At 4:15 AM +0000 3/15/06, John Levine wrote:
I don't see any concerns about mailing lists. All I see is a lack of
clarity about the meaning of third party signatures. Some list mail
will have only the original sender's signature, some will have only
the list host's signature (either because the original message was
unsigned or the list software mutated the message), some will have
both signatures.
+1
At 8:39 PM -0800 3/14/06, Dave Crocker wrote:
The meta-issue, here, is what a current batch of mailing list
software systems might do, versus what mailings are allowed to do.
There is no specification that restricts what lists are allowed to do.
Exactly right. And, given that, we cannot expect
currently-functioning software to want to change just because a new
standard is created years or decades after the software is deployed.
We dealt with this same issue in the S/MIME and OpenPGP working
groups. Neither group came out with restrictions on how mailing lists
should act, for good reason.
At 9:44 AM -0500 3/15/06, Barry Leiba wrote:
One note here: the base spec COULD suggest that if the signature
fails to verify and the subject is signed and begins with "[", that
the verifier might retry after removing the "[xxx]" part. And then,
much as with that part of the message that comes after the signed
length, the verifier must decide what to do if the retry succeeds.
Doing so would a poor security protocol. For one thing, some list
software adds different insignia at different places. For another, it
is an invitation to spammers to resend mail that didn't have [] at
the beginning of the subject to resend with their spam between the [].
It is far safer to assume that any of the signed headers might be
broken, and to encourage systems (such as mailing lists) that are
known to break DKIM signatures to sign after they break them.
--Paul Hoffman
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html