Subject: [dmarc-ietf] Meeting in Prague (IETF 99)

From: Barry Leiba <[email-masked]>
Date: Tue, 30 May 2017 01:49:15 +0900

We've had one request for a DMARC session in Prague, with no further
response from the working group.

We've had one suggestion for an interop test in Prague, with no
further response from the working group.

I would like to schedule a session -- at least a short one -- but I'm
not going to do that unless I hear from some people that (1) you'll be
there and (2) we have something useful to discuss face to face.

We have to decide by Friday (so, hey, let's say Thursday to be sure we
don't forget).

Barry, as chair

---

From: "Kurt Andersen (b)" <[email-masked]>
Date: Tue, 30 May 2017 09:41:35 +0800

> further response from the working group.

Yes to both. AFAIK, Steve Jones has been in touch with the hackathon
organizers to have ARC added to the slate. Both Steve and I will be coming
to Prague and several others from the group are expected as well. We also
want to meet with the IETF tools folks to arrange an assisted upgrade to
the IETF listserv to enable ARC signing.

>From my POV, the ARC spec is close to "done". There are a few details that
are turning up from new sets of eyes looking at it as implementations are
built but so far, nothing substantive. I'll have new versions after my
flights at the end of the week (protocol & usage).

To me, the biggest point of discussion has to do with the hypothetical next
milestone for the group which is currently called out as "document[ing]
operational practices..." (the _Draft Guide on DMARC Usage_). While I
understand that was viewed as "something that we could do" when the group
was chartered, I doubt the need for it as an IETF document as time has
passed. I think that discussing the next steps of the group would be
apropos in a F2F meeting.

--Kurt

---

From: "A. Schulze" <[email-masked]>
Date: Tue, 30 May 2017 16:57:44 +0200

> response from the working group.

I didn't follow all ARC discussion over the last months. An update
is welcome. Also it would be helpful if Murray could give an update on his openarc project.
I would welcome a F2F meeting is welcome could push ARC implementations aside the usual big player.

If there would be a meeting on Monday/Tuesday a travel to Prague would be valuable to me,
while I'm sure I'll see some of you soon in Lisbon :-)

Andreas

---

From: Dave Crocker <[email-masked]>
Date: Tue, 30 May 2017 08:03:45 -0700

>   didn't follow all ARC discussion over the last months. An update

However IETF face-to-face meetings are not for reporting.  They are for 
working to resolve outstanding issues.

Reporting can be done on the mailing list, more easily, more completely, 
and far less expensively.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 30 May 2017 11:10:08 -0400

I strongly agree about the "not for reporting" part, but what probably would be good is to get such reports now, so that one might tell whether there's a previously-unnoticed issue with ARC as there turned out to be with DMARC.  If there were such an issue, a meeting would be a good idea. 

Best regards,
Andrew (mostly watching from the cheap seats)

-- 
Andrew Sullivan 
Please excuse my clumbsy thums. 

> On May 30, 2017, at 11:03, Dave Crocker <[email-masked]> wrote:
> 
> 
> However IETF face-to-face meetings are not for reporting.  They are for working to resolve outstanding issues.
> 
> Reporting can be done on the mailing list, more easily, more completely, and far less expensively.
> 
> d/
> 
> -- 
> Dave Crocker
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

---

From: Seth Blank <[email-masked]>
Date: Tue, 30 May 2017 09:34:49 -0700

We've been working with Murray to get OpenARC to completion. As we near the
finish line, a few nuances in the spec have raised concerns, everything has
been brought to the working group. I don't think any of these fall into
"unnoticed issues," just matters that still need resolution.

Open items:
- AMS header/body canonicalization (spec says header=relaxed, body=[c
value] - should both respect c?)
- Should d= and s= be in agreement between AS and AMS
- Clarification of why AARs should be covered by the AMS, and if guidance
is needed in spec

Resolved items:
- Handling of multiple incoming AR headers (resolved, but language not yet
in spec)
- Do we need an arc tempfail concept [rough consensus appears to be no]

Beyond that, I'm bringing one more item to the list shortly regarding
authentication-results stamps for ARC.

For DMARC, I believe the critical issue is how to move the DMARC spec to
standards track.

Seth

On Tue, May 30, 2017 at 8:10 AM, Andrew Sullivan <[email-masked]>
wrote:

> I strongly agree about the "not for reporting" part, but what probably
> would be good is to get such reports now, so that one might tell whether
> there's a previously-unnoticed issue with ARC as there turned out to be
> with DMARC.  If there were such an issue, a meeting would be a good idea.
>
> Best regards,

-- 

Bringing Trust to Email

Seth Blank | Head of Product for Open Source and Protocols
[email-masked]
+1-415-894-2724 <415-894-2724>

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 30 May 2017 12:39 -0400

> - Handling of multiple incoming AR headers (resolved, but language not yet

If this is resolved in favor of not handling multiple AR header fields (which 
IIRC is the plan), then something needs to specify the combination is 
required.  I think that something needs to be a DMARC document, not ARC, 
because this is a requirement that's being imposed on all DMARC AR header 
field providers regardless of if they care about or participate explicitly in 
DMARC.

