Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: SPF: Discuss

MS Puts SID Patents Under Open Specification Promise

 

 

First page Previous page 1 2 Next page Last page  View All SPF discuss RSS feed   Index | Next | Previous | View Threaded


scott at kitterman

Oct 23, 2006, 2:08 PM

Post #1 of 31 (3059 views)
Permalink
MS Puts SID Patents Under Open Specification Promise

This was mentioned on IRC and I thought it worth passing on.

http://biz.yahoo.com/prnews/061023/sfm078.html?.v=67

http://www.microsoft.com/interop/osp/default.mspx

Scott K

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


william at elan

Oct 23, 2006, 2:35 PM

Post #2 of 31 (2972 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

It should also be noted that this was main topic of discussion on
Saturday SPF council meeting when we went to spf-private.

Feel free to discuss publicly now if and if/how this can effect SPF.

On Mon, 23 Oct 2006, Scott Kitterman wrote:

> This was mentioned on IRC and I thought it worth passing on.
>
> http://biz.yahoo.com/prnews/061023/sfm078.html?.v=67
>
> http://www.microsoft.com/interop/osp/default.mspx
>
> Scott K
>
> -------
> Sender Policy Framework: http://www.openspf.org/
> Archives at http://archives.listbox.com/spf-discuss/current/
> To unsubscribe, change your address, or temporarily deactivate your subscription,
> please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


alex at ergens

Oct 23, 2006, 4:38 PM

Post #3 of 31 (2976 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On Mon, Oct 23, 2006 at 02:35:11PM -0700, william(at)elan.net wrote:

> Feel free to discuss publicly now if and if/how this can effect SPF.

Well...

I have a hard time understanding all the text they wrote, but my
initial thought is that they granted everybody the right to use
their rfc 4408 without having to worry about microsoft's patents.

"...
Security Technologies

This promise applies to all existing versions of the following specifications:
[...]
RFC 4408 - Sender Policy Framework: Authorizing Use of Domains in “Mail From”
[...]
"

So, not only do they abuse existing SPF records in an inappropriate,
incompatible way (by applying SPF records to RFC822 "From:"), now they
explicitly claim rights on rfc 4408.

I'm sure people will tell me if I see this the wrong way. Go ahead please.


If the council agrees with me: what is going to be done?

Alex

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


wayne at schlitt

Oct 23, 2006, 5:08 PM

Post #4 of 31 (2973 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

In <200610231708.28804.scott [at] kitterman> Scott Kitterman <scott [at] kitterman> writes:

> This was mentioned on IRC and I thought it worth passing on.
>
> http://biz.yahoo.com/prnews/061023/sfm078.html?.v=67

For what it is worth, I did send a "Thank you" to Harry Katz. I
appreciate it when MS does the right thing. I don't know if any of us
had anything to do with getting this actually happening, but I would
like to thank MarkS any anyone else who put the effort into contacting
MS about this.


-wayne

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


julian at mehnle

Oct 23, 2006, 5:54 PM

Post #5 of 31 (2987 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alex van den Bogaerdt wrote:
> "...
> Security Technologies
>
> This promise applies to all existing versions of the following
> specifications: [...]
> RFC 4408 - Sender Policy Framework: Authorizing Use of Domains in “Mail
> From” [...]
> "
>
> So, not only do they abuse existing SPF records in an inappropriate,
> incompatible way (by applying SPF records to RFC822 "From:"), now they
> explicitly claim rights on rfc 4408.
>
> I'm sure people will tell me if I see this the wrong way. Go ahead
> please.
>
>
> If the council agrees with me: what is going to be done?

Well, I have been ranting about Microsoft plagiarising SPF before[1]. So
far, though, they have managed to avoid claiming authorship or other
rights _explicitly_. I still do not see them claiming rights _explicit-
ly_. As I see it, they are merely suggesting rights implicitly.

The question is what to do about it. I don't see what we can do about it
except contacting them and asking them to clarify on the relevant web
pages that they do NOT own any rights to SPF or RFC 4408. This is
probably something that Wayne, as one of the authors, should do. Any
comments, Wayne?

I don't think, however, that suing them over it is viable, or would do any
good in the first place.

I'm interested in reading other opinions.

