Subject: Re: [Asrg] 4. Consent Framework - General

From: "John Fenley" <[email-masked]>
Date: Fri, 29 Aug 2003 13:11:02 -0600

From: "Bart Schaefer" <[email-masked]>

>How would Choicelist or a similar scheme handle mailing lists that use
>VERPs?  Specifically those where the VERP token is regenerated at every
>list delivery and hence differs even for the same recipient?  (I believe
>Yahoo! Groups has this behavior, for example, though I haven't checked
>recently.)

Just to clarify, were you talking about Variable Envelope Return Paths?
That is a dilema. On the one hand that sort of dynamic address creation has 
valid uses, but on the other hand that makes it impossible to verify each 
address (a requirement for creation of a choicelist entry).

In this sort of special case it may be necisary to add a Choicelist header 
pointing an entry with a wildcard description of the sending addresses that 
will be used (without a header address based lookup might fail), as well as 
a mandatory authentication mechanism (without authentication a header would 
allow anyone to specify unsecured ids). Then there would have to be some 
sort of proof that the person creating the entry was authorised to use all 
of those addresses.

I personaly would not want that proof to be anything less than a notarized 
statement detailing the wild-carding system and signed by the owner of the 
domain to be used. If there are hundreds or thousands of different VERP 
senders at a single domain it could get tricky and complicated, but in that 
case the notarized page could detail an address to use to verify wildcarded 
sender descriptions.

eg.. sender "[email-masked] should be verified by sending an 
email to [email-masked]

So while this is a problem, i don't see it as insurmountable. Automated 
systems can be created to interpret these addresses, and with verified 
wildcard descriptions mail of this sort could be protected.
The only tough thing would be handling, verifying, and incorporating all the 
notarized pages into the entry creation system.

I can see it already:
"please select an authorized wildcard type from the list for that domain"

John Fenley

_________________________________________________________________
Get MSN 8 and enjoy automatic e-mail virus protection.    
http://join.msn.com/?page=features/virus

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Sat, 30 Aug 2003 17:12:51 -0400

On Fri, Aug 29, 2003 at 01:11:02PM -0600, John Fenley wrote
> sort of proof that the person creating the entry was authorised to use all 

  I use an ISP whose blocking occurs after RCPT:, but before DATA:.
This precludes the use of X-Headers.  I whitelist the rDNS of the
sending MTA.  For instance, I subscribe to a Yahoo mailing list.  The
line...

PIACCEPTTAIL grp.scd.yahoo.com

in my ruleset accepts email from machines whose rDNS ends in the string
grp.scd.yahoo.com

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did