Subject: [ietf-dkim] New issue: overview doc mentions signing policies, but leaves us hanging

From: "J D Falk" <[email-masked]>
Date: Tue, 18 Mar 2008 19:34:20 -0400

Suggested addition to third paragraph of section 2.2:

   An organization might build upon its use of DKIM by publishing
   information about its Signing Practices (SP).  This could permit
   detecting some messages that purport to be associated with a domain,
   but which are not.  As such, an SP can cause the trust assessment to
   be reduced, or leave it unchanged.  [As of the date of publication of
   this document, a standard method for publishing these Signing 
   Practices had not yet been finalized.]

--
J.D. Falk
Receiver Products
Return Path 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave Crocker <[email-masked]>
Date: Tue, 18 Mar 2008 21:04:59 -0700

JD,

My own view is that it's problematic to refer to what isn't, what is underway, 
or what might be.  It invites extraneous hassles, when there is no need. The one 
exception might be to constrain scope, such as is done in the list at the end of 
1.1.

Further, I think the agreement in the working group was to add more discussion 
about signing practices when they are approved by the IESG.

So I guess my question to you is:  Why?  What is the important benefit in adding 
this "nothing has been done yet" statement.  (Well, ok, maybe my choice of 
descriptive words is a bit strong, but at least there's no doubt about why I 
think it shouldn't be added...)

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "J D Falk" <[email-masked]>
Date: Wed, 19 Mar 2008 14:17:15 -0400

> My own view is that it's problematic to refer to what isn't, what is
> underway, or what might be.  It invites extraneous hassles, when there
> is no need. The one exception might be to constrain scope, such as is
> done in the list at the end of 1.1.

I was trying to read as if I wasn't a regular participant on ietf-dkim
-- in which case the obvious question, upon reading about signing
practices, is "wait, /how/ do I publish my practices?"

> Further, I think the agreement in the working group was to add more
> discussion about signing practices when they are approved by the IESG.

That works for me.

---

From: Dave Crocker <[email-masked]>
Date: Wed, 19 Mar 2008 17:04:36 -0700

> practices, is "wait, /how/ do I publish my practices?"

Unless I've missed something, I think this falls into the classic question of 
how to partition description of a larger system or service, versus specification 
of the component mechanisms in the system.

When ADSP is finished, we'll need to have an expanded discussion to answer the 
question you ask.  Separately, one could imagine a paper that discusses a larger 
"vision", beyond what has so far been standardized.  The Overview is trying to 
describe what is, not what could be.  A vision paper is free to wander all over 
among what is, could be, shouldn't be, whatever.

You ok with leaving this out of the current Overview paper, on these terms?

>> discussion about signing practices when they are approved by the IESG.

Absent objections, I'll take that as answering the question I asked immediately 
above...

Thanks.

d/

-- 

   Dave Crocker