ietf-mxcomp
[Top] [All Lists]

Re: Why we should choose the RFC2821 MAIL FROM/HELO identities

2004-03-31 12:11:41

On Wed, Mar 31, 2004 at 10:55:10AM -0800, Hallam-Baker, Phillip wrote:
That's also een mentioned repeatedly.  Is there data to support the
claim?

If not, could we refrain from making it?

Certainly. The vast majority of email users us a commercial client to
read their email, specifically they use Outlook, Outlook Express, 
Lotus Notes, Netscape Navigator, Eudora or a Web Mail interface.

Outlook and Outlook Express simply do not support direct to receiever
transmission of email, all the other email clients at least support 
routing of email through a gateway as the default option.


Yes, but can you be certain that's how they're configured?  Ability to
configure a client in a certain manner, and actual use of said
configuration are two different things.  Likewise, ability to route mail
through a preferred gateway and the existence and accessibility of said
gateway are two separate things.  


The market share of MUTT, PINE, etc. is simply not very large at all.
And the community that uses them is capable of downloading and installing
patches - unless all this OSS speeds innovation propaganda is hokum.


You're assuming there are only two classes of people:

1)  Those who use (primarily Windows-based) MUAs, and
2)  Those who use non-GUI, *nix-based MUAs.

You're either forgetting or ignoring those who use PDA-based MUAs,
cellphone-based MUAs, public-terminal MUAs over whose configuration the 
person wishing to send mail has no control (yet can change RFC2822
headers), people behind transparent proxies, and so forth.

You also seem to be assuming that the action of an individual updating her
personal MUA scales well to an enterprise updating thousands to tens of
thousands of deployed MUAs.  It doesn't.  One takes five minutes.  The
other can take months, require policy review, deployment planning, and
so forth.


Seriously guys, the geek community is a negligible proportion of Internet
users, less than 1%. The vast majority of Internet users are your aunt 
Meg who barely knows one end of the mouse from the other.


I wasn't referring to the "geek community".  I was referring to the
users who don't fit your use categories.  See my comments above on user
classes for clarification.  


The fact that the proposal is put forth is a tacit admission that the
group views the proposal as a good idea.  In a very real sense, the
group must consider whether the proposal is of merit before releasing
it.

No, the decision on whether the basic proposal is or is not a good idea
was debated at length in ASRG. This is not the forum to re-open that
debate. It is over, done, dead, deceased, passed on, it is no more,
it has ceased to be, it has run down the curtain and joined the choir
invisibule, its a stiff, its shuffled off this mortal coil, it is a
dead argument.



This sounds to me like you're saying that this group can produce a
proposal it sees no merit in.  That makes no sense to me.  I'm claiming
in the bit you quoted that the act of this group producing a proposal
at all implies that this group as a whole considers the proposal to have
merit.  Are you suggesting otherwise?



We must be careful to consider that certain use cases
_will_ break, and that others may value those use cases more 
than those in this group.

You have to break some china to make this work.

At the moment spam is breaking the whole kitchen and everything in it.
If there is going to be pain during the transition (and there is no
evidence that this is the case) then it is logical to make sure this 
falls on the technology oriented community which is most able to cope.


I never said, "don't break anything".  I merely pointed out that we must
be clear on what our proposal will break, and recognize that the value
we may assign those use cases will not match that assigned those taking
advantage of them.  



If you have an alternative proposal, make it to ASRG. If you have
no alternative proposal your comments are not relevant. We are
all aware of the points you keep raising, we just do not agree
with them.


Who is this "we" of which you speak?

Those of us who actually want to deploy a DNS based authentication 
scheme.

Then kindly stop speaking for me.  I also wish to deploy a DNS-based
authentication scheme, and I don't remember conceding my voice to you.

-- 
Mark C. Langston                                    Sr. Unix SysAdmin
mark(_at_)bitshift(_dot_)org                                       
mark(_at_)seti(_dot_)org
Systems & Network Admin                                SETI Institute
http://bitshift.org                               http://www.seti.org