Subject: [dmarc-ietf] DMARC BoF at IETF 87, Berlin

From: Barry Leiba <[email-masked]>
Date: Fri, 28 Jun 2013 13:46:03 -0400

(BCC to apps-discuss)

As some of you may have seen from the preliminary agenda, the App Area
will have one BoF in Berlin: Domain-based Message Authentication,
Reporting & Conformance (DMARC).  See the BoF wiki for details:
http://trac.tools.ietf.org/bof/trac/wiki

The BoF is currently scheduled for Tuesday afternoon, 30 July, from
15:20 to 16:50 Berlin time... though that could change as the IETF
meeting agenda is finalized.

Russ Housley (CC) has agreed to chair the BoF.  Russ is experienced
with what's needed to have a successful BoF, and will make sure we
stay on the right track to answer the questions we need to answer in
order to move forward with a working group, if that's the outcome of
the BoF.  He'll be working with the BoF proponents on the BoF agenda
over the next weeks.

Barry, Applications AD

---

From: Russ Housley <[email-masked]>
Date: Fri, 28 Jun 2013 14:43:25 -0400

> the BoF.  He'll be working with the BoF proponents on the BoF agenda

Thanks Barry.  I very much want the IETF to take on this work.  Fo those people that are new to this topic, by way of introduction, I was the Security AD that sponsored the DKIM BOFs and WG.

The agenda for IETF 87 is very full, and every session must be run efficiently.  I propose that we modify the proposed agenda as follows:
-- Summary of DMARC
-- Summary of open issues
-- Charter review
-- Hums

Comments? Thoughts?

Russ

---

From: "J. Trent Adams" <[email-masked]>
Date: Fri, 28 Jun 2013 14:21:00 -0600

> -- Summary of open issues

Many thanks for your support and encouragement, we're looking forward to
a productive bof in Berlin.

In that light, I think that your suggested streamlining makes sense. 
The item for the "Using DMARC" draft is a reasonable item to consider
setting aside for the proposed WG itself.

- Trent

>
> Russ
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

-- 
J. Trent Adams

Profile: http://www.mediaslate.org/jtrentadams/
LinkedIN: http://www.linkedin.com/in/jtrentadams
Twitter: http://twitter.com/jtrentadams

---

From: "John Levine" <[email-masked]>
Date: 28 Jun 2013 21:16:00 -0000

>that we modify the proposed agenda as follows:
>-- Summary of DMARC

This version presumes that people attending the BOF need to read the
drafts first, which seems utterly reasonable.

For the charter, I think it's important for people to understand that
DMARC is basically done with multiple working implementations
including several at giant mail systems. (I've written one of the
smaller ones.)  So the WG can certainly clean up and clarify the text,
and improve the discussion of where it's useful, but it's too late
to make incompatible changes to the bits on the wire.  

We've also had people who want it to be the magic spam bullet, aka
FUSSP, and demand horrible hacks to fix what they perceive as holes in
the spec, e.g., the alleged mailing list problem.  Those sorts of
changes need to be totally off the table.

Other than that, no prob.

R's,
John

---

From: Dave Crocker <[email-masked]>
Date: Fri, 28 Jun 2013 14:35:17 -0700

> to make incompatible changes to the bits on the wire.

This presumes that the DMARC base specification is part of the working 
group effort.  There's been enough back and forth on this point that 
it's probably worth clarifying it for this list.

To counter the suggestion not to discuss the current "Using" draft: 
Normally a BOF will provide some commentary about documents intended as 
input to the proposed working group.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Russ Housley <[email-masked]>
Date: Sun, 30 Jun 2013 11:47:50 -0400

Barry tells me that the base DMARC specification will be AD sponsored.  Therefore, the BOF will talk about work beyond the base DMARC specification.

Russ

On Jun 28, 2013, at 5:35 PM, Dave Crocker wrote:

> This presumes that the DMARC base specification is part of the working group effort.  There's been enough back and forth on this point that it's probably worth clarifying it for this list.
> 
> To counter the suggestion not to discuss the current "Using" draft: Normally a BOF will provide some commentary about documents intended as input to the proposed working group.
> 
> 
> d/
> 
> -- 
> Dave Crocker

---

From: Scott Kitterman <[email-masked]>
Date: Sun, 30 Jun 2013 11:59:04 -0400

Then why have a BoF at all?  It seems rather premature to discuss work beyond 
the base specification before we know what will be in the base specification.

Scott K

On Sunday, June 30, 2013 11:47:50 AM Russ Housley wrote:
> Barry tells me that the base DMARC specification will be AD sponsored. 
> Therefore, the BOF will talk about work beyond the base DMARC
> specification.
> 
> Russ
> 
> > group effort.  There's been enough back and forth on this point that it's
> > probably worth clarifying it for this list.
> >

---

From: Barry Leiba <[email-masked]>
Date: Sun, 30 Jun 2013 14:47:26 -0400

> the base specification before we know what will be in the base

First, the DMARC spec is sufficiently well baked and mature that it should
provide a solid enough basis for discussion.  It's not likely that changes
to it would be so drastic as to invalidate the BoF results.

Second, the *plan* right now is to have the base spec AD sponsored, but the
BoF could provide input to that plan.  We expect to hear what the community
thinks of the work and how it should proceed, as well as to get a sense of
who will work on it, who will implement it, and that sort of thing.

