text_combined: dave howorth vmcpafixmrclmbcamacuk roger oberholtzer wrote hello encountered unexpected problem nfs client opensuse 103 even root mount nfs share 100 system 103 client searched archives see problem seen reports mounts happening boot nonroot users able mount things experiencing mount two 103 systems two 100 systems 100 mount 103 system mounting 103 client system 100 server fails iirc defaults regards nfs version changed 103 2gb file size limit exceeded nfs 103 thread december may give clues cheers dave otsdcrockernet sat apr 26 154927 2008 message 5 date mon 25 feb 2008 143206 0800 dave crocker subject ietfdkim id actiondraftietfdkimdeployment01txt dkim ietf wg messageid 47c341e61050704dcrockernet contenttype textplain charsetiso88591 formatflowed pretty versions qfokcxikkhfhvqietforg wrote new internetdraft available online internetdrafts directories draft work item domain keys identified mail working group ietf title domainkeys identified mail dkim development deployment operations dave crocker brandenburg internetworking bbiwnet nplyattcom sat apr 26 154927 2008 message 6 date mon 25 feb 2008 172341 0500 tony hansen subject ietfdkim id actiondraftietfdkimoverview09txt gfkyhddlmipassocorg messageid 47c33fed2050605attcom contenttype textplain charsetiso88591 formatflowed reflects minor modifications since last version diff found visiting httptoolsietforghtmldraftietfdkimoverview clicking either diff1 diff2 tony hansen nplyattcom qfokcxikkhfhvqietforg wrote new internetdraft available online internetdrafts directories draft work item domain keys identified mail working group ietf title domainkeys identified mail dkim service overview nplyattcom sat apr 26 154927 2008 message 7 date mon 25 feb 2008 172547 0500 tony hansen subject ietfdkim id actiondraftietfdkimdeployment01txt qfokcxikkhfhvqietforg cc gfkyhddlmipassocorg moepzjuytjietforg messageid 47c3406b4090209attcom contenttype textplain charsetiso88591 formatflowed reflects minor modifications since last version diff found visiting httptoolsietforghtmldraftietfdkimdeployment clicking either diff1 diff2 tony hansen nplyattcom qfokcxikkhfhvqietforg wrote new internetdraft available online internetdrafts directories draft work item domain keys identified mail working group ietf title domainkeys identified mail dkim development deployment operations dyrbcmciscocom sat apr 26 154927 2008 message 8 date mon 25 feb 2008 153549 0800 jim fenton subject ietfdkim ssp02 problem author signature douglas otis cc dkim list messageid 47c350d590202ciscocom contenttype textplain charsetiso88591 formatflowed doug much appreciate personal appeal really rough consensus working group opinion matters understand correctly difference approach favor one favor follows approach favored doug check g tag key referenced valid signature present compare localpart address determine signature author signature approach b favored jim compare value valid signature default value address value localpart must match localpart address g tag key must matching localpart signature order signature valid approaches approximately equivalent case g tag value localpart signature approaches also equivalent difference appears g tag value contains localpart approach would consider author signature regardless localpart approach b would consider author signature localparts match rationale b allows domain apply signature representing author sharing domain havent gone details mailing list signing might work might times agent might want sign message explicitly author also require retention reretrieval key information evaluating whether something author signature understand rationale allows localpart used opaque tag representing revealing identity user agent signature applied response lots places opaque tag could put since local use particular domain done without interfering ability domain sign author jim douglas otis wrote jim cutoff approaches appeal reconsider agreement might found risks associated use g restricted keys signing messages identities found within header exists whether policy asserted g restricted key signifies signing restricted due limited trust words message signed keys may controlled domains signing practices whether policy records published aware risk associated localpart restricted keys requires presence restriction indicated dkim validation process risk accurately assessed risk related use g restricted keys change substantially domain also asserts sign messages domains asserting policy also likely cautious distribution localparty restricted keys limit weighing risk localpart restricted keys rare situations domains assert dkim policy otherwise use restricted localparts within header likely indicative messages attempting phish spam using keys purloined someones laptop seem fairly determined keep version author signature definition feel designed address concern fairly limited situations definition many cases prohibits use useragent specific information regarding token directly associated signatures without also implementing multiple signatures expecting verifiers guess identities picking higher header within message header stack unfortunate value dkim may curbing abuse depends substantial degree upon definition expressed within rfc 4871 parameter definition permits parameter serve token entity introducing message whose behalf signature added token enables simpler feedback reports defensive measures used receiving domains use multiple signatures wish specific sounds much like let eat cake statement represents excuse awkward erroneous definition overlooks intent rfc 4871 increased overhead complexity risk defence afforded meaningful tokens useragent affected value opaque matches nothing within message opaque value would compliant rfc 4871 identitys real value found token track sources within domain compromised systems whether token represents obscured machine person matter even identity changing every day still provides useful information dealing large domains blocking domain truly onerous addition author signature restatement definition parameter plain wrong one say parameter represents whose behalf signature added say identity must also represent emailaddresses found within header definition must wrong many cases dkim ensuring identity individual matches emailaddress contained message matching completely optional since dkim _not_ attempting replace smime openpgp reason dkim policies stipulate identities permitted represent onbehalfof entity recognizable identity offered dkim _domain_ author signature definition forces recipients guessing header might contain identity whose behalf signature added may happen compliant author signature definition signature remains ambiguous path least resistance guessing identities opens door spoofing especially multiple signatures added perhaps wrong order ironic dkim messages processed smtp transaction policy definition expecting use multiple signatures makes goal less obtainable definition causes signature processing overhead complex error prone less safe anyone using dkim naively thinking sign messages using rfc 4871 make dkim policy assertion sign messages rude awakening due definition author signature doug udcatmailabuseorg sat apr 26 154927 2008 message 9 date mon 25 feb 2008 174523 0800 douglas otis subject ietfdkim