Subject: So ... did Dewey beat Truman?

From: "John Glube" <[email-masked]>
Date: Thu, 5 Aug 2004 00:05:52 -0400

Oh yes, the famous headline of the Chicago Tribune when
Dewey was supposed to have beaten President Truman in the
1948 Presidential election.

Why that subject line? Because of this article:

IETF Prepares to Forward Sender-ID
http://www.internetnews.com/xSP/article.php/3390221

The implication from the article, as a result of the author
interviewing Andy Newton, one of the co-chairs of this WG
was that Sender-ID had won and CSV had lost.

The only thing holding things up? According to the article,
a fight going on within MS whether to insist on a license
for Sender-ID or not.

However it seems based on quick notes released by the WG
chairs, the issue remains open.

Why do I say this? 

* The core draft protocol (aka Sender-ID) will now be
divided into two documents, core and PRA.

* In the meantime, MS has been given until August 23 (the
same date when last call starts) to file any IPR claims.

* The group can start discussing CSV.

And what about CSV? 

It might be helpful if Andy could clarify whether the
interview in the noted article is accurate, or did the
reporter mangle his remarks and draw the wrong conclusions. 

Why? Because the article leaves the impression the issue
has already been decided.

Instead, with the split of Marid core into two documents,
core and PRA, the community could enjoy the benefit of
doing:

* PRA checks meaning both SENDER FROM and FROM checks as
per PRA.

* SENDER FROM, MAIL FROM or EHELO checks all as per core.

(I appreciate some may balk at this, but bear with me.)

With the Marid protocol (SPF) being the design used for
senders to publish DNS records, this allows people to build
a receiving authentication model around any one of these
four options depending on their needs, without prejudicing
senders.

The benefits:

* It leaves MS free to claim a defensive patent on PRA and
require a license should it so decide. 

If MS decides to proceed in this direction, those
developers who are happy to sign a license can do so. Those
receivers who want to do full blown PRA checks can do so. 

* It allows the open source community free to develop and
implement an authentication model around SENDER FROM, MAIL
FROM and/or EHELO FROM. Those receivers who would prefer to
focus on the transportation stage for authentication can do
so. 

* This approach does not prejudice senders since the record
published using Marid protocol (SPF) can be used to support
any authentication chosen by the receiver.

* It allows the market to decide which approach to use
based on performance. 

* It allows testing to proceed.

* It does not prevent ISPs and business networks from
saying in essence, don't want your mail to be automatically
rejected, then by such and such a date you must have
published an SPF record or else we will automatically
reject. As to whether it is delivered or not, depends on
our policies.

* For marketing purposes call the whole thing Sender-ID to
expedite implementation (presuming this name is available
and not encumbered).

One thing. I am not trying to rehash old ground, or usurp
what was discussed and agreed upon at the WG meeting. If
the approach suggested is foreclosed by what was discussed
and agreed upon, so be it.

John Glube
Toronto, Canada

The FTC Calls For Sender Authentication
http://www.learnsteps4profit.com/dne.html

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.729 / Virus Database: 484 - Release Date: 27/07/2004

---

From: Andrew Newton <[email-masked]>
Date: Thu, 5 Aug 2004 12:03:04 -0400

> reporter mangle his remarks and draw the wrong conclusions.

It was not accurate and either I miscommunicated with the reporter or 
he simply got it wrong.

I'm sorry if this has caused any headache or heartache.  It certainly 
was not intentional.

Talking to reporters is not an aspect of chairship I like, and I have 
in the past ducked several reporters.  However, from experience I have 
learned there is a higher probably that they will get the story right 
if I do talk to them, though it is never a guarantee.

Again, sorry.

-andy

---

From: wayne <[email-masked]>
Date: Thu, 05 Aug 2004 11:50:55 -0500

> It was not accurate and either I miscommunicated with the reporter or

There is also a third possiblity:  An editor chopped things up in
order to make things fit.  Reporters rarely "have time" to get a story
reviewed by their sources, and editors rarely "have time" to get their
edits reviewed by the reporter.  

-wayne

---

From: Meng Weng Wong <[email-masked]>
Date: Thu, 5 Aug 2004 13:17:55 -0400

On Thu, Aug 05, 2004 at 11:50:55AM -0500, wayne wrote:
| 
| There is also a third possiblity:  An editor chopped things up in
| order to make things fit.  Reporters rarely "have time" to get a story
| reviewed by their sources, and editors rarely "have time" to get their
| edits reviewed by the reporter.  
| 

In the same vein, many readers of a certain online community
news form rarely "have time" to read the articles before
posting their comments.  :)

---

From: wayne <[email-masked]>
Date: Thu, 05 Aug 2004 13:33:48 -0500

> posting their comments.  :)

Yeah, that is much like many IETF meeting attendees rarely "have time"
to read the I-Ds.  Paul Vixie has a very cool rant on that subject
during the DNSOPs yesterday.

From what I can tell, the MARID session also suffered from this
problem with respect to the "breaking up the marid-core I-D".  Yeah, I
know, there *are* still a few things other than just the PRA algorithm
described in the marid-core I-D, but from the discussions yesterday,
it sounded like many people thought that the stuff that moved to
marid-protocol was still in marid-core.

-wayne