qvcimnfiqkwxudxmipassocorg send ietfdkim mailing list submissions gfkyhddlmipassocorg subscribe unsubscribe via world wide web visit httpmipassocorgmailmanlistinfoietfdkim via email send message subject body help qvcimnfiqkwxudxmipassocorg reach person managing list qghtrnrqbhlpvmipassocorg replying please edit subject line specific contents ietfdkim digest todays topics 1 draftietfdkimssp02txt aspssp section 28 eric allman 2 draftietfdkimssp02txt aspssp section 28 hector santos 3 draftietfdkimssp02txt discardableexclusive douglas otis 4 draftietfdkimssp02txt aspssp section 28 j falk 5 draftietfdkimssp02txt aspssp section 28 eric allman 6 draftietfdkimssp02txt discardableexclusive eric allman 7 draftietfdkimssp02txt discardableexclusive steve atkins jbtlfzfgsendmailorg sun feb 24 102737 2008 message 1 date thu 07 feb 2008 165438 0800 eric allman subject ietfdkim draftietfdkimssp02txt aspssp section 28 hector santos cc dkim list messageid 02da2d6eb1065d7c54044f2crieuxneophiliccom contenttype textplain charsetusascii formatflowed hector say correct descriptions changes ssp02 dont match trying may well didnt get wording right yet first confession major changes 02 particular think pushed things onto jim went wanted think unfair ask jim defend things basically responsibility particularly apologize went major surgery time hitting fan im yet fully functioning theres certain philosophical difference folks list want ssp extremely specific others gone length ssp spec right authority impose receivers sympathies positions agree chance successfully dictate receivers operate ive said publicly many times receivers simply ignore specs makes lives better see today intentional violations rfc 2822 ssp02 attempt pare ssp appeal second set yes weakens ssp seems inevitable point particular im concerned without giving receivers guidance certain situations handled well end fairly chaotic state however agree guidance probably go nonstandardstrack document specific points message february 6 2008 14658 0500 hector santos wrote ssp02asp lost powerful ssp01 dkimall protection 3rd party fraud speaking ssp02 im sure see weve lost protection 01 dkimall specifically allowed 3ps thirdparty signatures arguably weaker ssp02 receiver could decide 3ps treated harshly harshly doesnt necessarily mean discard could mean content scanning message remove discussion 3ps extended list discussion around made clear dont enough operational knowledge time understand work leaving interpretation 3rd party signatures receiver doesnt mean weve necessarily lost ability handle 3ps distinct way go another document least never concept still covered using dkimdiscardable null dkim public key exclusive concept still covered using dkimdiscardable except discardable doesnt prohibit 3ps doesnt even say messages without signatures must even discarded says purported author domain views messages sends furthest goes say purported author domain encourages recipients discard anything related 3rd party signers completely eliminated ssp02asp even though ssp02 dkimall always sign 1st party authors concept basically dkimdiscardable without semantics rejection dkimdiscardable failures explicit rejection control dkimall failures ssp02 dkimall always sign 1st party authors concept doesnt even mention first parties mentions 3rd parties says message left control signed says absolutely nothing receiver handle message similarly noted dkimdiscardable makes normative assertions receiver message impossible say anything receiver reject messages without stepping forbidden territory forcing certain behavior receiver short dkimall spf version softfail record take rejection action like spf theres nothing prevents recipient rejecting messages dkimall condition fact intended normative language anywhere ssp02 receiver process messages signed unsigned 3ps case dkim 100 detectable fraud capabilities unrelated legitimate multiple hope ip issues asp mandating flawed inherent policy receivers ignore certain kinds obvious fraudulent messages im speaking asp ssp02 makes intended make normative restrictions receiver accept reject messages another addition ssp02 concept evaluator added purely try make clear ssp merely one input decision process evaluator decides whether reject message quarantine additional content scanning accept without scanning redirect fbi post usenet anything else cares hope creating explicit entity makes decision clearly declare scope would clarify limits ssp sincere hope quickly gain enough experience new documents produced providing guidance requirements evaluator interpret ssp broadest interoperability eric mwbfbflsantronicscom sun feb 24 102737 2008 message 2 date fri 08 feb 2008 062805 0500 hector santos subject ietfdkim draftietfdkimssp02txt aspssp section 28 eric allman cc dkim list messageid 47ac3cc53000407santronicscom contenttype textplain charsetiso88591 formatflowed eric sincerely appreciate response hope way full recovery surgery hip replacement years back first time long time forced prolonged vacation work long road road tuned nearly every stone discussed even worked remaining issues ones dont believe addressable best describe concerns lost potential protocol consistency fraud example pointed ssp01 dkimall offered 3rd party signatures could deemed weaker agree point however never indicated valid 3rd