Douglas Otis wrote:
On Dec 21, 2007, at 6:57 AM, Michael Thomas wrote:
l= with some z= magic. the point being that we understand the risks,
and we don't want net.busybodies telling us what is best for us. If
any of this becomes a real life problem -- which it is not -- there
are plenty of other mitigations we can take.
What are the mitigations?
They're secret. And obvious.
In addition, it is a matter of interpretation as to whether a
mailing-list should remove signatures prior signing. It is not that
far fetched to predict dependence upon permissive signature settings
and mailing lists not removing prior signatures is likely a recipe for
future policy compliance problems and represents valid concerns when
deciding upon policy assertions.
What part of RFC4871 section 4.1 paragraph 3:
Signers SHOULD NOT remove any DKIM-Signature header fields from
messages they are signing, even if they know that the signatures
cannot be verified.
is not clear? Your fanciful leaps of what-if's fly in the face of my field
tested 99.6% pass rate, not to mention that you are simply wrong about
what rfc4871 says.
Mike
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html