Subject: Re: [ietf-dkim] gathering data (was: Re: DKIM charter update proposal)

From: Franck Martin <[email-masked]>
Date: Mon, 5 Oct 2009 23:35:05 +1200 (FJT)

Huh?

My point was to simply ask does dkim help (directly or indirectly) to solve any problem related to SPAM? Where is the pudding and where is the proof?

----- Original Message -----
From: "Stephen Farrell" <[email-masked]>
To: "Franck Martin" <[email-masked]>
Cc: [email-masked], "IETF DKIM WG" <[email-masked]>
Sent: Monday, 5 October, 2009 9:36:38 PM GMT +12:00 Fiji
Subject: gathering data (was: Re: [ietf-dkim] DKIM charter update proposal)

Franck,

Franck Martin wrote:
> Seems to me something is missing: gather data to establish if DKIM specifications have in any way alleviated any misuse of the email system, in particular but not limited to spam, phishing attacks and fraud.
> 

If you want to propose some specific work items for the WG
then please do so as proposed charter text.

However, I've not really seen much interest or energy for
such work so if you're suggesting something, would it be
safe to assume you're willing to work on it yourself? In
that case, submitting a draft-martin-dkim-foo I-D would
be a good place to start so's we'd have an idea of what
kind of gathering you envisage.

Stephen.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 5 Oct 2009 13:07:25 +0100

> My point was to simply ask does dkim help (directly or indirectly) to solve any problem related to SPAM? Where is the pudding and where is the proof?

A fine question, but the thread Barry started is discussing the proposed
WG charter modification, so for now, I'm just trying to understand if
you're proposing something for that, (and if so, if you're volunteering
to do work:-)

If your question is unrelated to the charter discussion, that's fine
too.

Cheers,
S.

---

From: Franck Martin <[email-masked]>
Date: Tue, 6 Oct 2009 00:27:27 +1200 (FJT)

I'm cool to do work, but I'm not sure which one.... beside I don't think I have access to any data that would be usable.

I just had the feeling, seeing all the presentations, blogs ,etc... about DKIM that we have forgotten why it was created on the first instance, and I just wanted to put it back there where it belongs.

Like now each RFC must have a security consideration chapter, should email(and other messaging) related RFCs have a spam consideration chapter?

So as for the workgroup charter, it seemed all for refining the DKIM specs, forgetting the original goal, but then I also realize the goal of reducing spam was skilfully removed from the original charter (yeah, I should read the past charters first ;) )

----- Original Message -----
From: "Stephen Farrell" <[email-masked]>
To: "Franck Martin" <[email-masked]>
Cc: [email-masked], "IETF DKIM WG" <[email-masked]>
Sent: Tuesday, 6 October, 2009 12:07:25 AM GMT +12:00 Fiji
Subject: Re: gathering data

Cheers,
S.

---

From: Barry Leiba <[email-masked]>
Date: Mon, 5 Oct 2009 09:56:31 -0400

I'm going to reply to this point in both threads, so people who just
read the charter thread see it.  Please continue any discussion of it
here, in this thread.

On Wed, Sep 30, 2009 at 2:01 PM, Franck Martin <[email-masked]> wrote:
> Seems to me something is missing: gather data to establish if DKIM
> specifications have in any way alleviated any misuse of the email system,
> in particular but not limited to spam, phishing attacks and fraud.

On Mon, Oct 5, 2009 at 8:27 AM, Franck Martin <[email-masked]> wrote:
> I just had the feeling, seeing all the presentations, blogs ,etc... about DKIM
> that we have forgotten why it was created on the first instance, and I just
> wanted to put it back there where it belongs.
>
> Like now each RFC must have a security consideration chapter, should
> email(and other messaging) related RFCs have a spam consideration chapter?
>
> So as for the workgroup charter, it seemed all for refining the DKIM specs,
> forgetting the original goal, but then I also realize the goal of reducing spam
> was skilfully removed from the original charter (yeah, I should read the past
> charters first ;) )

It's not a question of skill, though thanks for the vote of confidence
there. :-)

It really was a question of focus: DKIM has never been meant to
address spam directly, but to be a tool to enable other mechanisms to
address spam.  That's reflected in the charter, both the old one and
the proposed new one.

I like the idea of having spam considerations in email-related
documents, actually.  I think the right place for that is in the
Security Considerations, and I think the Apps ADs should be the ones
responsible for making sure that spam-related considerations are in
there when appropriate.  Good idea.

To the point of gathering data, two things:

1. I agree that it's very important to do the data collection and
analysis.  It's also something that people are doing: I know that
Cisco is keeping track of various DKIM stats, and has shared partially
anonymized versions with us before.  Dave is collecting data, through
his surveys, on the deployment and use of DKIM.  Both Dave, as MAAWG
technical advisor, and I, as IETF liaison to MAAWG, will be getting
data, over time, from MAAWG members who use DKIM.

2. The IETF standards track has specific emphasis at the different
maturity levels (see RFC 2026).

For Proposed Standard, we need rough consensus that a protocol will be
useful, will interoperate, and is well designed.

For Draft Standard, we need to demonstrate that it does interoperate,
and that we have "sufficient operational experience".  Note that RFC
2026 says, "A Draft Standard may still require additional or more
widespread field experience, since it is possible for implementations
based on Draft Standard specifications to demonstrate unforeseen
behavior when subjected to large-scale use in production
environments."  That doesn't mean that we know, yet, that it's as
useful as we'd hoped or would like.

For (full) Internet Standard, we need "significant implementation and
successful operational experience", "a high degree of technical
maturity," and "a generally held belief that the specified protocol or
service provides significant benefit to the Internet community."  This
is the level at which we need to show how useful it is -- that it's
actually accomplishing what we'd like it to, and that it's a
"significant benefit".

DKIM might or might not get to full Internet Standard, but that's not
what we're aiming at now.  We do want to collect the data Franck is
talking about, and we are doing so.  And if there's consensus to put
that in the charter, I'm happy to do so (so far, only Franck has asked
for it).  But it's not a prerequisite for moving to Draft Standard.
On the other hand, it's entirely possible that moving to Draft
Standard is a prerequisite for getting the wide-spread deployment
needed to see the real usefulness.

Barry