party ever classified secured lack one power concept found concept really nothing new compare fraud detection concepts things form another include smtp simple example traffic cop requesting analyzing driver license officer first going make sure attributes indicated card matches sees person driver 20 year old woman license says 60 year old man among thing compare raises red flag anything doesnt conform expectations always first thing people notice know basic model lots things smtp world excellent example port 25 relaxed smtp compliance versus port 587 strict smtp compliance requirements ie ehlo checking port 25 recognized low benefit many historical reasons port 587 ehlo correctness requirement expects two protocols short port 587 less tolerance towards legacy operations design must login must certain headers etc even standard smtp port 25 operations basic x822 header requirements systems may strict dont exist data block post smtp processing bcp dkimssp take control allow become yet another relaxed protocol power protocol inconsistency fraud detection things compliant things comes play really much dkimssp point layers may come play including reputation ideas anything else never argued reputation felt one group trying based dkimssp even given ssp concept chance unfortunately entire process commandeered appears strategic goal simply water level total uselessness idea evaluator would first fundamental protocol consistency evaluator would part dkimssp framework across supportivecompliant systems would 100 independent subjective heuristics reputation analysis one group detecting questionable inherent policies implementations methods really nothing good guys vs bad guys know bad guys exhibit compliant behavior want want make sure everyone bad good playing field following basic fundamental protocol like expect standard clientserver communications protocol want model cant expect compliance good cant expect bad allow dkimssp become would back square one relaxed smtp legacy transactions receivers lack enforcement know hows importantly new information rely beyond normal level operations consider dkimssp changes lead technology belief major benefit smtp industry going work standard protocol box must follow wish implement think separate extra evaluators ie reputations spamassassin etc start standard relaxed higher level system lost unique opportunity havent smtp thanks sincerely hector santos cto httpwwwsantronicscom httpsantronicsblogspotcom eric allman wrote hector say correct descriptions changes ssp02 dont match trying may well didnt get wording right yet first confession major changes 02 particular think pushed things onto jim went wanted think unfair ask jim defend things basically responsibility particularly apologize went major surgery time hitting fan im yet fully functioning theres certain philosophical difference folks list want ssp extremely specific others gone length ssp spec right authority impose receivers sympathies positions agree chance successfully dictate receivers operate ive said publicly many times receivers simply ignore specs makes lives better see today intentional violations rfc 2822 ssp02 attempt pare ssp appeal second set yes weakens ssp seems inevitable point particular im concerned without giving receivers guidance certain situations handled well end fairly chaotic state however agree guidance probably go nonstandardstrack document specific points message february 6 2008 14658 0500 hector santos wrote ssp02asp lost powerful ssp01 dkimall protection 3rd party fraud speaking ssp02 im sure see weve lost protection 01 dkimall specifically allowed 3ps thirdparty signatures arguably weaker ssp02 receiver could decide 3ps treated harshly harshly doesnt necessarily mean discard could mean content scanning message remove discussion 3ps extended list discussion around made clear dont enough operational knowledge time understand work leaving interpretation 3rd party signatures receiver doesnt mean weve necessarily lost ability handle 3ps distinct way go another document least never concept still covered using dkimdiscardable null dkim public key exclusive concept still covered using dkimdiscardable except discardable doesnt prohibit 3ps doesnt even say messages without signatures must even discarded says purported author domain views messages sends furthest goes say purported author domain encourages recipients discard anything related 3rd party signers completely eliminated ssp02asp even though ssp02 dkimall always sign 1st party authors concept basically dkimdiscardable without semantics rejection dkimdiscardable failures explicit rejection control dkimall failures ssp02 dkimall always sign 1st party authors concept doesnt even mention first parties mentions 3rd parties says message left control signed says absolutely nothing receiver handle message similarly noted dkimdiscardable makes normative assertions receiver message impossible say anything receiver reject messages without stepping forbidden territory forcing certain behavior receiver short dkimall spf version softfail record take rejection action like spf theres nothing prevents recipient rejecting messages dkimall condition fact intended normative language anywhere ssp02 receiver process messages signed unsigned 3ps case dkim 100 detectable fraud capabilities unrelated legitimate