Subject: [marf] Reorganizing the AS

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 14 Feb 2012 16:01:35 -0800

As I mentioned earlier, I've done some reorganizing of the content in the AS.  The curret result of my work is here:

http://www.blackops.org/~msk/draft-ietf-marf-as.txt

Note: None of the content of the -08 version has been removed here, but a lot of it has been rearranged.  A test-drive of this on a couple of people here before I brought it to the list was quite successful, so now I'm showing it to the group.

Is this a more reasonable starting place for moving forward, or do we want to stick with the -08 version?  If we like it, I'll post it as -09, and then we can talk about another pass of work on it and perhaps a second WGLC.  If not, we'll do that on -08.

-MSK

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 15 Feb 2012 00:11:10 -0500

On Tuesday, February 14, 2012 04:01:35 PM Murray S. Kucherawy wrote:
> As I mentioned earlier, I've done some reorganizing of the content in the
> AS.  The curret result of my work is here:
> 
> Note: None of the content of the -08 version has been removed here, but a
> lot of it has been rearranged.  A test-drive of this on a couple of people
> here before I brought it to the list was quite successful, so now I'm
> showing it to the group.
> 
> Is this a more reasonable starting place for moving forward, or do we want
> to stick with the -08 version?  If we like it, I'll post it as -09, and
> then we can talk about another pass of work on it and perhaps a second
> WGLC.  If not, we'll do that on -08.

It doesn't seem to me to be significantly better or worse, so I'll take either 
one.

I did notice (this is common to both versions) in the authentication failure 
report section:

   1.  Selection of the recipient(s) for reports that are automatically
       generated MUST be done based on data provided by the report
       recipient, and MUST NOT be done heuristically.  Therefore these
       reports are always solicited, though the means for doing so are
       not specified in this memo.

Is there a reason not to just reference the DKIM and SPF drafts that define how 
to select the reporting address?  It seems to me that would be a lot clearer.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 14 Feb 2012 21:19:00 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Scott Kitterman
> Sent: Tuesday, February 14, 2012 9:11 PM
> To: [email-masked]
> Subject: Re: [marf] Reorganizing the AS
> 
> I did notice (this is common to both versions) in the authentication
> failure report section:
> 
> Is there a reason not to just reference the DKIM and SPF drafts that
> define how to select the reporting address?  It seems to me that would
> be a lot clearer.

This appears two paragraphs earlier (in the reorganized version at least):

   There are some cases where report generation is caused by automation
   rather than user request.  A specific example of this is reporting,
   using the ARF format (or extensions to it), of messages that fail
   particular message authentication checks.  Examples of this include
   [I-D.IETF-MARF-DKIM-REPORTING] and [I-D.IETF-MARF-SPF-REPORTING].
   The considerations presented below apply in those cases.

So the selection mechanism is specific to the reporting scheme, and we point off to the two we're developing right now.  That ties it together for me.  What do you think?

-MSK

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 15 Feb 2012 06:41:53 -0500

On Tuesday, February 14, 2012 09:19:00 PM Murray S. Kucherawy wrote:
> > From: [email-masked] [mailto:[email-masked]] On Behalf Of
> > Scott Kitterman Sent: Tuesday, February 14, 2012 9:11 PM
> > To: [email-masked]
> So the selection mechanism is specific to the reporting scheme, and we point
> off to the two we're developing right now.  That ties it together for me. 
> What do you think?

If you change "..., though the means for doing so are not specified in this 
memo." to "as described above." I think that ties it together.  The same text 
is just above in both, so it works either way.

Scott K

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 15 Feb 2012 13:40:58 +0100

On 15/Feb/12 01:01, Murray S. Kucherawy wrote:
> As I mentioned earlier, I’ve done some reorganizing of the content in
> the AS.  The curret result of my work is here:
> 

I particularly appreciate that "Where To Send Reports" has its own
subsection.  However, this version is not substantially  better or
worse than -08, so I'll take either one.

