ietf-mxcomp
[Top] [All Lists]

Re: Why we should choose the RFC2821 MAIL FROM/HELO identities

2004-03-31 13:13:03

On Wed, Mar 31, 2004 at 11:41:26AM -0800, Hallam-Baker, Phillip wrote:
Yes, but can you be certain that's how they're configured?  Ability to
configure a client in a certain manner, and actual use of said
configuration are two different things.  Likewise, ability to 
route mail
through a preferred gateway and the existence and 
accessibility of said
gateway are two separate things.  

As I said in the original post:

Outlook and Outlook Express do not support an option for 
direct sent mail. Therefore it is highly unlikely that any
users have chose a non-existent configuration option.


I wasn't responding in that bit you quoted to your statement about
Outlook and OE.  I was responding to your comment about other GUI MUAs.


You're either forgetting or ignoring those who use PDA-based MUAs,
cellphone-based MUAs, public-terminal MUAs over whose 

These configurations are even more tied to the routing through 
gateway model. Wireless mail applications almost without exception
route through a sever that performs compression features - like
automatically attaching the post replied to.

Not in all instanceßs.  In fact, I'd wager not in many.  I've got three
cellphones right here that don't do that.


You also seem to be assuming that the action of an individual 
updating her
personal MUA scales well to an enterprise updating thousands 
to tens of
thousands of deployed MUAs.  It doesn't.  One takes five minutes.  The
other can take months, require policy review, deployment planning, and
so forth.

You have failed to demonstrate that the configuration you describe 
is at all significant in enterprise use.

Almost without exception enterprises of any size manage their
internet connectivity through firewalls. Direct sent mail is not
a commonly supported configuration.


You're forgetting that employees and and do leave the building in which
they work.  Routinely, both for personal and work-related reasons.


I wasn't referring to the "geek community".  I was referring to the
users who don't fit your use categories.  See my comments 
above on user classes for clarification.  

You are simply hypothecating the existence of communities and
then saying that the onus is on us to prove they do not exist.


You don't believe people exist that send mail while mobile?  Fine, an
existence proof, then:  All T-Mobile Sidekick users do it.  Through a
transparent proxy, thus losing control of the RFC2821 ENVELOPE-FROM.
I don't have the device handy, but I'm fairly sure this holds true of
all Treo 600 users as well, on multiple providers.  I can verify that
next week.  These MUAs aren't using anything other than SMTP over IP.
The IP network just happens to be carried via GPRS.



This sounds to me like you're saying that this group can produce a
proposal it sees no merit in.

No, if you see no merit in the proposal described in the charter 
then you don't belong in this group. 


I was referring to the ultimate product of this group.  Hence the
phrasing "can produce a proposal".  The product and the charter are not
the same document.
 
I'm claiming
in the bit you quoted that the act of this group producing a proposal
at all implies that this group as a whole considers the 
proposal to have merit.  Are you suggesting otherwise?

Yep. I am saying that the question of whether the proposal has
merit should be debated on the IETF list which is the proper place
to discuss charters. 


Again, I wasn't referring to the charter, but the product of this group.

Once the charter is granted the question of whether the proposal has
merit has been decided and is therefore out of scope.


You're simply confused.



Again, if you think that there is a way to support users who post 
from unregistered IP addresses in a protocol that authenticates
messages by the fact they originate from a registered IP address
then please state it.


I have, both publicly and privately:  There would need to be a means to
securely update the relevant DNS records.  There would also need to be a
means to prove mobile identity prior to the update.  I have knowledge of
working code based on WAVEsec (http://www.wavesec.org) and DNSSEC that
provides this functionality.  

To the rest of us it appears to be clear that to the extent that
the problem you cite is significant, it can be met by means of 
a dynamic registration protocol.


...which is fine, but contrary to what you've been saying.  What I've
understood you to say is that the people negatively affected by the
necessary changes can go suck mud.  And it's that attitude and approach
that I find unacceptable.  If you're acknowledging now that a mechanism
should be put into place to accomodate those people, then we're in
agreement.




-- 
Mark C. Langston                                    Sr. Unix SysAdmin
mark(_at_)bitshift(_dot_)org                                       
mark(_at_)seti(_dot_)org
Systems & Network Admin                                SETI Institute
http://bitshift.org                               http://www.seti.org