Subject: RE: mailing list last call: pop and smtp sasl

From: "Larry Osterman (Exchange)" <[email-masked]>
Date: Wed, 3 Dec 1997 14:20:26 -0800

John asked me to chime in, so...

Putting on my "real world" hat, I think that since there's at least one
widely deployed client out there that implements AUTH with no arguments
(IE 3.0, IE 4.0), and since Exchange 5.0 and 5.5 have shipped with
support for AUTH with no arguments, and since the POP3 SASL draft
requires this (which is what we coded to), I'd rather see #2, instead of
#3.  The reality is that we're going to be seeing IE3.0 (and 4.0)
clients out there for a long time now (probably several years), and
there's no real way of upgrading those clients to a new mechanism.

>From a purists standpoint, I agree with the discussion that that #3 is
better, but...

Personally I think 1 is a BAD IDEA(tm) - #1 requires that a client that
supports CAPA make 2 round trips before authenticating to the server,
there's no point in forcing them to make the additional round trip.

If the writing on the wall goes towards 3, I would much rather see
Randy's comment be adopted (SASL= is a MUST, AUTH<CRLF> is a SHOULD).
That has the advantage of allowing legacy clients to continue to
function against even new servers, but new clients will be able to
transition to the new mechanism, and hopefully the AUTH<CRLF> mechanism
will go softly into that good night....

I almost wish that Chris had proposed this 2 years ago when Mike Gahrns
and I asked John to add AUTH<CRLF> to solve the AUTH TWINKIE (gag)
issue, I'd have jumped on this in a heartbeat as a solution, but that's
water under the dam....

Larry Osterman
Via Exchange Osmium on Larryo-Laptop.dns.microsoft.com with NT 4.0.
Since these are not all released products, please notify the sender of
any difficulties.

---

From: "Larry Osterman (Exchange)" <[email-masked]>
Date: Wed, 3 Dec 1997 14:20:26 -0800

better, but...

Larry Osterman