Subject: [Tools-discuss] Step backwards: <[email-masked]>

From: Brian E Carpenter <[email-masked]>
Date: Wed, 13 Mar 2019 11:45:23 +1300

I noticed that in the last few days, messages such as Gen-ART reviews generated by the tracker have From: fields like "John Doe via Datatracker <[email-masked]>".

This means that Reply won't work at all and Reply All will not include a direct copy to the reviewer (or other message originator).

This change wasn't announced, as far as I know. It's a bug as far as I'm concerned. 

If the reason for this is that some mail systems treat the genuine sender's address as a forgery, OK, but then please generate a Cc: field for the original sender's address, so that at least Reply All will do the right thing.

If that isn't the reason, I believe this change should be reversed.

Regards
   Brian Carpenter

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 13 Mar 2019 00:19:34 +0100

Hi Brian,

On 2019-03-12 23:45, Brian E Carpenter wrote:
> I noticed that in the last few days, messages such as Gen-ART reviews
> generated by the tracker have From: fields like "John Doe via
> Datatracker <[email-masked]>".
> 
> This means that Reply won't work at all and Reply All will not
> include a direct copy to the reviewer (or other message originator).
> 
> If the reason for this is that some mail systems treat the genuine
> sender's address as a forgery, OK, but then please generate a Cc:
> field for the original sender's address, so that at least Reply All
> will do the right thing.

The next datatracker release, which I hope to make tomorrow, will have
the Reply-To: header field set appropriately, using the reviewer or
AD email address which previously was used for the From: field.  

I believe this will make Reply and Reply All work as before, while still
avoiding the troubles we've seen from using a From: address that may
look like a forgery.

> If that isn't the reason, I believe this change should be reversed.

Understood.  Yes, this was the reason for the original change.  I hope
inclusion of the Reply-To: field will make this work better.

Regards,

	Henrik

---

From: "Patrik Fältström" <[email-masked]>
Date: Wed, 13 Mar 2019 08:25:54 +0900

On 13 Mar 2019, at 8:19, Henrik Levkowetz wrote:

> I believe this will make Reply and Reply All work as before, while still avoiding the troubles we've seen from using a From: address that may look like a forgery.

May I suggest stopping changing the body of the email messages (by adding a footer). That way DKIM signatures will work, and the email will indeed not be defined being forgery which in fact they are as long as the body is changed.

   Patrik

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 13 Mar 2019 12:31:39 +1300

Thanks Henrik!

Regards
   Brian

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 13 Mar 2019 04:57:27 +0100

Hi Patrik,

On 2019-03-13 00:25, Patrik Fältström wrote:
>> I believe this will make Reply and Reply All work as before, while
>> still avoiding the troubles we've seen from using a From: address
>> that may look like a forgery.
> 
> May I suggest stopping changing the body of the email messages (by
> adding a footer). That way DKIM signatures will work, and the email
> will indeed not be defined being forgery which in fact they are as
> long as the body is changed.

That is a different issue (that will hopefully be solved by ARC, which
we hope to deploy soon).

Brian is talking about a recent change away from a practice where
when a reviewer would enter his review into the datatracker, it would
originate a mail purporting to be from <[email-masked]>,
and send that out from the server mail.ietf.org, which is not mentioned
in the SPF record of reviewers.domain.

Since this was becoming increasingly troublesome, as more and more
domains were adopting stricter SPF settings, we've stopped sending
mail purporting to be sent by <[email-masked]>, and are
now sending from <[email-masked]>, but we missed adding a Reply-To:
header field that would make replies work as before.

Regards,

	Henrik

---

From: Adam Roach <[email-masked]>
Date: Wed, 13 Mar 2019 00:27:18 -0500

> header field that would make replies work as before.

By the way, this dovetails well into a conversation we had earlier about 
responses to IESG ballots being attached to the ballots, so that the 
entire conversation ends up in the ballot. This would greatly simplify 
the task of IESG members attempting to validate whether review comments 
received responses (and what those responses were). Please consider 
changing <[email-masked]> to instead be <[email-masked]>, and 
make mail sent to <[email-masked]> turn into a comment which is 
then appended to whatever data structure originated the initial email.

/a

---

From: Warren Kumari <[email-masked]>
Date: Wed, 13 Mar 2019 14:30:29 +0900

> then appended to whatever data structure originated the initial email.
Wow, that would be incredibly awesome.

W

> /a
>
> ___________________________________________________________
> Tools-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-discuss
>
> Please report datatracker.ietf.org and mailarchive.ietf.org
> bugs at http://tools.ietf.org/tools/ietfdb
> or send email to [email-masked]
>
> Please report tools.ietf.org bugs at
> http://tools.ietf.org/tools/issues
> or send email to [email-masked]
>

-- 
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf

---

From: "Patrik Fältström" <[email-masked]>
Date: Wed, 13 Mar 2019 17:41:13 +0900

On 13 Mar 2019, at 12:57, Henrik Levkowetz wrote:

> Brian is talking about a recent change away from a practice where when a reviewer would enter his review into the datatracker, it would originate a mail purporting to be from <[email-masked]>, and send that out from the server mail.ietf.org, which is not mentioned in the SPF record of reviewers.domain.
>
> Since this was becoming increasingly troublesome, as more and more domains were adopting stricter SPF settings, we've stopped sending mail purporting to be sent by <[email-masked]>, and are now sending from <[email-masked]>, but we missed adding a Reply-To:

Fun fun fun, multiple interacting interesting bits in the tussle!

Thanks for untangling the bits!

   paf

---

From: Michael Richardson <[email-masked]>
Date: Wed, 13 Mar 2019 19:47:42 -0400

> header field that would make replies work as before.

Wouldn't the @dmarc.ietf.org mangling have also been an option?

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 19 Mar 2019 17:38:15 +0100

Hi Michael,

> Wouldn't the @dmarc.ietf.org mangling have also been an option?

Yees, but much more complex, and with a forced return through the
ietf server, which all seems against KISS.

	Henrik