ssp02 problem author signature jim fenton cc dkim list messageid 314bd625634741b8858ceda2c07adc56mailabuseorg contenttype textplain charsetusascii formatflowed delspyes feb 25 2008 335 pm jim fenton wrote doug much appreciate personal appeal really rough consensus working group opinion matters jim thank feedback course consensus matters compatibility rfc 4871 ssp03 draft cause valid dkim signatures applied domain noncompliant ssp assertions happens parameter used indicate onbehalfof useragent identity represent emailaddress domains attempting clarify identities authenticated setting parameter prevented without applying multiple signatures leaving useragent identities ambiguous use multiple ambiguous signatures creates new risks understand correctly difference approach favor one favor follows approach favored doug check g tag key referenced valid signature present compare localpart address determine signature author signature g tag used untrustworthy systems key g tag restricts identity identity found within header even valid signature must considered unknown domain signing compliance matter whether domain makes policy assertions respect specific unusual case type signature must excluded considered compliant domain policy cause trust domain applied excluding restricted key signatures containing nonfrom header identity considered domain compliant domain signature domain header emailaddress require evaluation approach permits parameter _always_ represent useragent without identity even contained within message approach thus far compatible rfc 4871 approach b favored jim compare value valid signature default value address value localpart must match localpart address directly conflict rfc 4871s definition parameter g tag key must matching local part signature order signature valid approaches approximately equivalent case g tag value localpart signature approaches also equivalent difference appears g tag value contains localpart approach would consider author signature regardless localpart approach b would consider author signature localparts match overlooks exclusion evaluation process make approach b unknown domain signing compliance key g tag restricts identity identity found within header never notices unless policy evaluated makes approach b less safe less compatible rfc 4871 rationale b allows domain apply signature representing author sharing domain approach b may require ambiguous signature two overlapping signatures case single ambiguous signature identity useragent whose behalf signature added must guessed looking headers might exist header requiring two signatures may tend prevent session evaluations practical essence approach b requires possible removal information permitted rfc 4871 signature restoration information may necessitate second signature havent gone details mailing list signing might work might times agent might want sign message explicitly author also require retention reretrieval key information evaluating whether something author signature approach requires restricted keys nonfrom identities noted notation done regardless policy assertion approach beyond specific notation step domains signature email address play role signature compliance understand rationale allows local part used opaque tag representing revealing identity user agent signature applied exactly parameter _only_ identity currently defined upon verifier may employ defend abuse related compromised systems malicious users freedom use header address wish users freedom use emailaddress independent signing domains policy assertions response lots places opaque tag could put since local use particular domain done without interfering ability domain sign author approach b interferes ability identity agent user tags defined purpose defining yet another tag purpose needed compatibility rfc 4871 retained doug jim douglas otis wrote jim cutoff approaches appeal reconsider agreement might found risks associated use g restricted keys signing messages identities found within header exists whether policy asserted g restricted key signifies signing restricted due limited trust words message signed keys may controlled domains signing practices whether policy records published aware risk associated localpart restricted keys requires presence restriction indicated dkim validation process risk accurately assessed risk related use g restricted keys change substantially domain also asserts sign messages domains asserting policy also likely cautious distribution localparty restricted keys limit weighing risk localpart restricted keys rare situations domains assert dkim policy otherwise use restricted localparts within header likely indicative messages attempting phish spam using keys purloined someones laptop seem fairly determined keep version author signature definition feel designed address concern fairly limited situations definition many cases prohibits use useragent specific information regarding token directly associated signatures without also implementing multiple signatures expecting verifiers guess identities picking higher header within message header stack unfortunate value dkim may curbing abuse depends substantial degree upon definition expressed within rfc 4871 parameter definition permits parameter serve token entity introducing message whose behalf signature added token enables simpler feedback reports defensive measures used receiving domains use multiple signatures wish specific sounds much like let eat cake statement represents excuse awkward erroneous definition overlooks intent rfc 4871 increased overhead complexity risk defence afforded meaningful tokens useragent affected value opaque matches nothing within message opaque value would compliant rfc 4871 identitys real value found token track sources within domain compromised systems whether token represents obscured machine person matter even identity changing every day still provides useful information dealing large domains blocking domain truly onerous addition author signature restatement definition parameter plain wrong one say parameter represents whose behalf signature added say identity must also represent emailaddresses found within header definition must wrong many cases dkim ensuring identity individual matches emailaddress contained message matching completely optional since dkim _not_ attempting replace smime openpgp reason dkim policies stipulate identities permitted represent onbehalfof entity recognizable identity offered dkim _domain_ author signature definition forces recipients guessing header might contain identity whose behalf signature added may happen compliant author signature definition signature remains ambiguous path least resistance guessing identities opens door spoofing especially multiple signatures added perhaps wrong order ironic dkim messages processed smtp transaction policy definition expecting use multiple signatures makes goal less obtainable definition causes signature processing overhead complex error prone less safe anyone using dkim naively thinking sign messages using rfc 4871 make dkim policy assertion sign messages rude awakening due definition author signature doug _______________________________________________ note well list operates according wed 06 aug 2008 063856 0000 opensuse nfs opensuse 100 103