Dismiss me as a comic (and a bad one at that) if you wish, but my little
crystal ball reveals to me...
1) Microsoft will finish their product, continue to call it Sender ID, sue
the daylights out of whoever that UK firm is for using "their" trademark,
bundle it with Exchange Server 2008 or whatever they will call it, and
overprice the license for its use on any non-Exchange product. They will
declare The End Of Spam Is Nigh! and on schedule with their two year plan,
even though it would be four years later.
2) Yahoo and Verisign (if Microsoft doesn't beat Yahoo to it) will establish
a DomainKeys registry, charge obscene amounts of money for yearly
subscriptions to certificate services, charge more money for an Exchange
event sink for it. Or if Microsoft gets in on it, enter into yet another
collusion with Verisign over PKI, like they have with signing applications
Designed for Windows XP[1], and provide a competing service - Verisign wins
twice.
3) Open source advocates and programmers will fully develop SPF as a
competing technology, license it under the GPL and give it away. The moment
a real working [3] Exchange event sink appears for it, Microsoft will sue for
patent infringement. SPF development will move to Norway with its older
brother PGPi, to continue distribution "illegally," and suffer the same fate
as PGP. It will be called "SPFi" or some variant on that theme, and many
comparisons to it and PGPi will grace technical news sites and Slashdot,
where karma whores will continue to get +5 Funny scores by comparing it to
sunscreen.[4]
4) In the meantime, poor sysadmins and consultants like myself will have to
explain to their clients or employers why they should 1) spend exorbant
amounts of money to pay for a Microsoft / Verisign solution to prevent their
domain from being forged, even though half the Internet doesn't recognize it.
Or 2) explain why they should engage in civil disobedience in the name of
Open Source, and install something potentially illegal (depending on their
country) which could expose the client or employer to action, yet is The
Right Thing To Do For The Good Of The Internet, even though, *sigh*, the
other half the Internet doesn't recognize it.
5) Or, some sysadmins like myself will tell everyone trying to sell / preach
e-mail verification systems to go hang themselves with a CAT5 cable, and
instead recommend subscribing to Messagelabs, Brightmail, Black Spider, and
other managed e-mail providers, giving rise potentially to another 800 pound
gorilla Who Controls Your E-mail.
6) Oh yes, let's not forget that there will be a fellow who will say that He
Started It All and He Should Be Rich and He Will Sue Microsoft And SPFi for
Stealing His Ideas and that The IETF Is Corrupt.[2]
For all I preach about not blaming Microsoft, here's an instance where I'll
gladly say it. The words: "BLAME MICROSOFT," creep across my crystal ball.
Oops, my crystal ball just told me KERNEL_DATA_INPAGE_ERROR - I guess I shook
it too hard. Time to replace one of the crystals, reformat and reinstall.
[1] Don't even get me started here - Microsoft's Designed for Windows XP
Software page and linked documentation make no reference that there would
possibly be other PKI vendors who would provide code signing certificates
that would let Microsoft bless their application with XP Holy Water. It's
hard enough trying to make developers design for security when there are
(perceived) cost barriers like this.
[2] As much as I respect you Hadmut, for your gall and knowledge and sheer
guts, blasting the IETF and raving like The Village Idiot throughout this
process earned you that paragraph. *I'M* supposed to be The Village Idiot!
[3] I tried two which promptly crashed IIS5 trying to send mail to
dumbo.pobox.com. Someone forgot to test sending as well as receiving mail,
apparently.
[4] Or if you're a pure mathematician, "SPFi" would have a SPF value of the
square root of minus one, and applying it would make you more susceptible to
sunburn than your own skin would. As in Count Dracula sunburn.
--
PGP key (0x0AFA039E):
<http://www.pan-am.ca/consulting(_at_)pan-am(_dot_)ca(_dot_)asc>
Sometimes it's hard to tell where the game ends and where reality bites,
er, begins. <http://vmyths.com/resource.cfm?id=50&page=1>