Subject: DEPLOY - reference implementation

From: "Nate Leon" <[email-masked]>
Date: Wed, 25 Aug 2004 11:40:15 -0700

Is there a reference implementation published for Sender ID?

I realize it would be a Work In Progress.

It seems like it doesn't make sense for all of us to invent our own
wheels. :-)

Regards,
Nate

---

From: Chuck Mead <[email-masked]>
Date: Wed, 25 Aug 2004 15:18:12 -0400

Nate Leon wrote:
| Is there a reference implementation published for Sender ID?
|
| I realize it would be a Work In Progress.
|
| It seems like it doesn't make sense for all of us to invent our own
| wheels. :-)

So far as I am aware there is only one operational reference
implementation though it's only applicable to the 2821 headers (unless
someone more knowledgeable says different). See http://spf.pobox.com for
more information. I have had it in production for about 6 months now
with no effects save the obvious benefit of having a functional
anti-forgery tool applied to my MTA.

- --
Chuck Mead <[email-masked]>
Instructor II (and resident Postfix bigot), GLS
Disclaimer: "It's Thursday and my name is Locutus of B0rk!"
Addendum: "Bwahahaha! Fire up the orbital mind-control lasers!"

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 26 Aug 2004 10:18:18 +0200

On Wed, Aug 25, 2004 at 11:40:15AM -0700,
 Nate Leon <[email-masked]> wrote 

> Is there a reference implementation published for Sender ID?

You can say that every SPF implementation (there are many, see
http://spf.pobox.com/downloads.html) is an implementation of
Sender-ID's -protocol.

For -pra, the implementation seems trivial (<troll>so trivial that
nobody should be able to patent the idea</troll>).

---

From: Mark <[email-masked]>
Date: Thu, 26 Aug 2004 09:55:07 GMT

> http://spf.pobox.com/downloads.html) is an implementation of

Yep, Microsoft would love that, wouldn' they? The reality, however, is that
Sender-ID is an implementation of SPF!

See? Any license which allows one company to usurp/claim as their own the
open-source work of others, should be massively boycotted.

- Mark

        System Administrator Asarian-host.org

---
"If you were supposed to understand it,
we wouldn't call it code." - FedEx

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 26 Aug 2004 13:12:49 +0200

On Wed, Aug 25, 2004 at 03:18:12PM -0400,
 Chuck Mead <[email-masked]> wrote 
 a message of 34 lines which said:

> someone more knowledgeable says different).

Basically, Sender-ID is "get the PRA", then "get the PRD", send "apply
SPF to the PRD".

The last step is complicated but there are many free software SPF
implementations.

The first step is very simple, I attached my own implementation. Bug
reports are welcome to show me where I've misread -pra.

---

From: Mark <[email-masked]>
Date: Thu, 26 Aug 2004 14:00:02 GMT

> reports are welcome to show me where I've misread -pra.

Just for the heck of it, here is my Perl implementation of PRA. :)

- Mark

---

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 26 Aug 2004 16:33:41 +0200

On Thu, Aug 26, 2004 at 02:00:02PM +0000,
 Mark <[email-masked]> wrote 

> Just for the heck of it, here is my Perl implementation of PRA. :)

Does anyone have a good corpus of "bordeline" mails to test the two
implementations? (Although the algorithm is very simple, so we should
not expect discrepancies.)

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 26 Aug 2004 16:33:41 +0200

---

From: Mark <[email-masked]>
Date: Thu, 26 Aug 2004 14:00:02 GMT

- Mark

---

---

From: Mark <[email-masked]>
Date: Thu, 26 Aug 2004 14:00:02 GMT

- Mark

---

---

From: Mark <[email-masked]>
Date: Thu, 26 Aug 2004 17:55:12 GMT

> Just for the heck of it, here is my Perl implementation of PRA. :)

Actually, I made quite a few boo-boo's in that quicky jumbled together piece
of Perl. My apologies for that. This is how I should have done it. As far as
I can tell, it now follows the letter of draft-ietf-marid-pra-00.txt.

- Mark

---

---

From: Mark <[email-masked]>
Date: Thu, 26 Aug 2004 21:43:42 GMT

> Just for the heck of it, here is my Perl implementation of PRA. :)

Ok, last call. :) Not to worry, code is still the same; just all tidied up,
and all neatly condensed into this one "gimme_pra" subroutine, for easy use
within your own program.

- Mark

---