Scott K

---

From: Seth Blank <[email-masked]>
Date: Tue, 30 May 2017 10:14:29 -0700

[Taking my reply to the initial thread so not to clog this one]

-- 

Bringing Trust to Email

---

From: Barry Leiba <[email-masked]>
Date: Wed, 31 May 2017 03:11:24 +0900

(Putting Murray on explicit CC to alert him to the openarc points.)

> AFAIK, Steve Jones has been in touch with the hackathon
> to Prague and several others from the group are expected as well.

There is an ARC project listed in the Hackathon wiki
<https://www.ietf.org/registration/MeetingWiki/wiki/99hackathon>, with
Steve listed as the project champion.  But neither Steve nor Kurt are
registered for the Hackathon, and neither is anyone else claiming
"ARC" as a project they're interested in.  Will openarc be part of the
Hackathon ARC project?

Anyone who wants to work on this at the Hackathon, please register
(free) for the hackathon
<https://www.ietf.org/registration/ietf99/hackathonregistration.py>...
sooner is better, so we can track who's participating.

> flights at the end of the week (protocol & usage).

If there *are* substantive issues that need discussion, please collect
them and post them here so we can make up an agenda.

> passed. I think that discussing the next steps of the group would be apropos
> in a F2F meeting.

This seems like fodder for a short meeting -- 30 minutes, rather than
even one hour.  I'm happy to request only a 30-minute slot, but let's
see what we really need.  And keep in mind that even if we need to
discuss the next steps, we haven't done that on the list yet, so we
don't know that we need face time for it.

For example, do we need time to bat around possible issues with ARC
that could cause deployment concerns (will senders who want DMARC
protection be willing to allow mailing lists to take that over with
ARC?) or deployment problems that might be different from, but as
severe as, the ones DMARC caused?  Or are those issues settled to the
point where there's not a need to discuss them?  Is the openarc
project in a state where it would be useful to discuss it?

Peter Goldstein's note asking for a meeting in Prague brought up the
"next steps" discussion and also noted that it would be useful to have
contact between the DMARC people and the DCRUP people.  I'll note that
DCRUP will have a session in Prague whether or not we do, and the
crypto issues are probably better discussed there than here for now.
Fallout from it that affects ARC will have to be dealt with after
that.

Barry

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 31 May 2017 15:07:26 -0700

> there and (2) we have something useful to discuss face to face.

I will be in Prague, and I think there's lots of stuff to discuss, but we
only have a small number of people active so I'm fence-sitting on whether
it's worth convening formally.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 31 May 2017 15:11:13 -0700

> is welcome. Also it would be helpful if Murray could give an update on his

I can give an update on the list.  Status reports aren't a good reason to
hold a F2F meeting; meeting time is for discussion.

-MSK

---

From: Seth Blank <[email-masked]>
Date: Wed, 31 May 2017 15:17:04 -0700

I'll also be in Prague, but will unfortunately not be able to make the
hackathon.

I think there are four items for the WG to discuss that most likely will
not be resolved by mid July:
- The ARC specs (the current spec and the proposed spec, and how to merge
if this is what the group wants)
- The AR stamp for ARC
- DMARC reporting of ARC results
- And moving DMARC to standards track / any required rechartering therein

Seth

-- 

Bringing Trust to Email

---

From: "A. Schulze" <[email-masked]>
Date: Thu, 1 Jun 2017 00:25:36 +0200

Am 01.06.2017 um 00:11 schrieb Murray S. Kucherawy:

> I can give an update on the list. 
please :-)

> Status reports aren't a good reason to hold a F2F meeting; meeting time is for discussion.
yes, there whare long disscussion thread on this list, that make it (to me) hard to follow.
But I understand and respect "meeting is not for status update"

Andreas

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 31 May 2017 15:54:50 -0700

> > I can give an update on the list.

OpenARC is effectively in an Alpha state, implementing the -03 draft.  The
code is available via github.

It is correctly validating and generating seals and signatures and
generating ARC-Authentication-Results.  By the time of the M3AAWG meeting
in Lisbon, it will be able to select signing vs. verifying mode (needed for
milter installations) and will be compatible with ValiMail's testing
environment.  It may have indirect integration with OpenDMARC as well.
There's some work to do in terms of documentation of the APIs and some
README type stuff, the usual things you'd expect from a more mature open
source project.  There are a few bugs but they're more in corner cases and
should be ironed out before Lisbon, certainly before Prague.

It's modeled largely after OpenDKIM, so the structure and style should be
familiar to those of you familiar with OpenDKIM.  I expect to be doing
formal releases before Prague.

We have found a number of spec-related issues, some simple and some
fundamental.  I'm pretty sure all of them have been aired by now on the
list, some resolved, some not.

If there are any specific details you'd like to hear about, please feel
free to ask.

-MSK