ietf-dkim
[Top] [All Lists]

Re: [ietf-dkim] list expanders (was Re: chained signatures, was l= summary)

2009-06-13 15:35:23
On Sat, 13 Jun 2009 16:39:22 +0100, SM <sm(_at_)resistor(_dot_)net> wrote:

Coming back to the subject of list expanders, I'll skip the A-R angle
as there are other venues to talk about it.  The question is whether
to consider the author's signature, the mailing list signature or
both.  Sometimes you know the author and you'll choose to pass the
message through.  But if you rely on that alone, then you are only
doing selective "acceptance" of the mailing list traffic which goes
against how a mailing list operates.  There's a well-known mailing
list that suffers from a spam problem.  If the messages are accepted
based on the mailing list signature alone (that mailing list is not
using DKIM at the moment), you are allowing spam into your mailbox.

And that hs precisely the problem. 99.5% of list expanders are competently  
managed, and the list recipients will usually be quite happy that the list  
manager had taken proper note of any incoming signature, and had not  
allowed any bad stuff onto his list. So recipients will be quite satisfied  
if he signs to say this is a genuine message from the list, even if the  
incoming signature has been broken and/or removed.

But there will be a few lists where this is not the case, such as the one  
SM mentions. I don't know whether the spam on that particular list is  
because the list admin is careless, or whether it is inherent in the  
subject matter of the list. EIther way, it is necessary for recipients to  
be watchful.

Maybe their standard spam filters will filter out the spam (though I doubt  
it). So they may well want to take note of any signature placed there by  
the original sender. It is in the nature of that sort of list that the  
list admin can only sign to say that it came from his list, But if he is  
smart, he can help his members by checking and reporting on any in coming  
signatures he receives (e.g. by inserting A-R headers, and not destroying  
original signatures). That way, the ultimate recipients can be reassured  
even if the policy of the list is (for some good reason, let us assume) to  
forward everything submitted to it.

So recipients who care about it are likely to be looking carefully as  
_both_ signatures.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131                       
   Web: http://www.cs.man.ac.uk/~chl
Email: chl(_at_)clerew(_dot_)man(_dot_)ac(_dot_)uk      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

<Prev in Thread] Current Thread [Next in Thread>