Subject: Sendmail releases open source Sender ID milter for testing

From: Rand Wacker <[email-masked]>
Date: Mon, 30 Aug 2004 23:42:24 -0700

As part of our broad-reaching effort to spur the testing and eventual
broad adoption of sender-based email authentication to address fraud
and spam in email, Sendmail, Inc. is releasing an open source
implementation of the IETF's Sender ID specification for testing on
the Internet.  This implementation, part of the Sendmail Messaging
Integrity Pilot Program, utilizes the milter interface to plug
directly into the sendmail MTA.

Sender ID is a standards-track proposal that merges Meng Wong's SPF
and Microsoft's Caller ID for email.  Authorizations records are
published in DNS in an SPF-like format, and then used to validate
user-visible message headers using the Caller ID "Purported
Responsible Address".  This sid-milter release implements the
marid-protocol and marid-core draft standards, leaving the
marid-submitter SMTP Extension to be implemented directly by the
sendmail MTA.

To speed the adoption of sender-based messaging authentication
schemes, Sendmail is aggressively testing these implementations in the
Messaging Integrity Pilot Program. The goals of this program are to:

      * Deploy and test milter-based implementations of sender
        authentication schemes like Sender ID and DomainKeys.
      * Encourage diverse user communities to thoroughly test different
        sender authentication approaches using real-world use cases.
      * Share and publish results in a community forum purpose-built
        to share ideas about email authentication.

Sendmail is actively seeking participants and feedback for this Pilot
Program.  For more information about how you or your organization can
get involved in piloting the next generation in fraud and spam
protection software, please visit:

       http://sendmail.net/

The milter for testing Sender ID is available at:

       http://sendmail.net/sid-milter/

The MARID Working Group charter, along with links to all Sender ID
related proposals is at:

       http://www.ietf.org/html.charters/marid-charter.html

The SPF web site is located at:

       http://spf.pobox.com/

Microsoft's Sender ID page is located at:

       http://www.microsoft.com/senderid

---

From: wayne <[email-masked]>
Date: Tue, 31 Aug 2004 06:28:35 -0500

>        http://sendmail.net/sid-milter/

Actually, the download is hosted on sourceforge.  Have you made sure
that sourceforge is aware that all of there dozens of mirror sites
will have to sign a license in order to distribute this code?

-wayne

---

From: "Harold A'Hole" <[email-masked]>
Date: Tue, 31 Aug 2004 08:25:34 -0700

> will have to sign a license in order to distribute this code?

There's no need to sign a license because there's no evidence that MSFT owns
anything that requires such a license.  MSFT may have preliminary claims,
but until they prove they own it, nobody should bother with the license.
It's like buying a license from SCO for Linux.  Only a fool would fall for
such a trick.

Harry

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 31 Aug 2004 11:27:27 -0400

> will have to sign a license in order to distribute this code?

The patent license only affects implementors, the code can be freely 
distributed.

Yakov

---

From: Markus Stumpf <[email-masked]>
Date: Tue, 31 Aug 2004 17:39:45 +0200

> will have to sign a license in order to distribute this code?

And all e.g. ISPs that deploy it on hosts they manage for customers will
have to sign the license, too.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: wayne <[email-masked]>
Date: Tue, 31 Aug 2004 11:25:48 -0500

> The patent license only affects implementors, the code can be freely

Really?

From the SenderID licenses:

    2.2 _Source_Code_Distribution_ You also have [...] a
    perpetual, non-exclusive, royalty-free, nontransferable,
    non-sublicenseable, personal, worldwide license to distribute or
    otherwise disclose source code copies of such Licensed
    Implementation licensed in Section 2.1 only if You [...]
    
    'This source code may incorporate intellectual property owned by
    Microsoft Corporation that is necessary to implement the IETF
    Sender ID Specification. [...]  Our provision of this source code
    does not include any licenses or any other rights to you under any
    Microsoft intellectual property. If you would like a license from
    Microsoft (e.g. rebrand, redistribute), you need to contact
    Microsoft directly.'

This seems pretty clear, if you want to rebrand or redistribute the
source code, you need to contact MS and get a license.  Sourceforge is
*not* the implementor, Sendmail is.  Souceforge is just redistributing
the source code.  

    For clarification, this Agreement does not impose any obligation
    on You to require the recipients of Your source code
    implementations of such Licensed Implementations to accept this or
    any other Agreement with Microsoft. Your End Users may use the
    Licensed Implementations licensed in this section 2.2 or in
    section 2.1 that they receive directly or indirectly from You
    without executing this Agreement. [...]

Sourceforge is not an "End User", therefore I don't think Sendmail's
license for their implementation applies to SF.

Please explain what I'm missing.  This subject has been discussed a
fair amount on this list, and I haven't seen anyone say that ftp
mirrors and such would not be required to sign a license.

-wayne

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 31 Aug 2004 14:00:38 -0400

> *not* the implementor, Sendmail is.  Souceforge is just redistributing

My reading of this is that if you include the notice in your source, you 
are free to distribute it, although people who want to change it might 
need to get a new license.

Yakov

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Tue, 31 Aug 2004 20:27:58 +0200

Yakov Shafranovich wrote:
> wayne wrote:
>>     Our provision of this source code does not include any licenses 
>>     or any other rights to you under any Microsoft intellectual 
>>     property. If you would like a license from Microsoft (e.g. 
>>     rebrand, redistribute), you need to contact Microsoft directly.'
>
> My reading of this is that if you include the notice in your source, 
> you are free to distribute it, although people who want to change it 
> might need to get a new license.

Right. And people who want to redistribute it, too.

The first sentence quoted above says that the "you" (the party who 
wishes to redistribute) does not receive a SenderID license from "us" 
(the party who has one). The second says that to redistribute, "you" 
must contact Microsoft.

So even if Sendmail has a license, that doesn't grant Sourceforge a 
right to redistribute.

Maybe I'm wrong. If I am, I think it's an understandable error and 
clarifications are urgently needed.

Arnt