ietf-dkim
[Top] [All Lists]

Re: [ietf-dkim] draft-ietf-dkim-mailinglists-02 review

2010-09-10 20:33:16
Charles,

Lets keep in mind that when a backend has control of a online MUA, it 
has full control of the display rendering and could do practically 
anything to a convey an "intent" for the user:

    From: Original Author
    Note: 1st party signature removed by the MLM agent XYZ
    Note: 3rd party signature is valid

and given the direction of communications where greater centralization 
and small/thin devices, the backend has full control to display 
exactly what it wishes to convey.

But when you don't have control with store and forward technology, you 
have to use standards to provide standard information for the external 
MUA most common display rendering methods to date.

Once you begin to open the door with changing the 5322.from with 
middle ware, I see nothing but trouble, especially in legal areas.

One can even suggest in some "spec"

     - you MAY alter the FROM when its was DKIM signed
       but you need to break the signature

and tomorrow, you will find NON-DKIM reasons or worst no reason for 
changing the From.

How will know when the original author was lost?

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

Charles Lindsey wrote:
On Thu, 02 Sep 2010 18:35:16 +0100, Alessandro Vesely 
<vesely(_at_)tana(_dot_)it>  
wrote:

I repeat the two proposals that have been made, and ask once more
whether there are further ways to achieve similar results.

Charles' From-%-rewriting.
It seems the WG disagrees with it.  However, it has also been
mentioned that some MLMs already change the From.  Should it be
forbidden?  If not, I see no reason not to document it.

The problem is that too many people on this WG take the view "I believe in  
solution-X (TPA, PGP-MIME, don't use ADSP because it's broke, don't use  
mailing list if you advertise 'discardable') and I will vote down any  
solution other than X".

And all these so-called solutions have some downside or other (yes, mine  
does too).

BUT AFAICS noone has shown any flaw whereby my proposal would not fix the  
problem, and noone has shown that it opens the door to any scam that was  
not possible already.

So if it works, we should document it as ONE OF THE POSSIBLE TOOLS that an  
MLM might use.

Really, it is up to the MLM, who understands the purpose of his list and  
the nature of his subscribers, to decide whether and how to fix the  
problem. And note also that my solution need not be used except on those  
messages that might not survive without it.

As to the argument that "we don't document things that are not already in  
current use", well that is a classic chicken and egg problem. In real life  
you have to start somewhere.





_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html