Subject: [ietf-dkim] SSP Issues list

From: Stephen Farrell <[email-masked]>
Date: Mon, 10 Dec 2007 09:37:41 +0000

Hi All,

Eliot's updated the tracker [1] with all Dave's
new issues.

If anyone else has any SSP issues they'd like to
raise, now would be a good time. I'll chat a bit
with Barry and get back to the list with a plan
for processing these,

Regards,
Stephen.

[1]
https://rt.psg.com/Search/Results.html?Order=ASC&Query=Queue%20%3D%20'dkim'%20AND%20(Status%20%3D%20'open'%20OR%20Status%20%3D%20'new')&Rows=50&OrderBy=id&Page=1&Format=
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Mon, 10 Dec 2007 08:55:31 -0500

> with Barry and get back to the list with a plan

Hi Stephen,

Here's one that I hope will quickly eliminate a good portion of them:

NEW ISSUE:  Reputation is out of scope or define it.

Out of scope, undefined Reputation considerations continues to be the
prime source of diffusion, contention and conflicts in reaching a SSP WG
completion.  It has been abusing the SSP WG process.

Unless it is clearly defined what is meant by reputation and how it is 
related, I suggest that we remove all reputation considerations from SSP 
discussions or drafts and reinforce that it is out of scope.

If we wish to begin talking about reputation, then we need to begin to
defined it beyond its pure White/Black behavior which is already a
widely adopted industry practice and well understood to apply in local 
policy receiver decisions.

I don't believe SSP, nor DKIM-BASE nor any other technology XYZ will 
alter or replace local policy decisions.  However as part of the local 
policy decision process, I believe the SSP design goal was such that 
DKIM and SSP will be part of the total decision making process and to 
help protect against certain high potential exploitations of DKIM signers.

-- 
Sincerely

Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

---

From: "Frank Ellermann" <[email-masked]>
Date: Mon, 10 Dec 2007 16:25:24 +0100

Stephen Farrell wrote:

> raise, now would be a good time.

[FWS] within DNS records is just wrong.

 Frank

---

From: "J D Falk" <[email-masked]>
Date: Wed, 12 Dec 2007 20:48:32 -0500

> NEW ISSUE:  Reputation is out of scope or define it.

+1 for declaring it "out of scope."

> alter or replace local policy decisions.

Yep.  But if a reasonable person who hasn't been involved in the SSP
arguments reads the draft and immediately concludes that it /does/ alter
or replace their local policy decisions, they'll grumble and stop
reading and get back to doing real work.

So, my suggestion would be to mention that any decision about whether to
accept, reject, or print out and chew on a particular message is left
entirely to the verifier -- and may involve external sources of
information.  (This latter portion is to forestall the inevitable
accusation that DKIM does nothing to prevent spam.)

---

From: Eliot Lear <[email-masked]>
Date: Thu, 13 Dec 2007 15:00:16 +0100

Hector,
> NEW ISSUE:  Reputation is out of scope or define it.

As a point of information, "reputation" is mentioned precisely once in
the SSP specification, and that is to say that it is out of scope.
[...]
> related, I suggest that we remove all reputation considerations from
> SSP discussions or drafts and reinforce that it is out of scope.

See above.  Also, I think I don't see anything unreasonable about people
attempting to place SSP within a broader context on a mailing list, so
long as the work doesn't normatively depend on it.

> help protect against certain high potential exploitations of DKIM

On this I agree but I don't understand its relevance to the issue at hand.

Eliot