Subject: [spfbis] SPFBIS proposed charter

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 30 Nov 2011 12:01:04 -0800

Hello all, and welcome to the SPFbis mailing list.

As usual, our first order of business is to hash out a charter for the working group.  Many of you have already seen it privately, and it was circulated and discussed briefly within the APPS area working group session in Taipei and its mailing list.  Attached is the latest version, a product of all of the above.

So the usual questions:

-          Does this charter capture an accurate description of the problem to be solved (in our case, it's really the work to be done)?

-          Is the charter appropriately broad and/or limited in scope?

-          Who is willing to review and comment on documents in the working group?

-          Who is willing to act as document editor(s)?

-          Who is likely to implement (or, since SPF is already out there, who is likely to update their implementations to match any changes in the specs) and participate in interoperability testing?

-          Who is willing to co-chair a working group?

I'll put down my answers as: I agree with the current charter in terms of its goals and scope, and I also volunteer to review and/or edit documents, or act as a co-chair.

Our responses to this will be feedback to the APPS area directors as to whether or not there's enough interest to warrant a BoF in Paris, or even to skip that step and just charter the working group.

Thanks,
-MSK

---

From: Paul Midgen <[email-masked]>
Date: Wed, 30 Nov 2011 20:06:31 +0000

Hi Murray, thanks for putting this all together. You're the man, as usual. I didn't get your attachment, but will base my answers on the assumption that the charter is largely unchanged from the last one I saw. CIL.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Murray S. Kucherawy
Sent: Wednesday, November 30, 2011 12:01 PM
To: [email-masked]
Subject: [spfbis] SPFBIS proposed charter

So the usual questions:

[pmidge] yes

[pmidge] yes

[pmidge] sign me up.

-          Who is willing to act as document editor(s)?
[pmidge] i've seen what you go through doing this, so I'm loathe to sign up to do it, but if you can't and there's nobody else...

-          Who is likely to implement (or, since SPF is already out there, who is likely to update their implementations to match any changes in the specs) and participate in interoperability testing?
[pmidge] we have pre-emptively planned changes to our SPF/SenderID code to pivot on different identities and make it easier to adapt to record format changes.

[pmidge] sign me up.

Thanks,
-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 30 Nov 2011 12:06:58 -0800

Sorry I'm new to this whole email thing, and I failed to attach it.  It's attached here.

So the usual questions:

Thanks,
-MSK

---

From: SM <[email-masked]>
Date: Wed, 30 Nov 2011 13:52:22 -0800

At 12:06 30-11-2011, Murray S. Kucherawy wrote:
>As usual, our first order of business is to hash out a charter for 
>the working group.  Many of you have already seen it privately, and 
>it was circulated and discussed briefly within the APPS area working 
>group session in Taipei and its mailing list.  Attached is the 
>latest version, a product of all of the above.

[snip]

>
>I'll put down my answers as: I agree with the current charter in 
>terms of its goals and scope, and I also volunteer to review and/or 
>edit documents, or act as a co-chair.

I'll volunteer too.

I'll ask the obvious question: are there any strong concerns about 
moving the Sender-ID RFCs to Historic?

BTW, where's the draft-mehnle-spfbis-scope document?

Regards,
-sm

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 30 Nov 2011 13:56:55 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of SM
> Sent: Wednesday, November 30, 2011 1:52 PM
> To: [email-masked]
> Subject: Re: [spfbis] SPFBIS proposed charter
> 

I've contacted the author, and now his boss, to remind him to post it.  :-)

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 30 Nov 2011 15:50:17 -0800

On 11/30/2011 12:01 PM, Murray S. Kucherawy wrote:
> -Does this charter capture an accurate description of the problem to be solved
> (in our case, its really the work to be done)?
>
> -Is the charter appropriately broad and/or limited in scope?

yes.  both.

minor suggestion:

    The two protocols rely on the same policy mechanism,
    ->
    The two protocols rely on the same policy publication mechanism,

(one can argue that their different sources of identifiers constitutes very 
different policies...)

> -Who is willing to review and comment on documents in the working group?

+1

> -Who is willing to act as document editor(s)?

I am actually quite motivated to sign up for this.

Independent of being in love with SPF or not, I am concerned that this spec be 
well written and technically tight.

This is a widely used mechanism and its technical documents need to be easily 
usable by the widest range of developers an operations staff.  That requires the 
simplest technology and the best documents that can tolerable.

Removing unused or problematic features makes a specification easier to 
understand and implement and reduces the likelihood of interoperability 
problems.  Determining what -- if anything -- can be removed is a community 
consensus process, but it requires some research to formulate proposals for 
changes.  The challenge is that any proposal carefully consider the risks of the 
removal, not just the benefits.

Document quality is a technical editing task and I started my career doing that.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 30 Nov 2011 16:03:15 -0800

On 11/30/2011 1:52 PM, SM wrote:
> I'll ask the obvious question: are there any strong concerns about moving the
> Sender-ID RFCs to Historic?

