At 12:03 AM 8/21/2004 -0400, you wrote:
AccuSpam wrote:
You do not understand there is a big wide ocean between a user's cost to
download something (they do that often as evident by download.com success),
and getting users to understand and follow highly technical restrictions
have to do with terms such as "IP" address and "mail servers".
Uhm, if they don't understand those things (or can't at least follow
instructions) then they already can't send mail at all. I don't know of
any mail clients (except web mail) that don't require you to at least
enter a POP server and an outgoing mail server. Configuring SMTP AUTH
as well doesn't add any extra complexity, just extra fields to fill out
from the instruction sheet.
I will repeat what I wrote in the last message, but hopefully in a way that
appeals more to you.
It is NOT JUST configuring SMTP AUTH, it is a whole myriad of issues dealing
with the flexibility that people have grown accustomed to with e-mail.
SPF "-all" attempts to say semantically that "email not from a certain IP is
forgery" where from a senders perspective "any email I send is not a forgery".
Reconcilling the different semantics of what you as a sys admin are dreaming,
and the reality of the real world experience is going to be a rude awakening
from your dream IMHO.
One thing I learned in 18+ years as an engineer is that Murphy's Law always
rules.
When you deploy SPF "-all" to one major ISP, you will get feedback that will be
a like an education in eating dirt. Try it please.
I guess I don't understand why you're so opposed to SMTP AUTH,
I am not opposed to SMTP AUTH. I intend to use it even if using SenderKeys.
I am not opposed to SPF. I use it also.
I am opposed to the people who think "-all" will be widely supported by major
ISPs, because although I wish it would happen, because it would make job at
AccuSpam much easier (than being here grinding my nails against the
chalkboard), 18+ years as a commercial programming of programs targetted to
real users, is that the diversity in the ways people use email is not
compatible with SPF "-all" because there is a semantic gulf I stated above and
which has been stated by other critics of SPF.
when you
seem perfectly content to trust users to download special patches for
their MUAs to support your little scheme.
Because it does not break their semantics of what is a forged email (in more
scenarios than SPF "-all") and because that is all they have to do, and nothing
else, unlike for SPF "-all".
One thing I have learned today (well it is tomorrow already) is that SPF
appeals to sys admins, and they will try to force their will on users if they
can. Good luck!
Thanks,
Shelby