multiple hope ip issues asp mandating flawed inherent policy receivers ignore certain kinds obvious fraudulent messages im speaking asp ssp02 makes intended make normative restrictions receiver accept reject messages another addition ssp02 concept evaluator added purely try make clear ssp merely one input decision process evaluator decides whether reject message quarantine additional content scanning accept without scanning redirect fbi post usenet anything else cares hope creating explicit entity makes decision clearly declare scope would clarify limits ssp sincere hope quickly gain enough experience new documents produced providing guidance requirements evaluator interpret ssp broadest interoperability eric udcatmailabuseorg sun feb 24 102737 2008 message 3 date fri 8 feb 2008 095556 0800 douglas otis subject ietfdkim draftietfdkimssp02txt discardableexclusive eric allman cc dkim list messageid contenttype textplain charsetusascii formatflowed delspyes feb 7 2008 454 pm eric allman wrote exclusive concept still covered using dkimdiscardable except discardable doesnt prohibit 3ps doesnt even say messages without signatures must even discarded says purported author domain views messages sends furthest goes say purported author domain encourages recipients discard eric agreed changes strict exclusivity assertion something express domains intentions exclusivity assertion simply increases likelihood domains messages discarded previously mentioned motivation accommodate high profile domains finding victims phishing attacks using term discardable appears sending wrong message seems unlikely high profile domains want messages silently discarded assertion implies discarding messages several things destroys evidence serious crime reduces delivery integrity important transactional messages makes resolving compatibility far problematic see changing terminology attempt suggest verifier action going limb ill add modified furthermore statement frankly furthermore statement seems belong bcp happens later using hectors term exclusive exclusive mail domain signed intent avoid agents may damage remove signatures furthermore lieu trusted thirdparty signature message arrives without valid author signature due modification transit submission via path without access signing key reason domain encourages recipients reject message issue dsn rfc 2821 mailfrom domains match doug dupzypreturnpathnet sun feb 24 102737 2008 message 4 date fri 8 feb 2008 130114 0500 j falk subject ietfdkim draftietfdkimssp02txt aspssp section 28 dkim list messageid 8k3p2k4495405372skl3204q9f4g5d728klpg0rpnyex01rpcorplocal contenttype textplain charsetusascii eric wrote sincere hope quickly gain enough experience new documents produced providing guidance requirements evaluator interpret ssp broadest interoperability 1 jbtlfzfgsendmailorg sun feb 24 102737 2008 message 5 date fri 08 feb 2008 111515 0800 eric allman subject ietfdkim draftietfdkimssp02txt aspssp section 28 hector santos cc dkim list messageid 52069ca5adae4fde65b4e124rieuxneophiliccom contenttype textplain charsetusascii formatflowed hector admit im bit problem understanding everything saying response perhaps havent able get nearly 500 messages came recuperating finally concluded jump missing context thanks example smtp vs submit gives good handle mean relaxed protocol im understanding protocol consistency fraud think connected dont understand ssp02 makes easier vs ssp01 far aware ssp02 protocol weaker ssp01 weaker normative requirements receiver interprets protocol inevitable buy idea ssp right impose requirements receivers youre disagreeing premise fully understand case choose one go cant ways said position desirable may seem put requirements receiver order guarantee consistent results reality receivers whatever want order give best results customers hence saying normative requirements receivers mind bowing inevitable reality root eliminating concept 3rd party signatures relevant terms receiver interprets dkim results hence inappropriate discussion say things evaluator lead believe youve got different idea say idea evaluator would first fundamental protocol consistency evaluator would part dkimssp framework across supportivecompliant systems would 100 independent subjective heuristics reputation analysis one group detecting questionable inherent policies implementations methods inverse model head evaluator completely dependent subjective heuristics reputation analysis short receiver decides process message indeed point introducing concept attempt make explicit scope normative definition ssp spec im misunderstanding trying say possible apologize request explanation eric february 8 2008 62805 0500 hector santos wrote eric sincerely appreciate response hope way full recovery surgery hip replacement years back first time long time forced prolonged vacation work long road road tuned nearly every stone discussed even worked remaining issues ones dont believe addressable best describe concerns lost potential protocol consistency fraud example pointed ssp01 dkimall offered 3rd party signatures could deemed weaker agree point however never indicated valid 3rd party ever classified secured lack one power concept found concept really nothing new compare fraud detection concepts things form another include smtp simple example