We need to leave Sender-ID alone for this round of effort.  Touching it is 
inviting distraction and delay from producing an SPF specification on standards 
track.

There is nothing that /requires/ touching it as part of the SPF effort.  The 
paper that reviews the two specs is the very most that makes sense to pursue 
now, IMO.

d/
-- 

   Dave Crocker

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 30 Nov 2011 21:24:58 -0500

On 11/30/2011 03:06 PM, Murray S. Kucherawy wrote:
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Murray S. Kucherawy Sent: Wednesday, November 30, 2011
> 12:01 PM To: [email-masked] Subject: [spfbis] SPFBIS proposed
> charter
> 
> group session in Taipei and its mailing list.  Attached is the latest
> version, a product of all of the above.
> 
> So the usual questions:
> 
> 
> -          Does this charter capture an accurate description of the
> problem to be solved (in our case, it's really the work to be done)?
> 
> -          Who is likely to implement (or, since SPF is already out
> there, who is likely to update their implementations to match any
> changes in the specs) and participate in interoperability testing?
> 
> Our responses to this will be feedback to the APPS area directors as
> to whether or not there's enough interest to warrant a BoF in Paris,
> or even to skip that step and just charter the working group.

I'm certainly willing to participate in whatever capacity is needed
within the working group.  I have a strong desire to continue work as
editor for the working group of the 4408bis document I already started
as an input document.

I'm the co-maintainer of one widely deployed SPF library (pyspf) and
intend to implement needed changes from 4408bis (I also maintain a
widely used web based SPF checker and an email based checker that use
this library - I'll update those too).

I'm also glad to work on interoperability testing.  There is an existing
test suite for RFC 4408 SPF that is used by multiple implementations.
Updating that test suite to account for 4408bis changes should make
identifying interoperability issues relatively easy.

http://www.openspf.net/Test_Suite

Charter comments:

I think it's just about exactly what we need.  I agree with Dave
Crocker's comment about sharing a policy publication mechanism between
Sender ID and SPF.  Also (a detail) the last sentence of the first
paragraph should be "... and will seek ..." instead of "... an will seek
...".

Scott K

---

From: Frank Ellermann <[email-masked]>
Date: Thu, 1 Dec 2011 03:51:07 +0100

On 30 November 2011 21:06, Murray S. Kucherawy <[email-masked]> wrote:

> -  Does this charter capture an accurate description of the problem
>    to be solved (in our case, it’s really the work to be done)?

Anything "scope" should be out of scope.  It's a known rat-hole and got
enough visits in the early SPF years.  I strongly object to any "scope"
discussions; please remove the "scope" memo from the Charter.

The known "pra" + "mfrom" + hypothetical "helo" scopes can be handled in
the "conclusion of the experiment" memo.  The implemented mfrom + helo
practice is known as SPF and specified in RFC 4408.

For the memo describing the "experiment" some limited discussion about
technical PRA details not limited to "merits" might be necessary.  It's
not helpful to say in the WG Charter that the topic of this memo is off
topic: "Discussion of the merits of Sender-ID in preference to SPF."

Let this known rathole get its last visit, after all it is for the good
purpose of being the _last_ visit.  CSV can also get a last visit, in a
world without SPF it would be far better than SPF wrt to HELO/EHLO.

> -  Is the charter appropriately broad and/or limited in scope?

You can't say that PRA is off topic if you want to finish this business
in the "conclusion of the experiment" memo.  The WG should be free to
adopt drafts about general SPF topics such as a "modifier registry" for
the SPF-MARF draft, or any EAI considerations.  It should be also free
to ignore these general topics where that's irrelevant for 4408bis.

I'm willing to update or rewrite the SPF-EAI draft if somebody plans to
implement it.  I intend to revive the SPF options draft when and if I
feel that it helps for SPF "modifier registry" or "scope" discussions.

If you run out of volunteers for the "conclusion of the experiment"
memo I can be tempted to help as co-editor (but then there should be a
"plan B" for any extended AWOL periods on my side).

-Frank

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 30 Nov 2011 21:56:58 -0500

> discussions; please remove the "scope" memo from the Charter.

Frank,

Please wait for the draft.  I'm not sure it'll be what you're expecting.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 30 Nov 2011 20:06:19 -0800

> From: Frank Ellermann [mailto:[email-masked]]
> Sent: Wednesday, November 30, 2011 6:51 PM
> To: Murray S. Kucherawy
> Cc: [email-masked]

What Scott said.

> topic: "Discussion of the merits of Sender-ID in preference to SPF."

I think it is helpful.  Failing to call it out in the charter leaves us open to years-old food fights that won't help the current effort in the least, and I'd just as soon avoid that.

It is entirely possible to write a document describing the experiment and its conclusions without carving up the good and bad points of the two protocols.   That's what this charter is attempting to encourage.

> in the "conclusion of the experiment" memo.

I disagree.

> The WG should be free to

The WG is free to do two things:

1) Include stuff like the modifier registry in RFC4408bis, especially if we agree that should've been done in the first place.

