Subject: [ietf-dkim] (offtopicish) RFC 4871 Word Cloud

From: "J.D. Falk" <[email-masked]>
Date: Thu, 16 Apr 2009 08:35:05 -0600

I thought this was kind of amusing:

	http://www.wordle.net/gallery/wrdl/754322/RFC_4871

-- 
J.D. Falk                                   you're going sane in a crazy world
<[email-masked]>
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Thu, 16 Apr 2009 12:24:54 -0400

> 	http://www.wordle.net/gallery/wrdl/754322/RFC_4871

Doesn't work unless JavaScript is enabled and a  Java Pluggin is 
instlled. <OUCH!>  It only requires others for other cross domain 
access. (Get NoScript for FF website protection, its great!)

This is a prime example of an unauthorized 3rd party signature. <g>
I will allow NoScript to White List the first party website, but not 
others it attempts to access as well with JavaScripts.

Its also a prime example of others says:

        "If you trust J.D. Falk, then it shouldn't matter.
         Trust him!"

I say, but can you really trust Falk from himself. :-)

Do you really need to install a Java Pluggin for this?

-- 
Sincerely

Hector Santos
http://www.santronics.com

---

From: "J.D. Falk" <[email-masked]>
Date: Thu, 16 Apr 2009 13:17:33 -0600

Hector Santos wrote:

> instlled. <OUCH!> It only requires others for other cross domain access.
> (Get NoScript for FF website protection, its great!)

Sorry 'bout that.  Here's a PNG, on a site you can trust as much as you 
trust me ('cause I'm actually responsible for it):

http://www.cybernothing.org/jdfalk/tmp/dkimwordcloud.png

-- 
J.D. Falk
Return Path Inc
http://www.returnpath.net/
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Thu, 16 Apr 2009 17:36:25 -0400

> http://www.cybernothing.org/jdfalk/tmp/dkimwordcloud.png

Thanks!  Very cool. :-)

-- 
Sincerely

Hector Santos

---

From: Barry Leiba <[email-masked]>
Date: Fri, 17 Apr 2009 00:59:46 -0400

You can trust the wordle site, and wordles, in general, are pretty
cool.  The site was devised by Jonathan Feinberg, from IBM Research.
Here's what I said about it last year:
http://staringatemptypages.blogspot.com/2008/07/wordles.html

Barry

---

From: Hector Santos <[email-masked]>
Date: Fri, 17 Apr 2009 02:05:09 -0400

> http://staringatemptypages.blogspot.com/2008/07/wordles.html

Yes, I believe I was aware of the site (came across it before or 
something similar that was very dynamic in creating a cloud - more of 
a six degree association concept. It would blow you away. 
Unfortunately, I don't remember the site).

I apologize to J.D. I did not wish to insinuate lack of trust.  I 
found the irony in the post because not even minutes earlier, I had 
just finished reading legal news briefs with there were two reports of 
"how terrible the world is" with massive hacker penetrations into the 
user PC world using subtle tricks - like an innocent carrot that 
requires installation (download) but its automated these days with 
current browsers - hackers are exploiting this terrible trend.

For example, the current (negative) trend with browsers is to not 
allow users to turn off javascript, java, etc, i.e., Chrome does not 
even have the option in its setup/options.  Have you noticed the 
growing # of WEB 2.0 websites who will not function at all and will 
tell ya you need it on before continuing? I have a custom copy of 
Chrome that disable its "Call Home" logic and I use this whenever I 
want to see a web 2.0 site. 
(http://santronics.blogspot.com/2008/09/removing-chrome-spying-activity.html)

MS IE, as well as Mozilla is following freaking Google who has 
strategically change the industry mindset in relaxing the browser 
security - by not even offering the option to turn it off.

If you use FF, I recommend using the NoScript plugin to protect yourself.

I'm actually writing a bill proposal for my state senator Bill Nelson 
who involved in such matters to address the issue.

-- 
Sincerely

Hector Santos

---

From: Doug Otis <[email-masked]>
Date: Fri, 17 Apr 2009 10:39:11 -0700

> If you use FF, I recommend using the NoScript plugin to protect  

Agreed.  Unfortunately, even our portal requires third-party cookies  
used by a news feed. :^(

-Doug

---

From: Hector Santos <[email-masked]>
Date: Sat, 18 Apr 2009 17:29:03 -0400

> Agreed.  Unfortunately, even our portal requires third-party cookies 

Whats amazing and humbling experience to see the tide with the current 
generation of development lacking a regard for backward compatibility.