References:
1. http://thread.gmane.org/gmane.mail.spam.spf.discuss/21315/focus=21332

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFPWRgwL7PKlBZWjsRArWtAKDXeQl8l8rWXEDJ/jpZ15YIr0yW8ACgnTw4
f9UPw8h3sHwFAb7p4f0xraQ=
=yQoP
-----END PGP SIGNATURE-----

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


julian at mehnle

Oct 23, 2006, 6:06 PM

Post #6 of 31 (2983 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Julian Mehnle wrote:
> I don't see what we can do about it except contacting them and asking
> them to clarify on the relevant web pages that they do NOT own any rights
> to SPF or RFC 4408. [...]

... which they probably cannot do if they are determined to follow through
on their "Sender ID Framework" marketing strategy. (IOW, I do recognize
that they are plagiarising SPF/RFC4408 deliberately.)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFPWb8wL7PKlBZWjsRAtKXAJ93AFZ0sD+mL24Ay4D0W0rFtZ0F+gCfeMgl
HBRE/AMw+06TwrZZBRJa1bI=
=Z+jE
-----END PGP SIGNATURE-----

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


scott at kitterman

Oct 23, 2006, 6:21 PM

Post #7 of 31 (2985 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On Tue, 24 Oct 2006 01:38:36 +0200 Alex van den Bogaerdt <alex [at] ergens> wrote:
>On Mon, Oct 23, 2006 at 02:35:11PM -0700, william(at)elan.net wrote:
>
>> Feel free to discuss publicly now if and if/how this can effect SPF.
>
>Well...
>
>I have a hard time understanding all the text they wrote, but my
>initial thought is that they granted everybody the right to use
>their rfc 4408 without having to worry about microsoft's patents.
>
>"...
>Security Technologies
>
>This promise applies to all existing versions of the following specifications:
>[...]
> RFC 4408 - Sender Policy Framework: Authorizing Use of Domains in “Mail From”
>[...]
>"
>
>So, not only do they abuse existing SPF records in an inappropriate,
>incompatible way (by applying SPF records to RFC822 "From:"), now they
>explicitly claim rights on rfc 4408.
>
>I'm sure people will tell me if I see this the wrong way. Go ahead please.
>
There is, as I recall, some question about how broad their patent is. By putting RFC 4408 on that list it means they promise not to sue people for patent infringement if they implement RFC 4408. It says nothing about if they actually have a relevant patent.

So, I think that putting 4408 on the list is good. It means they explicitly promise not to sue SPF implementers. I don't think it means they claim any ownership over SPF.

Scott K

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


alex at ergens

Oct 23, 2006, 7:13 PM

Post #8 of 31 (2983 views)
Permalink
Re: Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On Tue, Oct 24, 2006 at 12:54:46AM +0000, Julian Mehnle wrote:

> Well, I have been ranting about Microsoft plagiarising SPF before[1]. So
> far, though, they have managed to avoid claiming authorship or other
> rights _explicitly_. I still do not see them claiming rights _explicit-
> ly_. As I see it, they are merely suggesting rights implicitly.

Initially I also wrote "implicitly", but I decided to change it into
explicitly before hitting send.

According to yahoo:
> "Great progress has already been made on e-mail authentication worldwide,
> with more than 5 million** domain holders adopting Sender ID as a best
> practice today to help protect brands and counter spam and e-mail exploits,"
> said Brian Arbogast, corporate vice president of the Windows Live Platform
> Development Group at Microsoft.
[snip]
> ** Based on findings from MarkMonitor Inc.,
> http://204.228.234.121/SPF/spfReport.htm?spfReportId=218 , and VeriSign Inc.

They hereby say Sender ID and SPF are one and the same. They claim
those 5,000,000 (I'm not disputing this number!) v=spf1 records
are theirs.

At the very least they claim that SPF is part of Sender ID:

> Q: Where can I download the Sender ID specifications?
> A:
> [...]
> RFC 4408 - Sender Policy Framework: Authorizing Use of Domains in “Mail From”
> [...]


If Microsoft really wants to do the right thing, they are going to
announce, very soon, very clear, very often and very public, that
they do not own SPF, that their Sender ID is incompatible with SPF
and that the majority of those 5,000,000 domains have chosen to
implement SPF, not Sender ID.

If they want to _use_ SPF, fine with me. But
a) use the protocol as intended, not in an incompatible way
b) don't {give away|share|promise not to enforce} rights you don't own
c) don't claim SPF's successes to be your own

If Microsoft really wants to promote interoperability, then stealing
technology, changing it slightly but significantly, and claiming
success where there's none (as far as their own work is concerned)
is not the way to convince me.

To quote Wayne, probably quoting someone else (webster?):
> plagiarism
>
> n 1: a piece of writing that has been copied from someone else and is
> presented as being your own work 2: the act of plagiarizing; taking
> someone's words or ideas as if they were your own

I think #2 applies to this case; they count 5 million v=spf1 records
to their Sender ID "success". Sure, literally taken this is not taking
someone's words or ideas. But it is taking success away from someone
else and presenting it as their own.

Contrary to what Scott believes, I do think that they are claiming
the rights to RFC 4408 or, at the very least, deliberately try to
make the general reader believe this.

A small test: take the text on their web page, change Microsoft into
your own name, and modify the list of "Covered Specifications" into
anything Microsoft generated. Do you think you can get away with
promising not to assert any claims you may or may not own ?

I think you cannot. I would not be able to wave my rights to outlook
source code and then in the fine print state "should I have any".
Merely mentioning it on such a page implies that I think I probably
have such rights. And worse, people reading it will think these
rights are mine to give away, thus start using it freely. I would
be sued, big time.

Alex

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


william at elan

Oct 23, 2006, 9:32 PM

Post #9 of 31 (2975 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On Tue, 24 Oct 2006, Alex van den Bogaerdt wrote:

> On Mon, Oct 23, 2006 at 02:35:11PM -0700, william(at)elan.net wrote:
>
>> Feel free to discuss publicly now if and if/how this can effect SPF.
>
> Well...
>
> I have a hard time understanding all the text they wrote, but my
> initial thought is that they granted everybody the right to use
> their rfc 4408 without having to worry about microsoft's patents.

More or less. One issue that worries in general about this page is
"Microsoft irrevocably promises not to assert any Microsoft Necessary
Claims against you for making, using, selling, offering for sale,
importing or distributing any implementation to the extent it conforms
to a Covered Specification"
i.e. they only cover if it is based on the technology document that is
authorized by Microsoft and confirms to it. For SPF however the actual
SPF specification (RFC4408) is listed as well, so I suppose it means
we're covered... But what would that mean if we release new document
for new version of of SPF standard?


> "...
> Security Technologies
>
> This promise applies to all existing versions of the following specifications:

Notice again the use of "existing versions" - see my comment above...

> [...]
> RFC 4408 - Sender Policy Framework: Authorizing Use of Domains in Mail From
> [...]
> "
> So, not only do they abuse existing SPF records in an inappropriate,
> incompatible way (by applying SPF records to RFC822 "From:"), now they
> explicitly claim rights on rfc 4408.

Yes, that is another issue that worries me. By listing SPF document among
the SID documents that rely on PRA they in a way claim that they have some
patent rights that may apply to it. D

> I'm sure people will tell me if I see this the wrong way. Go ahead please.
>
> If the council agrees with me: what is going to be done?

We discussed it briefly and did not have any consensus on what may need to
be done. We may end up discussing this again if there appears to be support
for certain action from SPF community in general.

--
William Leibzon
Elan Networks
william [at] elan

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


william at elan

Oct 23, 2006, 9:44 PM

Post #10 of 31 (2987 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

I'd like to quote parts of FAQ/comments on their page that concerns SID:
[http://www.microsoft.com/interop/osp/default.mspx]:

----------------------------------------------------------------------------
Frequently Asked Questions
...

Q: Is this Promise consistent with open source licensing, namely the GPL?
And can anyone implement the specification(s) without any concerns about
Microsoft patents?

A: The Open Specification Promise is a simple and clear way to assure that
the broadest audience of developers and customers working with commercial
or open source software can implement the covered specification(s). We
leave it to those implementing these technologies to understand the legal
environments in which they operate. This includes people operating in a
GPL environment. Because the General Public License (GPL) is not
universally interpreted the same way by everyone, we can’t give anyone a
legal opinion about how our language relates to the GPL or other OSS
licenses, but based on feedback from the open source community we believe
that a broad audience of developers can implement the specification(s).

SECURITY TECHNOLOGIES

Q: Why are putting Sender ID under the OSP now?