traffic cop requesting analyzing driver license officer first going make sure attributes indicated card matches sees person driver 20 year old woman license says 60 year old man among thing compare raises red flag anything doesnt conform expectations always first thing people notice know basic model lots things smtp world excellent example port 25 relaxed smtp compliance versus port 587 strict smtp compliance requirements ie ehlo checking port 25 recognized low benefit many historical reasons port 587 ehlo correctness requirement expects two protocols short port 587 less tolerance towards legacy operations design must login must certain headers etc even standard smtp port 25 operations basic x822 header requirements systems may strict dont exist data block post smtp processing bcp dkimssp take control allow become yet another relaxed protocol power protocol inconsistency fraud detection things compliant things comes play really much dkimssp point layers may come play including reputation ideas anything else never argued reputation felt one group trying based dkimssp even given ssp concept chance unfortunately entire process commandeered appears strategic goal simply water level total uselessness idea evaluator would first fundamental protocol consistency evaluator would part dkimssp framework across supportivecompliant systems would 100 independent subjective heuristics reputation analysis one group detecting questionable inherent policies implementations methods really nothing good guys vs bad guys know bad guys exhibit compliant behavior want want make sure everyone bad good playing field following basic fundamental protocol like expect standard clientserver communications protocol want model cant expect compliance good cant expect bad allow dkimssp become would back square one relaxed smtp legacy transactions receivers lack enforcement know hows importantly new information rely beyond normal level operations consider dkimssp changes lead technology belief major benefit smtp industry going work standard protocol box must follow wish implement think separate extra evaluators ie reputations spamassassin etc start standard relaxed higher level system lost unique opportunity havent smtp thanks jbtlfzfgsendmailorg sun feb 24 102737 2008 message 6 date fri 08 feb 2008 111815 0800 eric allman subject ietfdkim draftietfdkimssp02txt discardableexclusive douglas otis cc dkim list messageid 7b14bad2772a8428c49e37bcrieuxneophiliccom contenttype textplain charsetusascii formatflowed doug way married word discardable used ssp02 matched asp occurred weve spent far much time arguing exactly word use im deeply tempted switch numbers special characters random gibberish strings people read actual description eric february 8 2008 95556 0800 douglas otis wrote feb 7 2008 454 pm eric allman wrote exclusive concept still covered using dkimdiscardable except discardable doesnt prohibit 3ps doesnt even say messages without signatures must even discarded says purported author domain views messages sends furthest goes say purported author domain encourages recipients discard eric agreed changes strict exclusivity assertion something express domains intentions exclusivity assertion simply increases likelihood domains messages discarded previously mentioned motivation accommodate high profile domains finding victims phishing attacks using term discardable appears sending wrong message seems unlikely high profile domains want messages silently discarded assertion implies discarding messages several things destroys evidence serious crime reduces delivery integrity important transactional messages makes resolving compatibility far problematic see changing terminology attempt suggest verifier action going limb ill add modified furthermore statement frankly furthermore statement seems belong bcp happens later using hectors term exclusive exclusive mail domain signed intent avoid agents may damage remove signatures furthermore lieu trusted thirdparty signature message arrives without valid author signature due modification transit submission via path without access signing key reason domain encourages recipients reject message issue dsn rfc 2821 mailfrom domains match doug gsdszblightycom sun feb 24 102737 2008 message 7 date fri 8 feb 2008 112810 0800 steve atkins subject ietfdkim draftietfdkimssp02txt discardableexclusive dkim list messageid 60dc9dfb737b42f696e889cc6c03c603blightycom contenttype textplain charsetusascii formatflowed delspyes feb 8 2008 1118 eric allman wrote doug way married word discardable used ssp02 matched asp occurred weve spent far much time arguing exactly word use im deeply tempted switch numbers special characters random gibberish strings people read actual description assertion sender would prefer recipient deliver small fraction legitimate email well small fraction illegitimate email rather delivering small fractions legitimate illegitimate email senders opinion important mail claiming delivered delivered english meaning discardable matches semantics pretty well want implementors easily understand deploy specification importantly limits thats fairly important cheers steve _______________________________________________ note well list operates according end ietfdkim digest vol 106 issue 5 tue 05 aug 2008 160004 0800 ietfdkim digest vol 106 issue 5