<optional type="personal note">

Maybe because the current generation don't have the insight to design 
for backward compatibility - they know what they know now.  In other 
words, a portal designed for normal HTML is no longer important.  For 
our web portal, designed in 1996, we intentionally avoid UI designs 
that required cookies and javascript - pure HTML.  It was only in 
2004/5 when we updated the web portal to OPTIONALLY support 
javascript, cookie-based authentication. IOW, it didn't break down if 
the user has javascript and/or cookies disabled.

IMO, that sorta of design is now lacking.  Increasingly, I'm seeing 
more web sites totally breakdown with the better ones throwing up a 
browser requirements page.  In a way, thats good for us. Do the same 
thing and reduce the complexity of the backward compatibility web UI.

What bothers me though is that much of whats going on is being done by 
14-18 years old who IMO lack experience in social engineering and 
ethical design considerations.  To them the idea of COOKIES and 
JAVASCRIPT being disabled is unthinkable.

I have to give credit to gmail.com for their web-based UI.  Here they 
designed it for both javascript and non-javascript operations.  In 
fact, if you don't like the silly ads in the GMAIL.COM mail display, 
turn off Javascript and switch the HTML mode.

</optional>

Keeping this somewhat related to DKIM <g> I can see how 
Cookies/Javascript can be used for web based MUAs.

For example, we can have a AJAX based MAIL API where a message display 
  can be done by our backend:

      From: doug
      To:  hector
      Status: Signed by DKIM

The display includes javascript that to show an ajax-based DKIM status 
information request:

    Status: <div onCLick="ajaxDkimStatus();">Signed By DKIM</div>

Clicking it does a background Ajax call, and displays a overlapping 
popup <div id="dkimStatus_Result"><div> window.  It might use a cookie 
to store the current message id for reference.

If the user has cookies/javascript disabled, this breaks down. Does 
not provide me the incentive to do this.  For the new generation, they 
  won't think twice.  :-)

-- 
Sincerely

Hector Santos

---

From: Steve Atkins <[email-masked]>
Date: Sat, 18 Apr 2009 14:46:19 -0700

> JAVASCRIPT being disabled is unthinkable.

The lesson here is that irrational paranoia can damage useful
http standards. Also, that you shouldn't limit your use to the lowest
common denominator, the most irrationally paranoid of the
paranoids. When a potential user is 4 or 5 sigmas away from
normal behaviour, they're probably irrelevant.

There's probably a more general lesson about ignoring the
extremists while doing application - or protocol - development,
and catering to what the vast majority of normal, rational users
will find useful. As opposed to, say, catering to what only a tiny
fraction of users want at the expense of the vast majority.

Cheers,
   Steve

---

From: Doug Otis <[email-masked]>
Date: Sun, 19 Apr 2009 00:52:26 -0700

On Apr 18, 2009, at 2:46 PM, Steve Atkins wrote:

>> What bothers me though is that much of whats going on is being done  
>> by 14-18 years old who IMO lack experience in social engineering  
>> and ethical design considerations.  To them the idea of COOKIES and  
> The lesson here is that irrational paranoia can damage useful http  
> standards.

After untold users had systems compromised by zero-day browser script  
exploits, and a vendor recently taking weeks to issue repairs for  
several versions of their OS, why would anyone describe browser  
related security concerns irrational?  Once compromised, systems  
appear to typically remain so, based on observed email behaviors.

The adopted an Authentication-Results header, while okay for DKIM,  
intentionally excludes a means to inhibit annotations based upon CGNs  
authorizations, for example.  Security should not become secondary to  
unsupported statements or unsupportable schemes aimed at retaining an  
allusion of security.  In the face of polymorphic threats, greater  
reliance on source authentications is required, where possibly  
vulnerable browsers are often used to read email.

-Doug

---

From: Suresh Ramasubramanian <[email-masked]>
Date: Sun, 19 Apr 2009 18:27:10 +0530

> appear to typically remain so, based on observed email behaviors.

.. after untold drivers have died in accidents, you still do drive to
work right?

--srs

-- 
Suresh Ramasubramanian ([email-masked])

---

From: Hector Santos <[email-masked]>
Date: Sun, 19 Apr 2009 09:19:48 -0400

> .. after untold drivers have died in accidents, you still do drive to

Good point. But IMO, better metaphors might be:

- A car where the vendor no longer allows you to turn off the
   radio or change the station (Force feeding commuter ADs).

- A car that still functions if the GPS was removed/disabled.

- DKIM-aware mail reader that requires you to use Javascript.

