Re: Boycott Caller-ID for E-mail

> I discovered this morning to my great disappointment ... that SPF and 
> Microsoft Caller-ID were merging into a new project called "Sender ID"
There has been an effort underway for several months.  The current 
state of "Sender ID" is that it will check the PRA identity (derived 
from the mail headers, rather than the envelope MAIL FROM), and use the 
SPF syntax to publish the records.
> ... that this new project, described here: 
> http://spf.pobox.com/draft-ietf-marid-protocol-00.txt
The current plan is to publish in two parts: The "protocol" document 
describes the record format and the check_host() function that 
evaluates a domain name against a client IP.  The "core" document (in 
the -02 rev, to be published this week) describes how to extract the 
PRA from the headers, and how to handle the result of check_host() 
during a SMTP session.
This split makes it easier for the IETF working group, and us, to deal 
with the issues without getting mired in "throwing out the baby with 
the bath water" arguments.
P.S.: It has now been officially published by the Secretariat of the 
IETF.  The official version is at:
        http://www.ietf.org/internet-drafts/draft-ietf-marid-protocol-00.txt

> that an agreement has been passed about this merger between Microsoft 
> and Meng Weng Wong on June 24,
"merger" sounds like a company action -- what is going on here is a 
larger e-mail community, that includes MS, coming together to pool 
their ideas and work to a solution.  Seriously.  That MS has a faster, 
more able PR department than Meng should come as no surprise...
> "Sender ID" in software is governed by a "royalty-free" license wich 
> actually is the license for "Caller-ID", and this license ... is 
> clearly incompatible with incorporating "Sender ID" into Free Sotware
We believe that the MS claims in the area only cover the PRA algorithm 
(though they haven't made that explicitly clear).  It is our belief 
that MS has been operating in good faith and intends to allow open 
source development.  Meng has had some very prominent open source 
lawyers look at the language and they are not all that concerned on 
first look.  There will be some heavy legal review in the coming week.  
I'm sure that if MS and the open source community don't see eye to eye 
after that, then the IETF working group will move on (perhaps replacing 
the PRA check with SPF's original MAIL FROM check -- meanwhile the 
protocol document doesn't have to change.)
> Does SPF really belong to Microsoft from now on ? Is the 
> implementation of SPF in software now governed by a MS License ?
SPF as it exists in the wild today (the record format, the checking 
algorithm, and the use of it during a SMTP transaction to test the MAIL 
FROM identity) is completely free of intellectual property claims as 
far as we know.  Implement and deploy with a clear conscious.  (Mind 
you, ANYONE could have filed a patent on any aspect of it in the last 
year and we wouldn't know -- prior art often isn't an impediment to 
getting patents pending...)
The PRA algorithm probably does require a MS license, but their 
intention seems to be to give one for free to anyone just for asking.  
In which case, it would be practically free.  Our lawyer friends will 
be vetting this out more soon.
In the current state of the world, we all work with things that other 
people have intellectual property claims to - and often give free 
licenses to.  MPEG and GIF come to mind.  If you are concerned about 
the particular license from MS for the PRA claims, so are we and we 
have open source friendly lawyers looking into it.  If you know other 
open source savvy lawyers, please have them look at it too.  If you are 
concerned about it being from MS because you don't like them as a 
company, then I'm sorry - many smart people liked the PRA choice on 
purely technical grounds - and if that is what we use to check, it 
appears they have the patents pending.  If you are concerned about 
there being any license at all - that is probably not practical in this 
day and age.  Even open source has licenses.
        - Mark

Mark Lentczner
http://www.ozonehouse.com/mark/
markl(_at_)glyphic(_dot_)com