A: In September of this year, Microsoft announced a new approach to the
availability of open specifications. At the time we announced the
application of the Open Specification Promise to 38 Web services
specifications and earlier this month we expanded it to include the
Virtual Hard Disk Image Format specification. At this point, we think we
can promote further industry interoperability among all commercial
software solutions that utilize email authentication, including open
source solutions by making Sender ID more clearly available to the entire
internet ecosystem including customers, partners, ISPs, registrars and the
developer community. This approach complements Microsoft's broader
commitment to combat the spread of spam, phishing, malware and other
exploits in email, as well as interoperability, which we achieve in part
through enabling access to our technology.

Q: Are you making Sender ID available under the OSP because you received
so much criticism for your original licensing approach to the spec?

A: We recognize that there are lingering questions from some members of
the development community about Microsoft's licensing terms and how
those terms may affect developers ability to implement Sender ID. It is
important to note that great progress has already been made on email
authentication worldwide with more than 5 million domain holders adopting
Sender ID as a best practice today. Sender ID helps protect brands, reduce
spam, and counter email exploits. The OSP is a simple, clear way to
reassure a broad audience of developers and customers that any Microsoft
patents ever needed to implement all or part of the specification could be
used for free, easily, now and forever.

Q: What's the significance of the OSP for Sender ID?

A: By extending the OSP to the Sender ID format, Microsoft will help the
industry combat e-mail spoofing and phishing by fostering greater
interoperability among all commercial software solutions for email
authentication, including open source-based solutions. Implementers of the
Sender ID Framework will not need to be concerned about signing a license
in order to implement the anti-spoofing and anti-phishing technology. This
approach also complements Microsoft's broader commitment to
interoperability, which we achieve in part through enabling access to
our technology.

* Microsoft is committed to working with the IT industry and businesses to
help protect consumers and businesses from the blight of online threats.
The Sender ID Framework is an e-mail authentication specification that
helps address domain spoofing – a common tactic used for the spread of
spam, phishing, malware and other exploits in email – by verifying the
domain name from which an e-mail is sent.

* After nearly two years of worldwide deployment to over 600 million
users, Sender ID already enjoys broad industry support, with approximately
36% of all legitimate email sent worldwide Sender ID compliant and an
estimated 5.5 million domains worldwide protected by Sender ID. Adoption
of the Fortune 500 has increased from 7% a year ago to over 23% today

* Email authentication and the ability of validating the identity has
become critical in the face of the increase sophistication and online
threats being propagated. With Sender ID senders and receiving networks
are afforded an additional layer of safety and security from these
exploits.

* Sender ID provides significant business value at no cost and impact to
performance. Today business throughout the world are realizing enhanced
brand and user protection while realizing improved deliverability of
legitimate email. With the addition of Sender ID and the sender's
reputation, false positive are able to be reduced to nearly zero while
false negatives being reduced by over 80%.

Q: Where can I download the Sender ID specifications?

A:
RFC 4406 - Sender ID: Authenticating E-Mail
RFC 4408 - Sender Policy Framework: Authorizing Use of Domains in "Mail From"
RFC 4407 - Purported Responsible Address in E-Mail Messages
RFC 4405 - SMTP Service Extension for Indicating the Responsible Submitter
of an E-Mail Message

...
Feedback From Representatives of the Community
...

SECURITY TECHNOLOGIES

"E-mail security is critical to safeguarding consumer confidence online.
It's important that the entire community adopt interoperable,
easy-to-implement and low-cost platforms to encourage broad adoption of
tools to combat e-mail spoofing and phishing scams. We commend Microsoft
in its effort to foster improved industry cooperation."

Ramesh Lakshmi Ratan
Executive Vice President and Chief Operating Officer
Direct Marketing Association (DMA)

"The ESPC members have long recognized the need for strong spam
solutions that help ensure the delivery of legitimate e-mail, and we
welcome Microsoft’s announcement today as another positive step for the
delivery of safe and authentic e-mails."

Trevor Hughes
Executive Director
Email Sender & Provider Coalition (ESPC)

"As a leading Internet gateway security provider, we are interested in
seeing the best anti-spam products get to market to improve trust and
confidence in e-mail. Moving the Sender ID specification under the OSP is
an important move by Microsoft, and we hope it will result in widespread
adoption across the industry."

Patrick Peterson
Vice President, Technology
IronPort Systems Inc.

