michael Thomas wrote:
> Frank Ellermann wrote:
>> Michael Thomas wrote:
>>
>>> I don't see much if any support for changing the valid first party
>>> signature consensus from rfc 5016, and I've

I've no problem with polling on some of the issues, but given
the traffic in recent days, I think we should wait a while to
give folks a chance to catch up with the list.

S.

---

From: Barry Leiba <[email-masked]>
Date: Wed, 12 Dec 2007 11:27:02 -0500

> If you think we should toss out the 9 Jan session on that basis, OK, we 

Um, as y'all've noticed, my brain said "9 Jan", though Stephen said "3 
Jan".  So, yes, we're short a week, not a day, on the 30-day notice.

Still, the rest of what I said stands:  If any participants, or the ADs, 
think that 23 days' notice isn't sufficient, or that 3 Jan is too close 
to the new year, we can lose that one and start on 10 Jan.

Dave, it's not clear whether you actually object to it, or whether 
you're just concerned that others might have a problem with it, and are 
noting that it's not standard procedure.

Scott Kitterman said:
 > Personally, I'm not aware of any such complaints and I think in
 > an open entity such as the IETF, secret complaints should get no
 > weight.

Well, for better or worse, there are often reasons not to make 
complaints public, and we do consider them, at least at the early 
stages.  I personally think that's for the better.  Eventually, if the 
complaint is overruled and the plaintiff wants to appeal that decision, 
s/he will have to go public.  But we digress....

---

From: Dave Crocker <[email-masked]>
Date: Wed, 12 Dec 2007 08:45:03 -0800

> noting that it's not standard procedure.

I see these two points choices are compatible.

While a complete answer would prompt us to wander into much larger issues, 
let's leave it at:

    Before we declare a requirement for a conference call effort, we should 
pursue attempting to resolve Issues on the list, in order to assure both the 
widest possible participation and better time for contemplation.  Real-time 
exchanges are useful when folks largely or completely understand issues. 
Because they take place over a long time, lists are better for contemplation 
and for offlist (hallway) discussion.

    Since a number of the Issues involve conceptual points, I believe the 
group needs to first use the more deliberative mode of discussion.

    Please do note that I did say "widest possible participation".  Although 
formally open participation, and not nearly as restrictive as a face to face 
meeting, a conference call does serve to limit participation.  The logistical 
issues unavoidably act as a filter.

d/

-- 

   Dave Crocker

---

From: Jim Fenton <[email-masked]>
Date: Thu, 13 Dec 2007 00:21:03 -0800

Dave Crocker wrote:
>> you're just concerned that others might have a problem with it, and
>> are noting that it's not standard procedure.
>
> While a complete answer would prompt us to wander into much larger
> issues, let's leave it at:
>
>    Before we declare a requirement for a conference call effort, we
> should pursue attempting to resolve Issues on the list, in order to
> assure both the widest possible participation and better time for
> contemplation.  Real-time exchanges are useful when folks largely or
> completely understand issues. Because they take place over a long
> time, lists are better for contemplation and for offlist (hallway)
> discussion.
>
>    Since a number of the Issues involve conceptual points, I believe
> the group needs to first use the more deliberative mode of discussion.
>
>    Please do note that I did say "widest possible participation". 
> Although formally open participation, and not nearly as restrictive as
> a face to face meeting, a conference call does serve to limit
> participation.  The logistical issues unavoidably act as a filter.

Barry,

I suggest we follow the process to the letter.  If that means that we
need to start later in January, so be it.

-Jim