Re: 9 reasons for dynamic authorization records

On Fri, Feb 13, 2004 at 09:35:26PM +0100, Patrik Fältström wrote:
> >
> >At least I know many users who do so and I received many complaints
> >about RMX from users who felt handicapped because the first version
> >of RMX did not explicetely support this.
> 
> This is one of the main things which "the community" does not agree 
> about, how email is to move in the network.
> 
> From my point of view, mail is _always_ flowing from a client to an 
> outgoing MTA. Then from there using MX records to an incoming MTA which 
> stores mail in a local storage. This is the simple form. Any mechanism 
> which is to be developed at this point in time is a tool which the 
> incoming MTA use to make a decision whether he is to accept the mail 
> from the outgoing MTA.


I do not object. On the contrary: This is what I proposed
as a "clean" structure for SMTP. My proposal in the RMX
drafts was that Mail should always go back the same way
it came down. If you download the mail from anywhere by 
POP3, then you should upload it the same way back. 

I would prefer to have a "bidirectional" POP protocol.


What you're proposing now is exactly what I was proposing
in the RMX drafts, and "the community" did not agree with it.

From a technical point of view, I would agree with you in most cases. 
But as a matter of fact, the community does not.


LMAP will only be widely deployed if most of the domain owners accept
it. We can't ignore such requirements, even if we consider those
people as "clueless".





 
> What people argue about is whether the outgoing MTA can move around, 
> like sitting on the same laptop as the client, and potentially get a 
> new IP address quite often.

This is one argument. Other's required that several machines on 
their network can deliver messages without the need to publicly
reveal which machines these are. A dynamic "yes/no" answer would
easily do the job.






> The primary design (from my point of view, once again) is that the 
> location of the outgoing MTA is decided by the responsible party for 
> the sending domain, and not something the end user can decide.

Exactly. And what if the responsible party wishes to decide in 
a way that can't be expressed in LMAP entries due to shere complexity
or it's dynamic nature? What if the responsible party wishes to 
allow exactly every end user currently logged in from exactly his
IP address?

Most requirements of this type I received, btw, from Universities,
where students, assistants, professors live somewhere around the
campus, and every single one wishes to send e-mail from at home 
with a dynamically assigned IP addresses from different ISPs. 
Since these people insist on doing so, the sysops have already 
announced to cover the full address ranges of the involved ISPs with
their RMX record. Do you really want that?

Do you know the "SMTP after POP" mechanism? My dynamic proposal 
could do this, but for delivery to the world. This would fulfill the
needs of those Universities.








> Further, most people I have talked with which want to be able to "use 
> MX records directly" are people which are at least "semi-geeks" which 
> know how to run sendmail on their laptop _and_ they control the domains 
> they send mail from.

And what about the billion of other users?

And what about the users with operating systems other than 
windows? 



 
> These people should be able to run ddns for their laptop, and at the 
> same time ddns for the email policy which approve sending of mail from 
> the IP address they happen to have.

I agree. This is exactly what I wrote in my RMX drafts. 
Unfortunately, "these people" did not agree all.


Most of the examples people gave are actually odd and not 
well engineered, but I currently see no reason why to not 
support dynamic authorization.




> Summary: A mail which is sent is always to pass a "home outgoing SMTP 
> relay", and the location of it is decided by the administrator of the 
> domain.

Does every MSP who provides the incoming SMTP relay with POP
also provide the outgoing SMTP relay?



 
> If we don't agree on that, we are further apart than what I hoped. And, 
> with "we" I don't mean explicitly you and me Hadmut, but the people on 
> this mailing list.


Oh, I do agree with you that it would be desirable what you describe. 
After all, that's exactly what I wrote into the RMX draft about how
the perfect world should look like. There is not need to convince me
about this.

But I do not agree that this meets the reality. We do not have the
perfect world. Sadly.


The next step would be to ask Microsoft, Mozilla, ... to prepare
their software to give better support for this. Have a new protocol
like bidirectional POP. This would have the advantage that nobody
could complain anymore about firewalls, because if the firewall allows
to fetch e-mail from outside, it will also be possible to deliver.

To fulfill your wishes we would need such a protocol and to 
expunge SMTP from MUAs. 

It would be perfect to have a new protocol which does both 
download and upload of incoming and outgoing messages, 
which can be described with a simple URL, like

bpops://user:[email protected]/

Configuring the MUA would be reduced to entering this URL.

What do you think, how long will it take? 3 years?






> I apologize for the words I used when I wrote my mail. I hope you 
> accept the apology.

Accepted. :-)




> I have asked myself several times whether this request to get a 
> protocol which make it possible to use MX directly from the laptop and 
> not do (for example) DNS updates before they send mail is something we 
> just have to say "no, this will not be possible to implement" to.
> 
> I am just asking.


I see several reasons to allow this:

- Some people do not want to reveal their IP address publicly to 
  the world. If you use DynDNS, some attacker looking for you
  will always know where you are. It's a matter of privacy.

- As far as I am wrong, DynDNS does not have timeouts. If you 
  don't unregister, you will remain registered. Correct me 
  if I'm wrong.

- DynDNS is not as easy as it looks like. 

  It became very common in Germany to have DSL at home with one
  of those cheap and simple access routers. Luckily I have one
  which supports DynDNS, but all other routers I have seen so 
  far at friends and customers don't support it. None of these
  cheap routers supported querying the outer IP address, e.g.
  through SNMP. Can you register at DynDNS without knowing your
  own IP address? Do DynDNS providers accept the sender address in the  
  request or must the IP address be included in the protocol
  itself? How does the laptop know to which IP address it is 
  NATed?

- Even if a router supports DynDNS (such as mine), most of them 
  won't allow to use any server, but have a fixed list of 
  known DynDNS providers, some of them commercially.

  So you would always need those particular DynDNS providers.



But, after all, we all are here to discuss such questions.


regards
Hadmut