"Sender authentication technologies like Sender ID are important tools
that help ensure e-mail security, and by making Sender ID available under
the OSP, Microsoft is addressing the interoperability needs of
heterogeneous e-mail infrastructures. We're pleased to see this
development and believe it's a positive step in the fight against
spoofing, phishing and other categories of unwanted messaging"

Eric Allman
Chief Science Officer
Sendmail Inc.

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


nobody at xyzzy

Oct 23, 2006, 11:38 PM

Post #11 of 31 (2984 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

william(at)elan.net wrote:

> what would that mean if we release new document for new version
> of SPF standard?

There's no clear "we" in the process of creating 4408bis drafts,
it's a wild mixture including the authors of such drafts, the
authors of 4408, a sponsoring IETF AD, IESG procedures, an IETF
last call, statements by the SPF council, etc.

You say "standard". AFAIK the only existing SPF standard is what
the SPF council identified as SPF standard, an IETF "experiment"
published in RFC 4408 (+ errata).

>> This promise applies to all existing versions of the following
>> specifications:

> Notice again the use of "existing versions" - see my comment above

In other words it covers also implementations based on the drafts
published before the relevant RFCs. Their "promise" is a legal
statement, it can't talk about unknown future specifications

> By listing SPF document among the SID documents that rely on PRA
> they in a way claim that they have some patent rights that may
> apply to it

We (TINW) know that this isn't the case for 4408. And as far as
I'm concerned it also isn't the case for 4407, that's merely a
nice excerpt from 2822 stating the obvious way how to interpret
some mail header fields if there's no Return-Path.

Their list IMO says "whatever rights we might have in 4405...4408,
anybody is free to use these specifications as (s)he sees fit, as
far as we (= MS) are concerned."

> We may end up discussing this again if there appears to be
> support for certain action from SPF community in general.

You could welcome their statement on behalf of the SPF community,
pointing out that SPF was of course never affected by their prior
legalese, alive and kicking, current activities in the field like
the test suite, oo

Frank


-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


jmacdonald at e-dialog

Oct 30, 2006, 10:26 AM

Post #12 of 31 (2955 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On Tue, Oct 24, 2006 at 01:38:36AM +0200, Alex van den Bogaerdt wrote:
> So, not only do they abuse existing SPF records in an inappropriate,
> incompatible way (by applying SPF records to RFC822 "From:")

I brought this topic up at the recent MAAWG meeting in Toronto. I
basically said to Craig Spiezle 'stop telling people to publish v1
records for SenderID'.

I also asked Harry Katz if MS has ever done MFROM evaluation. He
responded 'never'.

I'll keep pressing the issue at every conference/meeting I'm at.


--
:: Jeff Macdonald | Principal Engineer, Messaging Technologies
:: e-Dialog | jmacdonald [at] e-dialog
:: 131 Hartwell Ave. | Lexington, MA 02421
:: v: 781-372-1922 | f: 781-863-8118
:: www.e-dialog.com

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


william at elan

Oct 30, 2006, 1:33 PM

Post #13 of 31 (2937 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On Mon, 30 Oct 2006, Jeff Macdonald wrote:

> On Tue, Oct 24, 2006 at 01:38:36AM +0200, Alex van den Bogaerdt wrote:
>> So, not only do they abuse existing SPF records in an inappropriate,
>> incompatible way (by applying SPF records to RFC822 "From:")
>
> I brought this topic up at the recent MAAWG meeting in Toronto. I
> basically said to Craig Spiezle 'stop telling people to publish v1
> records for SenderID'.
>
> I also asked Harry Katz if MS has ever done MFROM evaluation. He
> responded 'never'.
>
> I'll keep pressing the issue at every conference/meeting I'm at.

Thank you much for such effort.

--
William Leibzon
Elan Networks
william [at] elan

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


alex at ergens

Oct 30, 2006, 1:43 PM

Post #14 of 31 (2959 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On Mon, Oct 30, 2006 at 01:26:30PM -0500, Jeff Macdonald wrote:

> I also asked Harry Katz if MS has ever done MFROM evaluation. He
> responded 'never'.

Just so that I don't get you wrong; you are saying here that
MS never looked at RFC 821 "MAIL FROM", only at RFC 822 "From:" ?

tia
Alex

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


nobody at xyzzy

Oct 30, 2006, 4:31 PM

Post #15 of 31 (2959 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

Alex van den Bogaerdt wrote:

> Just so that I don't get you wrong; you are saying here that
> MS never looked at RFC 821 "MAIL FROM", only at RFC 822 "From:" ?

