Do we really have to figure out yet again why an automated C/R system
is inferior in every way to a signature system like Domainkeys?
I'm not defending C/R systems as I believe they are not feasible for widesp=
read adoption. The system I've been promoting has some slight overlap but =
is markedly different and superior to C/R.
If you say so. I try to use standard terminology, so anything that
sends back a "send us something to persuade us to deliver your mail"
is C/R.
it doesn't require that senders remember all the mail they've sent
to know which challenges are to real mail and which to forged,
This 'remembering' in invisible and effortless as far as the sender
is concerned.
Um, smoke alert. Maintaining a database of sent mail for even a
moderately high volume mail server is a seriously hard problem.
High-speed updates are the hardest part of a database system, and this
is a worst case scenario because the info for a message needs to be
available as soon as the message has been sent, since we can expect an
automated C/R system to fire back a challenge immediately. The usual
way to deal with large volumes of updates is to batch them, but that
adds delays. I suppose you could batch the database updates and delay
the outgoing mail until the batch runs, but now you have another
locking problem to know when to release the outgoing mail.
I support DK, but its existence doesn't mean we don't need to
seriously pursue additional venues.
I'd like to pursue other topics as well, but surely we can find some
with better prospects than this.
The topic I keep hoping people will pursue is reputation systems. If
you believe that anything like SPF, DK, or Sender-ID is going to be
useful, you need some way to decide what to do with a message once you
know the domain it's from.
R's,
John
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg