Re: Fwd: Re: [spfbis] SPFBIS proposed charter

This effort definitely needs a co-chair the counteract any ill 
direction this may take.I already see a security problem with the is 
proposed scope extension for the same reasons that any payload 
technology, i.e, Sender-ID, had - forcing high overhead on receivers 
to receive the DATA payload.  We been through these conflicts already 
and SenderID was forced to introduce the SMTP-level SUBMITTER protocol 
to help pre-empt and resolve this critical payload acception conflict. 
  This issue CAN NOT, MUST NOT and WILL NOT be ignored.  That along is 
enough to ignore this effort.

In short, the MAIL-FROM must be SPF verified first before any 
additional scope processing can be done.

    MAIL FROM:   SCOPE TAG, IF ANY (SPFBIS proposal)

    FAIL         don't bother

    PASS         check if available

    SOFT         This is always the case that we had, and why other
                 email authentication was considered to help the
                 indeterminate state.

Here is a heads up:

If this SPFBIS extended scope tag idea attempts to tell SPF receivers 
to bypass the MAIL FROM (or HELO/EHLO check),  then we have a serious 
APPEAL level security problem with this SPFBIS effort.  It would NO 
LONGER be SPF - but a different protocol altogether.


Scott Kitterman wrote:
> FYI.  Anyone who's interested in working on updating SPF should really
> be subscribed to the SPFbis mailing list.  Since decisions are going to
> be made by rough consensus of the people on that list, it would be good
> to have more people with a history of involvement in SPF there.
> 
> Scott K
> 
> -------- Original Message --------
> Subject: Re: [spfbis] SPFBIS proposed charter
> Date: Wed, 30 Nov 2011 12:06:58 -0800
> From: Murray S. Kucherawy <[email protected]>
> To: [email protected] <[email protected]>
> 
> Sorry I'm new to this whole email thing, and I failed to attach it.
> It's attached here.
> 
> 
> From: [email protected] [mailto:[email protected]] On Behalf
> Of Murray S. Kucherawy
> Sent: Wednesday, November 30, 2011 12:01 PM
> To: [email protected]
> Subject: [spfbis] SPFBIS proposed charter
> 
> Hello all, and welcome to the SPFbis mailing list.
> 
> As usual, our first order of business is to hash out a charter for the
> working group.  Many of you have already seen it privately, and it was
> circulated and discussed briefly within the APPS area working group
> session in Taipei and its mailing list.  Attached is the latest version,
> a product of all of the above.
> 
> So the usual questions:
> 
> 
> -          Does this charter capture an accurate description of the
> problem to be solved (in our case, it's really the work to be done)?
> 
> -          Is the charter appropriately broad and/or limited in scope?
> 
> -          Who is willing to review and comment on documents in the
> working group?
> 
> -          Who is willing to act as document editor(s)?
> 
> -          Who is likely to implement (or, since SPF is already out
> there, who is likely to update their implementations to match any
> changes in the specs) and participate in interoperability testing?
> 
> -          Who is willing to co-chair a working group?
> 
> I'll put down my answers as: I agree with the current charter in terms
> of its goals and scope, and I also volunteer to review and/or edit
> documents, or act as a co-chair.
> 
> Our responses to this will be feedback to the APPS area directors as to
> whether or not there's enough interest to warrant a BoF in Paris, or
> even to skip that step and just charter the working group.
> 
> Thanks,
> -MSK
> 
> 
> 

-- 
Hector, Engineering & Technical Support
Santronics Software, Inc.
http://www.santronics.com (sales)
http://www.winserver.com (support)
http://www.winserver.com/AupInfo (Online AUP Help)
Office: 305-248-3204