Re: Operations requirement: no hop-by-hop

On 15-feb-04, at 22:58, Paul Hoffman / IMC wrote:

> Trying to get back to making this a requirements discussion, you are 
> saying that it is a requirement that the transport mechanism validate 
> policy before delivery.

Why would you transport something that you don't want to have in the 
first place? I don't think we can assume that policy validation is more 
expensive than transport as a general rule so transporting anyway would 
be preferable.

> I am saying that is not a requirement, that the real requirement is 
> that "the sender and the recipient to interact in a sane and automatic 
> way", and further that the result of that interaction be passed to 
> agents for each of them.

Ok.

>> I don't want to have messages transmitted to me that I know I don't 
>> want to see. Especially when they're big.

> Of course. The cost is that you will refuse some messages that you 
> might have actually wanted

That's ok as long as this situation is communicated back to the sender 
so the sender can take appropriate action. Note that doing this today 
is impossible because of all the fake and/or invalid headers in spam 
and even some non-spam.

> Further, the infrastructure that you require is much more prone to 
> silently dropping mail than today's is.

Why?

> The Internet works best when policy is only at, or very close to, the 
> edges. If you disagree with that (and you very well might), your 
> requirements are different than the ones I am describing.

It's all a matter of tradeoffs. You can have very fine grained policies 
OR a multihop system while keeping things simple, or have both but have 
to eat a good deal of complexity.

But I think the mistake we've both been making in this discussion is to 
treat every message as an independent event. It would be good to 
consider having to set up a relationship between the sender and 
recipient first (which could be relatively complex and time consuming) 
and then be able to check whether the sender is authorized to send 
messages of a certain type by looking if there is a valid reference to 
a valid relationship. This check could be relatively fast and simple.