Barry

---

From: Franck Martin <[email-masked]>
Date: Sun, 30 Jun 2013 19:13:47 +0000

On Jun 30, 2013, at 11:47 AM, Barry Leiba <[email-masked]<mailto:[email-masked]>> wrote:

Scott K

First, the DMARC spec is sufficiently well baked and mature that it should provide a solid enough basis for discussion.  It's not likely that changes to it would be so drastic as to invalidate the BoF results.

Second, the *plan* right now is to have the base spec AD sponsored, but the BoF could provide input to that plan.  We expect to hear what the community thinks of the work and how it should proceed, as well as to get a sense of who will work on it, who will implement it, and that sort of thing.

You can find the spec here: http://tools.ietf.org/html/draft-kucherawy-dmarc-base-00 and it has not much changed (in terms of functionality) since the first release, one year ago: http://dmarc.org/draft-dmarc-base-00-01.txt

It has been 3 months since the spec has been released as an IETF document, where people had the opportunity to comment and as Barry said no drastic changes required have surfaced, and prior to that for more than a year the DMARC group has been taking input from the whole industry. so I'm not expecting any surprise, tho it may happen.

---

From: Scott Kitterman <[email-masked]>
Date: Sun, 30 Jun 2013 15:42:31 -0400

On Sunday, June 30, 2013 07:13:47 PM Franck Martin wrote:
> On Jun 30, 2013, at 11:47 AM, Barry Leiba
> <[email-masked]<mailto:[email-masked]>> wrote:
> 
> Then why have a BoF at all?  It seems rather premature to discuss work
> beyond the base specification before we know what will be in the base
> specification.
> 
> Scott K
> 
> You can find the spec here:
> http://tools.ietf.org/html/draft-kucherawy-dmarc-base-00 and it has not
> much changed (in terms of functionality) since the first release, one year
> ago: http://dmarc.org/draft-dmarc-base-00-01.txt
> 
> It has been 3 months since the spec has been released as an IETF document,
> where people had the opportunity to comment and as Barry said no drastic
> changes required have surfaced, and prior to that for more than a year the
> DMARC group has been taking input from the whole industry. so I'm not
> expecting any surprise, tho it may happen.

So far, comments have been made and I've no idea what, if anything is being 
done with them.  I've got my one pet rock issue and I think that the level of 
writing is not up to par for an IETF standard.  

Here's Russ' mail I was replying to:

On Sunday, June 30, 2013 11:47:50 AM Russ Housley wrote:
> Barry tells me that the base DMARC specification will be AD
> sponsored.  Therefore, the BOF will talk about work beyond the base DMARC
> specification.

This says the base spec is out of scope for the BoF.  Thus my objection.  I 
understand people that have already implemented DMARC are (reasonably) 
cautious about engaging with the IETF in a way that could cause it to change 
incompatibly.  OTOH, I think it's also reasonable for a new protocol that 
directly affects existing IETF protocols to have significant scrutiny.

Scott K

---

From: "John Levine" <[email-masked]>
Date: 30 Jun 2013 20:04:14 -0000

>directly affects existing IETF protocols to have significant scrutiny.

I'm with Scott.  While I agree that it would be bad to make
incompatible changes to the many bits on the wire, the document itself
could be improved.

R's,
John

---

From: Dave Crocker <[email-masked]>
Date: Sun, 30 Jun 2013 13:07:58 -0700

> incompatible changes to the many bits on the wire, the document itself

Indeed, purely editorial, non-technical work rarely (if ever) warrants a 
working group.

And there have recently been some detail, independent reviews that are 
prompted a document revision that will be issued within days.

d/

---

From: Scott Kitterman <[email-masked]>
Date: Sun, 30 Jun 2013 16:30:51 -0400

> prompted a document revision that will be issued within days.

So then we're discussing about a BoF that may or may not include discussion of 
a document that we haven't actually seen yet because it's being developed in 
private.  

1.  Definitely premature to be discussing it.

2.  I don't think the IETF should be in the rubber stamp business.

Scott K

---

From: Franck Martin <[email-masked]>
Date: Sun, 30 Jun 2013 21:09:06 +0000

> 2.  I don't think the IETF should be in the rubber stamp business.

It should not and it is not. Submit you review like Eliot did:
http://www.ietf.org/mail-archive/web/dmarc/current/msg00292.html

I agree with Eliot's review and as Dave pointed, this is all editorial.

And the BoF will indicate if the AD sponsored path is the best path, or if there is substantial work to be done on the protocol. Is it? What work is needed?

---

From: "John Levine" <[email-masked]>
Date: 30 Jun 2013 22:14:43 -0000

> And there have recently been some detail, independent reviews that
> are prompted a document revision that will be issued within days.

While I don't doubt that the next version will be better, I think that
the dmarc.org group needs to make up its mind and either get a
reasonably chartered IETF WG that says no gratuitous changes to the
bits, contribute all of the drafts to the WG, and take its chances. or
else contribute none of them and just send them in via the independent
stream.

I understand why you might want to tell the IETF that it can only
change the minor documents, not the major one, but I don't see why the
IETF would be interested.

R's,
John