Subject: Re: [ietf-dkim] Consensus points on "errata" draft from the IETF 74 meeting

From: DKIM Chair <[email-masked]>
Date: Fri, 03 Apr 2009 18:30:14 -0400

> 1. On the content, we hashed out a few things that needed tweaking, and Dave
> has  already posted about these.  The response looks good.

The chairs note that Dave's proposed changes have rough consensus.  We understand 
that Dave has a new draft with the current version of those changes ready to go. 
Since the changes have already been agreed to, we think we do not need an 
explicit Working Group Last Call on it.

Dave, please post that, and we'll send it up to Pasi early next week (when I have 
time to do a PROTO writeup on it).  The delay will also give the WG a few days to 
give it a final check.

Barry

--
Barry Leiba, DKIM working group chair  ([email-masked])
http://internetmessagingtechnology.org/

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave CROCKER <[email-masked]>
Date: Fri, 03 Apr 2009 17:58:28 -0700

DKIM Chair wrote:
> Dave, please post that, 

done.

assorted formats, as well as a diff for the new version, are at:

    <http://dkim.org/ietf-dkim.htm#errata>

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Fri, 3 Apr 2009 18:00:11 -0700

On Apr 3, 2009, at 3:30 PM, DKIM Chair wrote:

>> 1. On the content, we hashed out a few things that needed tweaking,  
>> and Dave has  already posted about these.  The response looks good.
>
> The chairs note that Dave's proposed changes have rough consensus.   
> We understand that Dave has a new draft with the current version of  
> those changes ready to go. Since the changes have already been  
> agreed to, we think we do not need an explicit Working Group Last  
> Call on it.

Is this an errata?  What is the rush?  Why prevent the WG from  
commenting on finalized changes?  It is not clear what now represents  
"agreement" or "consensus".  Excluding any WG input might be overly  
optimistic.

> Dave, please post that, and we'll send it up to Pasi early next week  
> (when I have time to do a PROTO writeup on it).  The delay will also  
> give the WG a few days to give it a final check.

-Doug

---

From: Barry Leiba <[email-masked]>
Date: Fri, 3 Apr 2009 22:54:02 -0400

> "agreement" or "consensus".  Excluding any WG input might be overly

This is the "errata" draft, renamed to "Update" and processed as an
RFC, as we decided in the IETF 74 meeting.  The new text has all been
agreed to on this list over the last week, in the three sub-threads
that Dave started... which is why we only need a brief check to make
sure they're OK.  We're not excluding anything.

Barry

---

From: Hector Santos <[email-masked]>
Date: Sat, 04 Apr 2009 14:04:23 -0400

> "agreement" or "consensus".  Excluding any WG input might be overly  

Its called Consensus by Osmosis. There is just too much so drama here. :-)

Anyway, FWIW, I have one nit regarding the original message submitter

                    ------------------
   6.  RFC4871 Section 2.9 Signing Domain Identifier (SDID)

   A single domain name that is the mandatory payload output of DKIM
   and that refers to the identity claiming responsibility for
   introduction of a message into the mail stream.
                    ------------------

The SDID is not necessarily the identity for introducing a message 
into a mail system.  An AUTHOR can introduce/submit a message and 
unbeknownst to him during the router/relay process, it may sign it, 
resign it, or not.  The process is not the originating submitter.

Suggestion:  Add one single word:

   A single domain name that is the mandatory payload output of DKIM
   and that refers to the identity claiming responsibility for
   introduction of a SIGNED message into the mail stream.

Background:

Example, using my junk gmail.com account:

    [email-masked]

At gmail.com web online setup, I have added a 2nd account to it:

    [email-masked]

I own winserver.com.

 From my Thunderbird MUA, I can send email to gmail.com via port 587.

    From: [email-masked]
    To: [email-masked]

Press SEND, gmail gets it and routes it to the boss.

When I get the mail at our beta.winserver.com site, the message source 
has this:

    DKIM-Signature: d=gmail.com; s=gamma; ....
    Return-Path: <[email-masked]>
    Sender: HLS <[email-masked]>
    Message-ID: <[email-masked]>
    From: hector <[email-masked]>
    To: [email-masked]

I am introducing the message into the mail stream. Not GMAIL.  This is 
  clearly identify by the Message-id:.  The author is always the 
responsible party for the message.  The identity that submits it is 
generally not going to be the signer process unless its a MUA doing 
the signing.

At best, we can say that the SDID is responsible for introducing the 
SIGNED message.

-- 
Sincerely

Hector Santos
http://www.santronics.com

---

From: Dave CROCKER <[email-masked]>
Date: Sat, 04 Apr 2009 10:11:15 -0700

Barry Leiba wrote:
>     The new text has all been

Folks,

To emphasize:

Includes a pointer to a diff file between the latest draft and the pre-vote draft.

The editing exercise was a matter of folding in the 3 circulated texts and, I 
believe, the correction Ellen offered.

Since my bookkeeping skills are poor, it won't be a surprise if I missed 
something.  That said, the diff file should make it trivial for folk to find any 
errors.

d/

ps.  A small distraction will be the chunk of IPR boilerplate.  The latest draft 
uses the latest boilerplate.  For those not following this bit of IETF process 
work, it's been confusing and unstable for some months.  Happily, the xml2rfc 
that the draft is coded in makes it trivial for conversion to txt or html to 
pickup whatever the latest boilerplate should be.

-- 

   Dave Crocker

---

From: John Levine <[email-masked]>
Date: 5 Apr 2009 11:40:45 -0000

>    <http://dkim.org/ietf-dkim.htm#errata>

Looks good to me.

Near the end of section 12, I'd change 

  The real-world efficacy of any but the most basic bindings between
  the SDID or AUID and other identities is not well established,

to:

  The real-world efficacy of bindings between the SDID or AUID and
  other identities is not yet established,

but if other people strongly prefer the current wording, I can live
with it.

I've seen plenty of hypotheses about what identities should match
what, but precious little operational data.

R's,
John

PS: Simple example: if a message is From: paypal.com and signed by
paypal.co.uk or vice-versa, what do you do with it?  Don't answer,
just note that there's more than one plausible interpretation.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Jim Fenton <[email-masked]>
Date: Mon, 06 Apr 2009 15:03:08 -0700

John Levine wrote:

Looks good to me.

to:

I like this new wording.

-Jim

---

From: Jim Fenton <[email-masked]>
Date: Mon, 06 Apr 2009 15:10:39 -0700

Dave CROCKER wrote:

Barry Leiba wrote:

Folks,

To emphasize:

Nits:

Sections 6 and 7:  s/semantics is/semantics are/

Section 12:  s/single, Signing Domain Identifier/single Signing Domain
Identifier/

s/DKIM's mandatory delivery/DKIM's mandatory output/

s/semantics is/semantics are/

Otherwise looks fine.

What are we doing with the other errata in the queue?  Are they to be
included in this update or processed as errata?

-Jim

---

From: Barry Leiba <[email-masked]>
Date: Mon, 6 Apr 2009 22:39:25 -0400

> included in this update or processed as errata?

The other errata are non-controversial and simple, and we'll process
them as errata.

Barry (as chair)

---

From: "Siegel, Ellen" <[email-masked]>
Date: Tue, 7 Apr 2009 11:29:49 -0400

> -Jim

+1