Michael Thomas wrote:
This sort of gets to the heart of a concern I've had for a long
time about ar. Just who exactly is the consumer of an ar header?
For me, the consumer has been either me or some automaton that
digests the ar and produces statistics, or takes some action
based on the digested bits. My assumption has always been that
ar's are protected by firewall-y-like mechanisms (eg, ingress
filtering by border mta's) and that that's good enough security.
That's my vision as well, and I think the draft fairly clearly reflects
that without simultaneously restricting its use to only such automata.
Admittedly, those are a lot of assumptions. If people are planning
on using ar for very different uses -- especially across internally
secured areas, then the current design is woefully lacking. If
they aren't then it's probably ok.
I haven't heard of any current or proposed uses for which the current
proposal is insufficient. Can you conceive of one?
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html