On Mon, 2004-10-25 at 19:06, David Woodhouse wrote: /me makes note to remind himself that David Woodhouse is also on this list ;-) Sorry. Though have been a bit of an SPF advocate, I am aware of the flaws and have had *some* second thoughts, lately. However, I beg to differ that simply mentioning it as a possible benefit to some people is inappropriate. This isn't politics or religion we're talking about, it is technology. I could also call any discussion of Mono in Fedora Core inappropriate for my own reasons, but really it's just a matter of opinion on a *technology* issue. And who are you to call Red Hat's publishing of an SPF record an error in judgement? Especially if they have no forwarding issues, it may be an entirely appropriate and beneficial thing for Red Hat to do. Given that they've had it published for a least a few months, I've got to wonder if it might, in fact, be accomplishing exactly what Red Hat wants. Your position on SPF is pretty well known for those who know your postings on the matter. Please don't use the weak (in this case, at least) 'off-topic' argument to suppress any discussion of it. -- -Paul Iadonisi Senior System Administrator Red Hat Certified Engineer / Local Linux Lobbyist Ever see a penguin fly? -- Try Linux. GPL all the way: Sell services, don't lease secrets

On Tuesday 26 October 2004 08:36, Sean Middleditch wrote: In other words, all forms of forwarding email addresses will be down the toilet (sf.net, berlios.de, etc.). Otherwise, you expose two emails both confusing the issue and leaking an otherwise benign email address out. have fun, -- -jeff

On Mon, 2004-10-25 at 21:07 -0400, Sean Middleditch wrote: Right. SPF, if it's to work, requires the whole world to 'upgrade' to make the initial flawed assumptions of SPF come true. This is in the same world which hasn't actually managed to make ESMTP ubiquitous yet. Meng and the others are living in a dream world. Paul Iadonisi writes: How do they _know_ they have no forwarding issues -- that they never send mail to a forwarding address? I'd certainly be surprised if that were the case. There a countless cases of a non-technical company getting someone to register a domain and set up a web site somewhere, and forwarding all mail to that domain to the company's single real AOL address. Is it appropriate for Red Hat to declare that they don't ever want to send mail to such people? Or others who use .forward files or virtual domains to forward mail? -- dwmw2

On Tue, 2004-10-26 at 09:45 -0400, Sean Middleditch wrote: I gave concrete examples showing that this statement is false. You elided them from your reply -- although amusingly you did include the words "you fix them" which you said earlier, at which time you apparently _were_ prepared to acknowledge that a vast number of mail servers out there in the real world are not operating in accordance with the flawed assumptions of SPF. But you're right. This discussion doesn't live on this list. If people want an education in how email actually works in the real world, and hence why SPF is broken, there are many alternative fora in which they can learn. Or they can try running their own mail servers for a few years and learn the fun way. -- dwmw2

