On Sep 19, 2016, at 6:37 PM, John Levine <johnl(_at_)taugh(_dot_)com> wrote:
In article <6DD54672-A321-42A8-837C-0F5A85A2D796(_at_)dukhovni(_dot_)org> you
write:
It seems to me that catering to senders whose unsubscribe volume is so
high as to overwhelm their email systems should not be a priority.
People at large mail systems tell me it's a fact of life. Long before
this particular hack ever came up, they already had problems of
accidentally DoS'ing other mail systems by mistake when something
provoked a lot of responses. In any event, our goal here is to help
make mail less lousy, not to make a statement about how we think
people should design their systems.
If they DoS a few spammers, seems like a win... :-) In any case,
there's no need for this as a motivation in the RFC.
Can you explain the DKIM requirement in more detail? Is the MUA required
to verify the DKIM signature? Or is it expected to alternatively trust
any Authentication-Results header?
That's an implementation detail. In the most likely implementations,
it's web mail so the MDA and MUA are all the same system.
The requirement for DKIM signing is a mystery in the draft. If is
there, its purpose should be explained. What are MUAs supposed to
do in its presence or absence? What happens when DKIM is validated
at the border and conveyed via Authentication-Results headers?
What purpose does the DKIM signature
serve, if there is no required correlation between the authenticated "d="
value and the authority of HTTPS unsubscribe URI?
It gives the recipient system a handle to use to decide whether they
trust the message enough to use the list-unsubscribe and
list-unsubscribe-post. The postmaster at the world's largest mail
system has told me that this is useful to them.
If it is merely useful to them, there's no requirement for DKIM on
the receiving side, and this is not enough to mandate DKIM in the
draft. Perhaps you meant to say that senders SHOULD use DKIM,
otherwise the one-click unsubscribe signal might not be honoured?
What are the cross-origin risks in allowing the incoming mail to trigger
a POST to a URI of the sender's choice with sender selected parameters?
I would think that it's about the same as the GET that
List-Unsubscribe already can trigger. We've lived with that for nearly
two decades.
I think not, "GET" is supposed to not have non-idempotent side-effects.
I would strongly suggest that there be a requirement to include an
"Origin: mailto:<envelope-sender>" header in the POST, which would
indicate to the target webserver that it is dealing with a cross-origin
request.
--
Viktor.