Subject: RE: [ietf-dkim] SSP and mailing lists

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 12 Sep 2006 10:12:05 -0700

How about:

"I sign all email, and respectfully suggest that the risk of harm due to accepting unsigned email is greater than the risk of deleting all email transported through any body or signature altering gateways that cannot be otherwise authenticated"

I don't see mail forwarders as a real problem here. A mail forwarder relationship is by consent of the recipient or the mail should be tossed anyway. Since it is by consent of the recipient the mail forwarder is logically a part of the recipient mail infrastructure and the whole 'problem' of modified messages is irrelevant.

Again: we are building a spring here, not a mousetrap.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Stephen Farrell
> Sent: Monday, September 11, 2006 3:11 PM
> To: Thomas A. Fine
> Cc: [email-masked]
> Subject: Re: [ietf-dkim] SSP and mailing lists
> 
> 
> Hi Thomas,
> 
> This isn't really directed at you, but I've wondered each 
> time someone has said something like:
> 
> Thomas A. Fine wrote:
> > "I sign all email, and do NOT permit email through any body or 
> > signature altering gateways"
> 
> I've no idea how a sending domain could enforce the "do NOT permit"
> there. Neither in practice, nor in principle. Does anyone? 
> (This may just be my own ignorance of course, I don't claim 
> to be a mail
> expert.)
> 
> If its unenforceable, then I don't see why anyone would 
> bother making the statement.
> 
> Stephen.
> 
> _______________________________________________
> NOTE WELL: This list operates according to 
> http://mipassoc.org/dkim/ietf-list-rules.html
> 
> 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Hector Santos" <[email-masked]>
Date: Tue, 12 Sep 2006 13:37:14 -0400

----- Original Message -----
From: "Hallam-Baker, Phillip" <[email-masked]>

> How about:
>
> "I sign all email, and respectfully suggest that the risk
> of harm due to accepting unsigned email is greater than the
> risk of deleting all email transported through any body or
> signature altering gateways that cannot be otherwise
> authenticated"

That has always been the intepretation.  In short, SSP provides a hint to
the Receiver local policy decisions.

The odds are very high most systems running in such an environment will
honor the hint because they are not interested in dealing with junk anymore
than the domain would want any receiver to accept forged domain junk.

> Again: we are building a spring here, not a mousetrap.

A spring to what?  To Acceptance or Rejection?   An accelerator?

Sorry, but it gets a bit tiresome trying to blend in with clichés when we
all need to do is just say it like it is.

All of this email protection technologies proposed within the last 2-4 years
are exactly that - "Mouse Traps."

All of them are new prescribe new methods, some even patented, so that if
when one is followed, it is suppose to trap the dark dirty mouse who are not
following the new methods rules.  That might also include the white clean
mouse if he didn't follow the rules too.  C'est la vie.

The goal in these technologies is to hopefully make everyone follow the same
new rules.

DKIM is a new Mouse Trap, and if it doesn't work, some one will undoubtedly
proposed a better mouse trap tomorrow.

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com