Subject: Discussing CSV

From: Mark Lentczner <[email-masked]>
Date: Tue, 3 Aug 2004 14:42:28 -0700

All -

On July 2nd, Marshall wrote:
> i think it would be fine for the csv design team to continue to refine 
> their specifications; however, in order to help the working group -- 
> as a whole focus -- the co-chairs ask that csv-related emails be 
> minimal on the mailing list for a few weeks.

I have therefore kept all my comments and thoughts on CSV off list.

Doug Otis' posts of the last week, especially his most recent for 
today, are mostly discussion of CSV, and why CSV is better than 
Sender-ID or any other proposal.

Is CSV now open for discussion again?  If so, I have a fair bit to say, 
especially on the issue of CSV vs. the other proposals.  Chairs?

	- Mark

Mark Lentczner
http://www.ozonehouse.com/mark/
[email-masked]

---

From: John Leslie <[email-masked]>
Date: Tue, 3 Aug 2004 19:39:53 -0400

> I have therefore kept all my comments and thoughts on CSV off list.

   It is certainly appropriate to comment directly to the authors in
order to honor this reuest. (And I will note that Mark has done so.)

> Sender-ID or any other proposal.

1. Marshall requested "a few weeks". Dave Crocker and I are willing to
   put off discussion a small bit longer; but I can't blame Doug for
   feeling the request may have expired.

2. Doug really isn't "discussing CSV", though he keeps mentioning it.
   He's mostly disussing what he sees as failings of the various flavors
   of SPF.

3. Regardless of Marshall's request, it is not helpful (IMHO) to censor
   ourselves to the extent of failing to post anything that mentions
   CSV.

> Is CSV now open for discussion again? 

   I don't believe CSV has ever _not_ been open for discussion; but
probably _extensive_ discussion of it is better done with the authors
privately for another day or so.

   Of course, YMMV, and I fully intend to respect requests of the chairs.

> If so, I have a fair bit to say, especially on the issue of CSV vs.
> the other proposals. 

   IMHO, it would be helpful to discuss these issues on-list.

   Of course, I (and the other authors, so far as I know) will be happy
to receive comments off-list as well.

> Chairs?

   It's not really fair to ask the chairs to rule on this until the close
of tomorrow afternoon's session...

--
John Leslie <[email-masked]>

---

From: "John Glube" <[email-masked]>
Date: Tue, 3 Aug 2004 21:50:04 -0400

Based on some questions I asked Andy earlier today, it seems
the WG is entitled to reasonably presume MS is asserting:
(i) a defensive patent over the PRA algorithm; and (ii) will
require software developers who wish to implement this
algorithm to enter into a royalty free license:

http://www.imc.org/ietf-mxcomp/mail-archive/msg02984.html

The license form is found at:

http://download.microsoft.com/download/6/0/a/60a02573-3c00-4ee1-8
56b-afa39c020a95/callerid_license.pdf

On July 26, 2004, Phillip Hallam-Baker wrote in response to
a post by Richard Stallman:

"Microsoft has been told that they need to adjust the
license terms if the technology is to stay in. The chairs
have given a specific date for providing the statement from
the lawyers. Ergo there is nothing to be done until either
we hear from the lawyers or the deadline expires. There
seems to already be consensus that the license terms are not
acceptable as is."

http://www.imc.org/ietf-mxcomp/mail-archive/msg02843.html

Since nothing new was filed by 02.08.04:

* Is their any room left for the Unified Theory which Meng
eloquently put to the SPF discuss list?

Under this approach, and applying it to where we are today,
SPF would be the protocol used by senders to publish their
sender policy. Receivers could then use this data to
authenticate domains based on SPF/SRS, CSV/CSA/DNA or Sender
ID/Submitter.

(I appreciate this would require some work with the existing
drafts.)

*  Unified Marid could then become a draft protocol, broken
out into its component parts. One standard for senders.
Three standards for receivers.

On 19.07.04 David Crocker wrote in response to a post by
Margaret Olson:

"There is an ietf movement to get cross-area reviews early
in the specification process. This is intended to uncover
significant design and operations issues quickly.

I strongly urge Marid to get some senior IETF review of the
sender-id stuff from security and operations geeks.  One
source candidate reviewers is at
http://graybeards.net/sirs/index.html."

http://www.imc.org/ietf-mxcomp/mail-archive/msg02751.html

To date there has been no uptake on Dave's suggestion.

To supplement the Unified approach, would it make sense for
the WG to have a senior IETF review of SPF as the sender
standard, along with a review of SPF/SRS and
Sender-ID/Submitter as receiving standards on an expedited
basis?

(I have excluded CSV/CSA/DNA as it is my understanding from
follow up posts by Dave this review is already underway and
may now be complete.)

* By taking this approach, instead of outright rejecting
Sender-ID/Submitter, it would leave receivers free to adopt
that protocol which best suits their specific needs.

The open source community and those portions of the
corporate sector which found the MS license requirement
incompatible with their needs could proceed forward on the
receiving side with SPF/SRS or CSV/CSA/DNA.

Those who were willing to accept the MS license could
proceed on the receiving side with Sender-ID/Submitter.

Using SPF as the unifying standard for senders would avoid
fragmentation while leaving receivers free to choose that
protocol which best suits their needs.

I appreciate the WG meeting at the 60th IETF is scheduled
for tomorrow. Also, I acknowledge time is very short.

However, is it not better to have all hands in the same
tent?

I put forward these suggestions to facilitate discussion
at the meeting.

John

P.S. I would love to be at the meeting. However,
unfortunately for personal reasons I am stuck here in
Toronto. So, best wishes to all. Cheers, John

cc. Meng, Mark, Harry, Jim, Dave, Phillip, Carl 

John Glube
Toronto, Canada

The FTC Calls For Sender Authentication
http://www.learnsteps4profit.com/dne.html

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.729 / Virus Database: 484 - Release Date: 27/07/2004

---

From: "william(at)elan.net" <[email-masked]>
Date: Tue, 3 Aug 2004 19:57:53 -0700 (PDT)

I'm in complete agreement with what John just wrote. I believe we should
proceed with Unified SPF and allow for senders and receivers to decide
which identities they want to provide email policy records for. Each 
identity should be defined in its own IETF document and if there are any 
IPR claims for certain identity and licensing is not acceptable to 
publisher or to recepient, then they don't have to verify that identity.

---

From: Andrew Newton <[email-masked]>
Date: Wed, 4 Aug 2004 11:03:47 -0400

> To date there has been no uptake on Dave's suggestion.

Marshall and I have taken this input as well as input from the MARID 
presentation at the Apps Open Area meeting and will be soliciting for 
reviews that fit within our schedule.

-andy

---

From: Andrew Newton <[email-masked]>
Date: Wed, 4 Aug 2004 20:50:19 -0400

> Is CSV now open for discussion again?

In keeping with our plan and given that we have tentatively agreed on 
milestones for CSV, the answer is yes.

-andy