On Tue, 2004-10-26 at 17:52 -0700, Z wrote: That wasn't an opinion. That was a statement of fact. My _opinion_ is that it isn't ever going to happen, and that it's not worth the pain of even trying when there are far better alternatives. Nobody with any real clue has claimed that SPF's assumptions are true in the real world today, and that strict SPF publishing and checking would not be throwing away real mail today. To pick a few examples, since you're obviously incapable of understanding the technical points without someone to lead you... Meng Weng Wong (the inventor of SPF in its current form) doesn't disagree: "if we expect it will take 1 to 3 years for the world to upgrade, maybe we can take 1 to 3 years to move from proposed standard to draft standard to standard." -- Meng Weng Wong The people who invented the 'Sender Rewriting Scheme' which needs to be deployed ubiquitously in order to make SPF work don't disagree: "In an SPF world, forwarders need to rewrite the return-path to stay in good standing." -- http://spf.pobox.com/srspng.html Even you yourself didn't seem to disagree on Monday when discussing the vast number of sites out there who have not yet 'upgraded' to SPF's Brave New World, and will probably never do so: Jeff Pitman wrote: Only the ones people are not willing to fix, and breaking them is a good thing. Sean Middleditch didn't seem to disagree either when he said "No. You fix them" in response to the same mail from Jeff. The only people who do seem to disagree are the enthusiastic but dim people who jumped on the bandwagon because it seemed shiny, without really thinking about it. Also perhaps those who are actively and disingenuously avoiding the technical points on which they'll obviously lose any argument, and resorting to ad hominem 'arguments'. The other thing to recognise is that even if this SRS rewriting scheme, where each forwarding host 'takes responsibility' for the mail it's forwarding by rewriting the address, _does_ get deployed ubiquitously, it destroys the information which SPF was originally meant to check. Because any host can rewrite mail in such a way, and all you can actually tell from an SPF pass is how much you can trust the individual mail server which sent you the mail -- it has nothing to do with the address the mail seems to originally come from, and _certainly_ nothing to do with the address in the From: header. So after all this breakage, SPF hasn't even managed to do anything more than saner options like CSV. SPF is fundamentally flawed, and the IETF MARID working group was disbanded. On the other hand, the STRIVERS working group is still very much alive, developing the ideas around Yahoo's DomainKeys, Cisco's IIM, etc. They should come up with a combined solution which gives all the benefits purported by SPF without the breakage. That's what we should be supporting. But since you obviously don't like the technical side of the discussion (and given your complete lack of understanding, who can blame you for that?) I'll leave you with another quote: "When banks start DomainKeys or S/MIME signing all outbound mail, I promise to give up SPF and Sender ID." -- Meng Weng Wong. -- dwmw2

On Thu, 2004-10-28 at 19:35 -0700, Z wrote: I said that the technical assumptions on which SPF is based are flawed. That part is not disputed by anyone with any clue, and since you seem incapable of understanding even the most basic technical explanation, I gave some examples where even known SPF advocates acknowledge the flaw, and try to invent workarounds for it. You seem very confused, because in response to that you seem to be arguing "No, those people _support_ SPF". Which was sort of my point. I also said that in my opinion, those flaws and the difficulty in fixing them renders SPF completely unworkable. That part _is_ disputed by some. What part of that don't you understand? I'm not going to bother to go through your response in detail -- again you ignored the technical points which you obviously cannot answer, and bizarrely tried to concentrate on personalities. You even seem to try to contradict your own previous admission that forwarding servers need to be 'fixed', and now you claim that there is no flaw to be fixed. Although you mostly perform an Ad Hominem attack upon yourself with your own evident cluelessness and self-contradiction, there there are a couple of things in what you said which I suppose I should address: The word 'upgrade' in the above is used in direct reply to an objection that SPF would be throwing away real mail until/unless the whole world manages to 'upgrade' to do something like SRS. It's in a mail in which Meng changed the Subject: line to 'migration strategy for "-all"'. Meng has never to my knowledge claimed that SPF doesn't throw away valid mail in today's world. Only the really clueless hangers-on do that. Your list is extremely disingenuous. Some of those are domains which don't ever send mail, and many of the others aren't publishing records with '-all', so aren't actually asking people to throw away valid mail. Either you're being deliberately dishonest, or you really don't seem to understand what you're talking about. This seems to be a common trait among SPF advocates, in my experience. It looks like I called whoever set up the SPF records for philzimmermann.com and spamassassin.org 'dim', because they're actually publishing records ending in '-all'. In this context I'll stand by that, if those domains ever do actually send mail. Google aren't dim though -- they've implemented DomainKeys instead, and although they do publish an SPF record they end it in '?all' which isn't actually broken; just mostly irrelevant. But I'm not interested in an argument about personalities. Some of us actually have the capacity to think for ourselves and make decisions on technical grounds rather than just following the crowd, so your deceptively-compiled list of SPF publishers doesn't really make any difference. Since you obviously don't seem capable of thinking for yourself or conducting a _technical_ discussion, I suspect this thread isn't really going to achieve anything productive. Please don't bother to respond unless you actually want to discuss the technical points instead of just spouting names at me. -- dwmw2