Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-08 Thread Neil Anuskiewicz
> On Apr 1, 2024, at 2:43 PM, John R. Levine wrote: > > On Sun, 31 Mar 2024, Jim Fenton wrote: >> Based on the above problems, I do not think DMARC-bis should be published as >> a standards track document by IETF. > > This reminds me of the NAT wars in the 1990s. We all understand that

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-04 Thread Tero Kivinen
Murray S. Kucherawy writes: > Some sort of contract or agreement between sender and receiver > seems to me to be unavoidable if we want to leverage ARC without > having a global domain reputation system.  We don't have a > precise method to do that.  We need to experiment and >

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-04 Thread Douglas Foster
Sender reputation is in use everywhere. What is lacking is an omniscient data source, but I have no hope of finding one. Small senders will always be at a disadvantage because sender reputation is entirely based on past experience, and smaller senders have less experience to draw upon. ARC

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-04 Thread Jim Fenton
On 4 Apr 2024, at 12:08, Murray S. Kucherawy wrote: > On Thu, Apr 4, 2024 at 12:02 PM Dotzero wrote: > >> >> >>> >>> My overall point is that this thread makes it seem like we're not putting >>> forward a complete solution. It feels a lot more like a proposed standard >>> that for its clear

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-04 Thread Murray S. Kucherawy
On Thu, Apr 4, 2024 at 12:02 PM Dotzero wrote: > > >> >> My overall point is that this thread makes it seem like we're not putting >> forward a complete solution. It feels a lot more like a proposed standard >> that for its clear success depends on a bunch of other things that range >> from

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-04 Thread Dotzero
On Thu, Apr 4, 2024 at 1:42 PM Murray S. Kucherawy wrote: > On Thu, Apr 4, 2024 at 10:21 AM Douglas Foster < > dougfoster.emailstanda...@gmail.com> wrote: > >> Murray, I was hoping your proposal to advance ARC was serious. >> > > If people think (and have evidence that) ARC is ready, then why

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-04 Thread Murray S. Kucherawy
On Thu, Apr 4, 2024 at 10:21 AM Douglas Foster < dougfoster.emailstanda...@gmail.com> wrote: > Murray, I was hoping your proposal to advance ARC was serious. > If people think (and have evidence that) ARC is ready, then why would I not be serious? The WG needs to resolve that "if" though. >

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-04 Thread Alessandro Vesely
On Thu 04/Apr/2024 18:13:37 +0200 Murray S. Kucherawy wrote: On Thu, Apr 4, 2024 at 8:50 AM Alessandro Vesely wrote: I know what "contract" means abstractly, but what does this actually look like to someone that's looking for specific guidance? The text you have here, by itself, is vague

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-04 Thread Douglas Foster
Murray, I was hoping your proposal to advance ARC was serious. Google has solved the problem of limited ARC deployment. To my mind, this means that we cannot revoke the experiment and we cannot do much to change it, so we might as well advance it to standards track. It became a de-facto

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-04 Thread Murray S. Kucherawy
On Thu, Apr 4, 2024 at 8:50 AM Alessandro Vesely wrote: > > I know what "contract" means abstractly, but what does this actually > look > > like to someone that's looking for specific guidance? The text you have > > here, by itself, is vague and I don't think many operators will know > what > >

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-04 Thread Alessandro Vesely
On Wed 03/Apr/2024 18:49:50 +0200 Murray S. Kucherawy wrote: On Wed, Apr 3, 2024 at 4:16 AM Alessandro Vesely wrote: Some sort of contract or agreement between sender and receiver seems to me to be unavoidable if we want to leverage ARC without having a global domain reputation system. We

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-03 Thread Murray S. Kucherawy
On Wed, Apr 3, 2024 at 4:16 AM Alessandro Vesely wrote: > > So what are you suggesting should go in this document that's in WGLC? > > Section 8.6 states the ML problem very well, but it says nothing about the > way forward. Here, we agree. And I'm saying: If we have anything concrete we can

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-03 Thread Douglas Foster
In response to Ale's comment that we describe the mailing list problem without defining a path forward, I suggest the text below. Doug Foster Some legitimate messages are sent on behalf of an individual account, based on an established relationship between the sender and the account owner, but

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-03 Thread Alessandro Vesely
On 02/04/2024 20:16, Murray S. Kucherawy wrote: On Tue, Apr 2, 2024 at 9:01 AM Alessandro Vesely wrote: By now, most mailing lists arranged to either rewrite From: or not break DKIM signatures. We all hope those hacks are temporary. What do you mean by "temporary", given the time scales

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-02 Thread Murray S. Kucherawy
On Tue, Apr 2, 2024 at 9:01 AM Alessandro Vesely wrote: > By now, most mailing lists arranged to either rewrite From: or not > break > DKIM signatures. We all hope those hacks are temporary. > >>> > >>> What do you mean by "temporary", given the time scales that have > already > >>>

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-02 Thread Alessandro Vesely
On Tue 02/Apr/2024 15:35:05 +0200 Murray S. Kucherawy wrote: On Tue, Apr 2, 2024 at 3:01 AM Alessandro Vesely wrote: By now, most mailing lists arranged to either rewrite From: or not break DKIM signatures. We all hope those hacks are temporary. What do you mean by "temporary", given the

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-02 Thread Murray S. Kucherawy
On Tue, Apr 2, 2024 at 3:01 AM Alessandro Vesely wrote: > >> By now, most mailing lists arranged to either rewrite From: or not > break > >> DKIM signatures. We all hope those hacks are temporary. > > > > > What do you mean by "temporary", given the time scales that have already > > passed

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-02 Thread Alessandro Vesely
On Mon 01/Apr/2024 16:35:28 +0200 Murray S. Kucherawy wrote: On Mon, Apr 1, 2024 at 4:44 AM Alessandro Vesely wrote: * Mailing lists — Mailing list operators, including ietf.org, have had to implement rewriting of From addresses such as u...@example.com becomes

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-01 Thread John R. Levine
On Sun, 31 Mar 2024, Jim Fenton wrote: Based on the above problems, I do not think DMARC-bis should be published as a standards track document by IETF. This reminds me of the NAT wars in the 1990s. We all understand that DMARC has a lot of problems, but it's far more widely used than many of

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-01 Thread Murray S. Kucherawy
On Mon, Apr 1, 2024 at 4:44 AM Alessandro Vesely wrote: > > * Mailing lists — Mailing list operators, including ietf.org, have had > to > > implement rewriting of From addresses such as u...@example.com becomes > > user=40example@dmarc.ietf.org when a p=strict or p=quarantine > policy is in

Re: [dmarc-ietf] Overall last-call comments on DMARC

2024-04-01 Thread Alessandro Vesely
Let me add a few comments that seem obvious to me. On Mon 01/Apr/2024 04:00:03 +0200 Jim Fenton wrote: In addition to the editorial review I have provided, I have significant concerns regarding the standardization of DMARC-bis. I do not expect that the working group rough consensus will

[dmarc-ietf] Overall last-call comments on DMARC

2024-03-31 Thread Jim Fenton
In addition to the editorial review I have provided, I have significant concerns regarding the standardization of DMARC-bis. I do not expect that the working group rough consensus will necessarily agree with these concerns, but I want to state them for the working group and will probably