2) Recharter to increase its scope if it thinks stuff like helping MARF or EAI would be a good idea.

> feel that it helps for SPF "modifier registry" or "scope" discussions.

Both of those are out of scope for this charter, but you might be able to talk the working group into rechartering to cover them once the first round of deliverables is complete.  Or, for that matter, you could lobby this list to consider adding them now if it's appropriate to do so.

> "plan B" for any extended AWOL periods on my side).

Thanks for volunteering.

-MSK

---

From: Tony Hansen <[email-masked]>
Date: Thu, 01 Dec 2011 00:12:27 -0500

Can I say ditto?

Let me know if I can help in any way.

     Tony

On 11/30/2011 6:50 PM, Dave CROCKER wrote:
> Independent of being in love with SPF or not, I am concerned that this
> spec be well written and technically tight.

---

From: Frank Ellermann <[email-masked]>
Date: Thu, 1 Dec 2011 07:15:23 +0100

On 1 December 2011 05:06, Murray S. Kucherawy <[email-masked]> wrote:

 [unknown scope memo]

> What Scott said.

I've had my share of back-chamber nobody-knows-what-it-is secret late
surprises in MARID, that was enough.  Drop it, you, Scott, or Julian, drop
it, whatever it is.  If it is something good let's talk about it *after*
4408bis is on standards track.

 [conclusion memo]
>> It's not helpful to say in the WG Charter that the topic of this memo is
>> off topic: "Discussion of the merits of Sender-ID in preference to SPF."

> I think it is helpful.  Failing to call it out in the charter leaves us
> open to years-old food fights that won't help the current effort in the
> least, and I'd just as soon avoid that.

That's as easy as 1-2-3 from my POV:  PRA doesn't fly with 822 and 4409
as they were.  6609 intentionally didn't change that, therefore PRA is
still not strictly compatible with "the e-mail architecture".  The idea
to modify header fields of in-transit mail is unpopular, putting it very
mildly.

The idea to add a "responsible submitter" SMTP extension (4405) worldwide
was also unpopular, because it's like some hopeless FUSSP quest.  The SPF
concept of modifying only the envelope sender in forwarding scenarios was
already bad enough for all involved parties, but at least it is derived
from the original STD 10 reverse path concept.

Otherwise, (1) if we could update SMTPs worldwide to support 4405, (2) if
we could decree that 5322 or its successor is STD 11, (3) if we could add
a minor tweak to 6609 explaining the secrets of "MAY add Resent-Sender",
and (4) all forwarders and MUA implementors follow suit, then PRA could
make perfect sense.  But that is obviously not the case, and no happy end
for the PRA story.

The definition (4407) was brilliant, but in practice a focus on "reverse
path" = "mail from" = "envelope sender" turned out to be simpler, or let's
say "bad enough" (for forwarders).

> It is entirely possible to write a document describing the experiment
> and its conclusions without carving up the good and bad points of the
> two protocols.

I doubt it.  I'd agree that it doesn't require more than the 25 lines
above, but obviously the WG has to discuss the content of these 25 lines
when it works on the "conclusion memo".  Do you fear that some PRA fans
pop-up from the woodwork in an odd attempt to repeat MARID from scratch?

Within anything remotely related to the IETF there is only one PRA-fan
I'm aware of, the worst fan it can have: me.

 [suggested charter]

> 1) Include stuff like the modifier registry in RFC4408bis, especially
>    if we agree that should've been done in the first place.

Speedy disagree, creating registries before they are actually needed is
IMHO a bad idea.  The SPF options draft was originally designed to be a
chapter in 4408, and there was consensus to do this elsewhere and later
only when needed, because 4408 was long and complex enough without
such esoteric modifier considerations.

For 4408bis it could make sense to put the (boring) technical details
of a "SPF modifier registry" in a separate memo, and while at it maybe
also move the (fixed) Received-SPF header details to this separate memo,
recommending 5451 in 4408bis proper.

-Frank

---

From: Scott Kitterman <[email-masked]>
Date: Thu, 01 Dec 2011 01:21:31 -0500

> 4408bis is on standards track.

It's not a secret thing, it's just that I've discussed some of Julian's
ideas with him as was fleshing them out.  Since they are his ideas, I'll
wait for him to present them in his draft (which I haven't seen yet
either).  My only point was that if you're going to reject the idea, do
it after you've seen it, not based on what your guess about what it is
based on a title.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 30 Nov 2011 22:37:49 -0800

> Sent: Wednesday, November 30, 2011 10:15 PM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> surprises in MARID, that was enough.  Drop it, you, Scott, or Julian,
> drop it, whatever it is.  If it is something good let's talk about it
> *after* 4408bis is on standards track.
> [...]

This level of hostility will kill this work before it gets off the ground.

But some of us do want to see this proceed.  The proposed charter plots a path forward.  So if you're still nursing MARID wounds that are this deep, then maybe this isn't the right place for you.

-MSK