From: ietf [mailto:ietf-bounces@xxxxxxxx]
On Behalf Of Murray S. Kucherawy On Sat, Apr 12, 2014 at 4:35 PM, <ned+ietf@xxxxxxxxxxxxxxxxx> wrote:
Something's amiss here. What new semantics does DKIM attach to From:? As far as I know, it only requires that the field be signed. It doesn't require that it be interpreted in a particular way or that it contain any particular value.
Yes, that's useful advice for a future revision.
It's the same document that was posted on other web sites for some time, and was in use by a number of operators (including Yahoo) long before it went into the datatracker. As it's only a draft, there's ample opportunity to make such improvements. Also: By "the IETF published a draft", are you talking about an RFC, or the DMARC base draft? It seems extreme to lay blame on the IETF in general merely for having an open mechanism by which to post a draft for all to see and discuss.
A "Request For Comment", as it were. Are you suggesting that process should be closed or moderated somehow?
MH: I’m going to disagree with your statement about insufficient attention Ned. I’ve been reviewing the discussions from the DKIM working group at that time
(early 2008) and there was in fact quite a bit of attention given to the issue in the context of SSP and the discussion got quite heated. One such discussion at that time was “RE: [ietf-dkim] Re: ISSUE 1521 -- Limit the application of SSP tounsigned messages”.
One position in that discussion was that mail lists could be trusted and therefore should supercede any policy assertions by domain owners made through SSP (which name was changed at my suggestion because the standard represented domain policy assertions and
not individual sender assertions). The discussion of mail lists in the context of email authentication has been exhaustive (both literally and figuratively) on multiple occasions and in multiple places for some time frame approaching a decade if not longer.
As with any draft, its content is only as good as its contributions and the reviews it got. MH: The reality is that there was a compromise to get ADSP set and out the door with the understanding that once there was some experience running in the wild
“we” would circle back and remediate identified issues. It was a bad compromise and there were even some that stated at the time, the compromise was intended to kill ADSP. If I had it to do over again I would be more resistant to compromise regarding the MLM
issue even if it had meant ADSP not getting out the door.
I would add to this that, by its ultimate inaction in the face of a protracted period of abuse and attempts by participants to solve that problem within its procedures, the IETF has abdicated any authority it may have had. MH: I’m not sure I would go this far but I think it reflects concerns held by many.
I certainly agree with that. MH: First there needs to be a consensus as to what “this” is before there can be an attempt to address “this”.
|