Re: A new SMTP "3821" [Re: FTC stuff...........]

David Woodhouse <[email protected]> wrote:
> Well yes, this is true; I had assumed we were speaking of things which
> may be achieved by a Turing Machine.

  Which cannot, in theory, perform certain calculations.

  My background is physics, and there's a well-known saying in that
community, which is "if you give us infinite amounts of computing
power, we will need more."

>  In this case there are options which are far cheaper in terms of
> interoperability, which I believe should be one of our primary
> 'cost' criteria.

  But do they do the same thing?  I keep seeing statements like
"proposal X doesn't break forwarding like SPF breaks it".  But when I
look at proposal X, most of the time, it doesn't do MAIL FROM
checking, but something else.  So the comparison is unwarranted.

> [ re: using my domain name ]
>
> No, not in _any_ way they want. They can't publish web pages in your
            ^^
             "almost" is the qualification I used.

> domain, they can't run incoming mail servers for your domains, they
> can't publish your DK/IIM/MS keys and they can't run your SES
> message&address validation server.

  I understand.  Systems use DNS domain names as a way of determining
where to send traffic TO that domain.  But there are no restrictions
on the use of a domain name when traffic is allegedly being sent FROM
that domain.

  For me, that's the crux of the problem.  And it's a hard problem to
solve in the physical world, too.  If you look up the cable company's
address in the phone book and visit there in person, you're pretty
sure it really is the cable company you're talking to.  But if someone
comes to your door and claims to be the cable repair guy, you have few
ways to verify he's really from the cable company.

  In the physical world, these problems are solved by calling the
cable company, and asking them if they send a 6' 250lb guy named
"bob".  If they say yes, then you're likely to let him in.

  Similar approaches should be workable on the net.  e.g. asking a
domain via DNS whether it is really responsible for certain traffic
which is using it's name.

  Alan DeKok.