Subject: [ietf-dkim] In the spirit of moving forward...

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 14 Sep 2010 21:24:15 -0700

There was very little response to my last straw poll about where we go with the MLM draft next.  It certainly wasn't enough to be able to claim "rough consensus" from a group this size.

I have some feedback on the actual text from Jeff, Daniel and Dave to incorporate, and I haven't forgotten that.  But there remains the issue of whether or not to split it into two or three documents covering specific topics (a non-DKIM MLM BCP, a DKIM-specific MLM BCP, and a DKIM value-add for MLMs informational), and whether or not to just drop the whole affair because there's not enough we can really say anyway.

Given my druthers I'd like to proceed with it the way it is since absent rough consensus to change course, the right thing to do seems to be to press on.  (After thinking about that a bit, I have to admit that it's also the most attractive to me since it's the least amount of work...)

Is anybody going to be really upset if I go that route and then work toward a WGLC later this year?

-MSK
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Wed, 15 Sep 2010 06:53:22 -0400

At this point, I personally see little value in "moving forward" with 
the MLM draft until the ADSP issues and 3rd party signer consideration 
are resolved. I think once we resolve the POLICY issue as it relates 
to list servers or any allowed 3rd party signer and consensus can be 
reached, then I believe the MLM guidelines can be better specified.  I 
hope documents authors can step up and help resolve this long time 
known issue once and for all.

I personally do not believe it is a major issue and can be resolved 
simply by codifying the documents by relaxing the 5322.From bind and 
allowed for 3rd party signature policy declarations.  (Note, just in 
case, I am not referring to the problematic authorized signers 
considerations.)

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

---

From: "McDowell, Brett" <[email-masked]>
Date: Wed, 15 Sep 2010 08:16:33 -0600

It was my understanding that the MLM BCP was intended to inform MLM operators of what they should do with DKIM-signed mail.  Since that is the critical question, I would assert we need rough consensus on the answer to that question before issuing a WGLC on the document.  I do not believe we have rough consensus on the answer to that question, i.e. reject vs. discard vs. bounce nor strip-and-sign, change from: and sign, or just simply re-sign as-is nor what to do about/with A-R.  Correct me if I'm wrong about that, but I saw some of those issues raised just this week (and we were debating these same issues in May).

---

From: Jeff Macdonald <[email-masked]>
Date: Wed, 15 Sep 2010 10:54:11 -0400

> Given my druthers I'd like to proceed with it the way it is since absent rough consensus to change course, the right thing to do seems to be to press on.  (After thinking about that a bit, I have t…

+1

-- 
Jeff Macdonald
Ayer, MA

---

From: "J.D. Falk" <[email-masked]>
Date: Wed, 15 Sep 2010 09:23:27 -0700

On Sep 15, 2010, at 7:16 AM, McDowell, Brett wrote:

> It was my understanding that the MLM BCP was intended to inform MLM operators of what they should do with DKIM-signed mail.

More of what they COULD do than what they SHOULD do, IIRC.

And, that may provide a path to compromise: keep everything as less-than-SHOULD (but still limited to very minimal changes required to MLMs), publish as Experimental, and wait for the Best Current Practices to emerge.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 15 Sep 2010 09:45:42 -0700

> -----Original Message-----
> From: McDowell, Brett [mailto:[email-masked]]
> Sent: Wednesday, September 15, 2010 7:17 AM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> Subject: Re: [ietf-dkim] In the spirit of moving forward...
> 
> It was my understanding that the MLM BCP was intended to inform MLM
> operators of what they should do with DKIM-signed mail.  Since that is
> the critical question, I would assert we need rough consensus on the
> answer to that question before issuing a WGLC on the document.  I do
> not believe we have rough consensus on the answer to that question,
> i.e. reject vs. discard vs. bounce nor strip-and-sign, change from: and
> sign, or just simply re-sign as-is nor what to do about/with A-R.
> Correct me if I'm wrong about that, but I saw some of those issues
> raised just this week (and we were debating these same issues in May).

I wasn't saying it's ready for a WGLC yet; as I said there's lots of feedback to incorporate still.  I just wanted to gauge whether or not there's a general feeling that moving forward with it (including evolving it) is a reasonable path from here.

But since you brought up those points, do you have any specific changes you'd like to propose?

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 15 Sep 2010 09:52:25 -0700

> From: [email-masked] [mailto:ietf-dkim-
> [email-masked]] On Behalf Of J.D. Falk
> Sent: Wednesday, September 15, 2010 9:23 AM
> To: DKIM List
> operators of what they should do with DKIM-signed mail.
> 
> And, that may provide a path to compromise: keep everything as less-
> than-SHOULD (but still limited to very minimal changes required to
> MLMs), publish as Experimental, and wait for the Best Current Practices
> to emerge.

The current draft deliberately avoided using any normative language at all, and has Informational status only.  Hopefully that satisfies those concerns.

---

From: "John R. Levine" <[email-masked]>
Date: 15 Sep 2010 14:38:47 -0400

> Is anybody going to be really upset if I go that route and then work toward a WGLC later this year?

Nope, so long as it describes actual practice, as a BCP is supposed to do.

It doesn't have to be universal practice, but it really should be 
something that someone, somewhere does, so we can at least have an 
existence proof that it doesn't immediately cause massive failures.

Here's some actual practice I have observed in the wild:

- sign list mail with a list signature (Yahoo Groups, Google Groups,
   this list, my lists)

- add and sign an A-R header describing signatures on inbound mail (this
   list, Googlegroups using an X- header)

- remove signatures from incoming mail (Googlegroups, Yahoo Groups, this
   list)

- keep signatures from incoming mail even if they're broken (my lists)

Anything else?

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor
Please consider the environment before sending e-mail.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 15 Sep 2010 12:26:14 -0700

> From: John R. Levine [mailto:[email-masked]]
> Sent: Wednesday, September 15, 2010 11:39 AM
> To: Murray S. Kucherawy
> Subject: Re: [ietf-dkim] actual practice, In the spirit of moving
> forward...
> 

The current status is Information, which gives us a little more leeway.

> - keep signatures from incoming mail even if they're broken (my lists)

That all makes sense, and from memory I think that is what we're saying right now.  I'll double-check this afternoon.

-MSK