Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Roland Turner
On 15/11/22 23:30, Alessandro Vesely wrote: On Mon 14/Nov/2022 19:29:10 +0100 Evan Burke wrote: > On Mon, Nov 14, 2022 at 8:03 AM Alessandro Vesely wrote: > >>> The exception is a standardised mechanism to allow a sender/signer to >>> indicate the [approximate] number of intended recipients,

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Roland Turner
On 15/11/22 23:10, Alessandro Vesely wrote: On Mon 14/Nov/2022 18:54:33 +0100 Wei Chuang wrote: > On Mon, Nov 14, 2022 at 8:03 AM Alessandro Vesely wrote: > >> BTW, we all know that mailing lists send one message at a time, doing >> VERP for each subscriber. They can more easily include the

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Roland Turner
On 15/11/22 03:01, Alessandro Vesely wrote: > The exception is a standardised mechanism to allow a sender/signer to > indicate the [approximate] number of intended recipients, with which > receivers might make fact-based decisions about when to recognise an > instance of this particular attack

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Scott Kitterman
On November 16, 2022 4:11:27 AM UTC, Roland Turner wrote: >On 15/11/22 23:29, Murray S. Kucherawy wrote: > >> Wei might argue that their signature means "We attest that this passed >> through us, and we did our best to make sure it was legitimate before it >> went out", than the more

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Roland Turner
On 14/11/22 22:12, Alessandro Vesely wrote: On Mon 14/Nov/2022 01:26:29 +0100 Scott Kitterman wrote: > >> Because of DKIM’s broad deployment, compatibility with existing >> deployments will be a critical factor, and it is unlikely that proposals >> that lack compatibility will proceed to

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Scott Kitterman
On November 15, 2022 3:12:22 PM UTC, Barry Leiba wrote: >On Mon, Nov 14, 2022 at 11:03 AM Alessandro Vesely wrote: >> >> On Mon 14/Nov/2022 05:50:42 +0100 Roland Turner wrote: >> > I'd point out that all but one of those things is either redundant (vs. say >> > ARC), unacceptably harmful (we

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Roland Turner
On 15/11/22 23:29, Murray S. Kucherawy wrote: Wei might argue that their signature means "We attest that this passed through us, and we did our best to make sure it was legitimate before it went out", than the more absolute "We claim this is legitimate and we are willing to stake our

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Roland Turner
On 14/11/22 22:03, Laura Atkins wrote: Does it make sense to add in a brief discussion of ‘responsibility for the message'? As I see it, responsibility implies able to do something against the originator of the message or act to stop the message if it turns out to be a problem. If it’s your

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Roland Turner
On 14/11/22 20:38, Murray S. Kucherawy wrote: On Mon, Nov 14, 2022 at 12:26 AM Scott Kitterman wrote: Is compatibility with DKIM sufficient for  the charter or should there be broader language about compatibility with existing email architecture?  I'm inclined to say

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Roland Turner
On 14/11/22 20:34, Murray S. Kucherawy wrote: On Sat, Nov 12, 2022 at 7:32 AM Roland Turner wrote: On 11/11/22 23:09, Murray S. Kucherawy wrote: More concerning to me: The IETF has previously taken the position that the market will figure out spam and phishing, and therefore

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Roland Turner
On 14/11/22 20:07, Wei Chuang wrote: On Sun, Nov 13, 2022 at 8:50 PM Roland Turner wrote: On 13/11/22 03:05, Wei Chuang wrote: On Fri, Nov 11, 2022 at 11:17 PM Roland Turner wrote: 1. Unless one or more of the larger receivers (a) has a useful tool to

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Barry Leiba
On Mon, Nov 14, 2022 at 11:03 AM Alessandro Vesely wrote: > > On Mon 14/Nov/2022 05:50:42 +0100 Roland Turner wrote: > > I'd point out that all but one of those things is either redundant (vs. say > > ARC), unacceptably harmful (we use DKIM *in the first place* to facilitate > > forwarding

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Murray S. Kucherawy
On Mon, Nov 14, 2022 at 11:04 AM Laura Atkins wrote: > Does it make sense to add in a brief discussion of ‘responsibility for the > message'? As I see it, responsibility implies able to do something against > the originator of the message or act to stop the message if it turns out to > be a

Re: [Ietf-dkim] DKIM reply mitigations: re-opening the DKIM working group

2022-11-15 Thread Alessandro Vesely
On Mon 14/Nov/2022 18:54:33 +0100 Wei Chuang wrote: On Mon, Nov 14, 2022 at 8:03 AM Alessandro Vesely wrote: BTW, we all know that mailing lists send one message at a time, doing VERP for each subscriber. They can more easily include the recipient in the ARC signature. However, any spammer