Subject: RE: Point of Order: Incomplete, flawed response to MARID WG Chart er

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 18 Aug 2004 07:15:52 -0700

> Is it in order for the WG to proceed to last call with a 
> solution which:
> -  addresses only half the problem space and
> -  increases the number of unauthorized, frequently 
> virus-carrying, messages
>    on the Internet?

By longstanding IETF precedent a charter only states the problems that
a WG MAY solve. There is no requirement that the eventual solution
MUST meet all the criteria that might be claimed to be in the scope
of the charter.

In the case of bounces Jim Lyons proposed a scheme that allows a party
acting on their own to eliminate fake bounces without requiring 
any other party to adopt the standard.

Perhaps this could be written up as informational so everything was
on the table.

> Just to illustrate the weakness of the current WG proposal, I 
> postulate some
> press headlines which, in my opinion, would be 
> technologically accurate:

They would not be technically accurate in my opinion.

---

From: Tony Finch <[email-masked]>
Date: Wed, 18 Aug 2004 15:51:24 +0100

> Perhaps this could be written up as informational so everything was

This is being done. Dave Crocker is fleshing out his Bounce Address Tag
Validation draft, and various people have or are working on
implementations of the idea.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
BERWICK ON TWEED TO WHITBY: WEST OR SOUTHWEST 2 OR 3 INCREASING 3 OR 4. FAIR.
GOOD. SLIGHT OR SMOOTH.

---

From: Dean Anderson <[email-masked]>
Date: Wed, 18 Aug 2004 11:19:25 -0400 (EDT)

> MUST meet all the criteria that might be claimed to be in the scope

The IETF has a longstanding precedent of having running code that
demonstrates the validity of the solution.  From the Mission Statement:

http://www.ietf.org/internet-drafts/draft-alvestrand-ietf-mission-02.txt

Anyway, I thought that someone was going to go off and test SPF (hopefully
in a realistically hostile environment).  It seems rather premature to
move before that is complete. Or has that test been abandoned?

> any other party to adopt the standard.

I didn't see Lyons proposal. But how can you tell a fake bounce from a
real bounce without some reference to the _actual_ original message and
the _actual_ state of the mail system?  This is a relevant point that I'm 
discussing with attorneys in another issue.  

> They would not be technically accurate in my opinion.

Well, the press to date certainly hasn't been very accurate. I read an
article in one of the linux magazines (linux journal, I think) that was
_way_ overstating what SPF would do.

                --Dean