-- 
Sincerely

Hector Santos

---

From: Suresh Ramasubramanian <[email-masked]>
Date: Sun, 19 Apr 2009 18:55:38 +0530

1. None of these are standards - in other words 'drive a different
car, you have plenty of choices'

2. Analogies suck, let's stop this thread and get back to whatever's
the IETF equivalent of "operational" discussion.

srs

---

From: Hector Santos <[email-masked]>
Date: Sun, 19 Apr 2009 09:34:48 -0400

As Doug noted, these concerns are rational, especially among the 
rational. Maybe it helps keep the laissez faire care-free development 
in check, and these are the ones who are not following standards and 
ethical engineering practice.

Nonetheless, I speak of backward compatibility.  Like your 
wordtothewise.com web site not breaking down because I have javascript 
disabled for your web site.  It will be irrational, to me, for any 
organization worth its (visiting) salt to force javascript in order to 
operate.

You point is well taken - at some point Pareto's principle come into 
play.  But you still need to be careful of ignoring potential security 
holes.  If one doesn't care, then has history has proven and continues 
to show, it generally becomes a problem for the relevant.

I think it would be "stupid" for a MUA designer for example to force 
javascript in order to support DKIM - that would be security oxymoron.

-- 
Sincerely

Hector Santos

---

From: Hector Santos <[email-masked]>
Date: Sun, 19 Apr 2009 09:49:24 -0400

> car, you have plenty of choices'

Exactly, the point was that the trend is towards a (unsecured) common 
method.

> the IETF equivalent of "operational" discussion.

My point proven - the concerns are irrelevant these days among those 
who feel they are most relevant over others which is ok, if there were 
  not security issues involved.

Part of "operational" design is to keep an open mind about all issues 
related to a technology especially when new and there is a lack of 
employment experience especially with the irrevalent.  You must 
incorporate existing experiences, including the usage of http 
"OPTIONAL" standards, the operative word here is optional.

-- 
Sincerely

Hector Santos

---

From: Doug Otis <[email-masked]>
Date: Sun, 19 Apr 2009 08:58:06 -0700

On Apr 19, 2009, at 5:57 AM, Suresh Ramasubramanian wrote:

> .. after untold drivers have died in accidents, you still do drive  
> to work right?

Most email abuse emanates from hundreds of millions of compromised  
systems.  Most of these systems have been compromised by browser  
related exploits.  Email authentication helps recipients determine  
whether it might be safe to run scripts, or whether it might be safe  
to click on links contained within emails, or to accept any number of  
often socially engineered threats.

It took the auto industry decades before seat belts were mandated.   
NoScript allows users to know who is there before removing the chain.   
While a nuisance, the same could be said for seat belts.

Email will not continue to function without security improvements.   
Plugins like NoScript helps remind developers some people don't want  
dancing fruit when they can't see who it is from.

-Doug

---

From: Suresh Ramasubramanian <[email-masked]>
Date: Sun, 19 Apr 2009 21:32:52 +0530

On Sun, Apr 19, 2009 at 9:28 PM, Doug Otis <[email-masked]> wrote:
> Most email abuse emanates from hundreds of millions of compromised systems.
>  Most of these systems have been compromised by browser related exploits.
>  Email authentication helps recipients determine whether it might be safe to
> run scripts, or whether it might be safe to click on links contained within
> emails, or to accept any number of often socially engineered threats.

No sorry. Reputation and reputational analysis of individual emails -
possibly but not entirely tied ot authentication - determines that.

If you go around comparing this to seatbelts on cars, that's a
staggeringly bad analogy.

-srs

---

From: Doug Otis <[email-masked]>
Date: Sun, 19 Apr 2009 10:12:44 -0700

On Apr 19, 2009, at 9:02 AM, Suresh Ramasubramanian wrote:

>>  Email authentication helps recipients determine whether it might  
>> be safe to run scripts, or whether it might be safe to click on  
>> links contained within emails, or to accept any number of often  
>> socially engineered threats.
>
> No sorry. Reputation and reputational analysis of individual emails  
> - possibly but not entirely tied to authentication - determines that.

Unfortunately, without authentication, reputation that will always  
miss a percentage and only keep inboxes from being overwhelmed.

> staggeringly bad analogy.

While providers might like to declare email safe, those offering an  
allusion of security with authorization, also eliminated evidence of  
their involvement.  A seat belt mandate would be analogous to a  
functional security mandate.

-Doug

---

From: Suresh Ramasubramanian <[email-masked]>
Date: Mon, 20 Apr 2009 05:59:26 +0530

On Sun, Apr 19, 2009 at 10:42 PM, Doug Otis <[email-masked]> wrote:
> Unfortunately, without authentication, reputation that will always miss a
> percentage and only keep inboxes from being overwhelmed.

[raises eyebrows]

-srs