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Wed, 15 Feb 2012 12:31:01 -0500

In <1995466.1FV58W8Wkm@scott-latitude-e6320>, on 02/15/2012
   at 12:11 AM, Scott Kitterman <[email-masked]> said:

>define how  to select the reporting address?  It seems to me that
>would be a lot clearer.

I'd endorse adding such language for messages that are authenticated
by DKIM or SPF, but I believe that the general statement is still
needed for other messages.

-- 
     Shmuel (Seymour J.) Metz, SysProg and JOAT
     Atid/2        <http://patriot.net/~shmuel>
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 15 Feb 2012 15:57:08 -0500

> needed for other messages.

I don't think it's possible for this applicability statement to cover 
arbitrary authentication technologies.  I think it can only address the ones 
we have.  I don't mind if we make the references to the DKIM and SPF drafts 
exemplary, but that doesn't mean arbitrary things will work.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 15 Feb 2012 13:03:43 -0800

> Sent: Wednesday, February 15, 2012 12:57 PM
> To: [email-masked]
> arbitrary authentication technologies.  I think it can only address the
> ones we have.  I don't mind if we make the references to the DKIM and
> SPF drafts exemplary, but that doesn't mean arbitrary things will work.

I prefer this approach as well.  Do you have specific text to suggest (or point me to earlier in this thread)?

-MSK

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 15 Feb 2012 16:12:59 -0500

On Wednesday, February 15, 2012 01:03:43 PM Murray S. Kucherawy wrote:
> > Scott Kitterman Sent: Wednesday, February 15, 2012 12:57 PM
> > To: [email-masked]

>From earlier in the thread:

> If you change "..., though the means for doing so are not specified in
> this memo." to "as described above." I think that ties it together.  The 
> same text is just above in both, so it works either way.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 15 Feb 2012 13:47:06 -0800

> Sent: Wednesday, February 15, 2012 1:13 PM
> To: [email-masked]
> > this memo." to "as described above." I think that ties it together.
> > The same text is just above in both, so it works either way.

How about:

", such as the mechanisms described in the examples listed above."

That way it references the mechanisms (which we've already called "examples" in earlier in that section) while leaving open the idea that others might come in the future.  I think that satisfies both perspectives.

OK with both of you?

-MSK

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 15 Feb 2012 18:48:37 -0500

On Wednesday, February 15, 2012 01:47:06 PM Murray S. Kucherawy wrote:
> > Scott Kitterman Sent: Wednesday, February 15, 2012 1:13 PM
> > To: [email-masked]
> That way it references the mechanisms (which we've already called "examples"
> in earlier in that section) while leaving open the idea that others might
> come in the future.  I think that satisfies both perspectives.
> 
> OK with both of you?

They are already described as examples above, so I don't think it adds 
anything, but if you prefer it, I'm fine with it.

Scott K

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Thu, 16 Feb 2012 03:52:52 -0500

In <2086143.VlEbLfYXfO@scott-latitude-e6320>, on 02/15/2012
   at 03:57 PM, Scott Kitterman <[email-masked]> said:

>I don't think it's possible for this applicability statement to 
>cover arbitrary authentication technologies.

Certainly not in detail, but it is possible to specify general
constraints. The existing text is reasonable for any likely future
techology, it just needs a reference to the specific cases that the
draft discusses in detail.

   1.  Selection of the recipient(s) for reports that are
       automatically generated MUST be done based on data provided
       by the report recipient, and MUST NOT be done heuristically.
       Therefore these reports are always solicited, though the
       means for doing so, other than the cases discussed above,
       are not specified in this memo.

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Thu, 16 Feb 2012 03:55:44 -0500

In
<[email-masked]>,
on 02/15/2012

>", such as the mechanisms described in the examples listed above."

I sent alternative text, but the above is fine with me if you believe
that it is clearer.