As part of the PRA. Thanks to Jeff for the MAAWG report.

Frank


-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


deving at 3sharp

Oct 31, 2006, 7:18 PM

Post #16 of 31 (2941 views)
Permalink
Re: Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On 10/31/06 8:26 PM, "Jeff Macdonald" <jmacdonald [at] e-dialog> wrote:

> On Tue, Oct 31, 2006 at 01:31:08AM +0100, Frank Ellermann wrote:

>> Alex van den Bogaerdt wrote:

>>> Just so that I don't get you wrong; you are saying here that
>>> MS never looked at RFC 821 "MAIL FROM", only at RFC 822 "From:" ?

>> As part of the PRA. Thanks to Jeff for the MAAWG report.

> Correct, MS just does PRA checking, not RFC 821 MAIL FROM checking,
> even though SenderID allows such checks.

Can you be more precise? Are you saying that MS implementations (such as
Exchange) do PRA checks on v=spf1 records instead of MAIL FROM checks, or
are you saying that they do PRA checks on v=spf1 records for Hotmail/MSN?

I'm giving a session on Sender ID and SPF next week at Exchange Connections
in Las Vegas, and if the Exchange Sender ID implementation is broken in this
fashion, I'd like to let people know.

If anyone wants to look over the PowerPoint slides for the previous version
of this session (I gave it last April), it's at:

http://www.3sharp.com/files/deving/exc02.ppt

I would VERY much appreciate any comments, clarifications, and advice. I've
already marked away some time this weekend to update the presentation with
the talking points from the SPF vs. Sender ID page.

--
Devin L. Ganger Email: deving [at] 3sharp
3Sharp LLC Phone: 425.882.1032 x 109
15311 NE 90th Street Cell: 425.239.2575
Redmond, WA 98052 Fax: 425.702.8455
(e)Mail Insecurity: http://blogs.3sharp.com/blog/deving/

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


jmacdonald at e-dialog

Oct 31, 2006, 7:26 PM

Post #17 of 31 (2940 views)
Permalink
Re: Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On Tue, Oct 31, 2006 at 01:31:08AM +0100, Frank Ellermann wrote:
> Alex van den Bogaerdt wrote:
>
> > Just so that I don't get you wrong; you are saying here that
> > MS never looked at RFC 821 "MAIL FROM", only at RFC 822 "From:" ?
>
> As part of the PRA. Thanks to Jeff for the MAAWG report.

Correct, MS just does PRA checking, not RFC 821 MAIL FROM checking,
even though SenderID allows such checks.


--
:: Jeff Macdonald | Principal Engineer, Messaging Technologies
:: e-Dialog | jmacdonald [at] e-dialog
:: 131 Hartwell Ave. | Lexington, MA 02421
:: v: 781-372-1922 | f: 781-863-8118
:: www.e-dialog.com

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


deving at 3sharp

Oct 31, 2006, 7:53 PM

Post #18 of 31 (2942 views)
Permalink
Re: Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On 10/31/06 9:34 PM, "Scott Kitterman" <scott [at] kitterman> wrote:

> On Tuesday 31 October 2006 22:18, Devin Ganger wrote:

>> Can you be more precise? Are you saying that MS implementations (such as
>> Exchange) do PRA checks on v=spf1 records instead of MAIL FROM checks, or
>> are you saying that they do PRA checks on v=spf1 records for Hotmail/MSN?

> It's both.

Wow. That's completely in violation of the way MS's own documentation
describes their Sender ID implementation working.

Does anybody have any pointers to constructing a test case that can clearly
demonstrate this? If I have time, I'd love to be able to get a working demo.
Conferences love a good show and tell.

>> I would VERY much appreciate any comments, clarifications, and advice. I've
>> already marked away some time this weekend to update the presentation with
>> the talking points from the SPF vs. Sender ID page.

> When do you need comments by?

I need them by Sunday, 05 Nov, so I can finish up the slide deck on Monday.
I'd prefer to get them sooner, of course, so I can internalize, research,
and verify.

Thanks in advance, everyone. I've been a huge advocate of Sender ID
precisely because I believed that it was backwards-compatible with SPF. If
it's not, then I'll be writing, speaking, and blogging about it a lot.

--
Devin L. Ganger Email: deving [at] 3sharp
3Sharp LLC Phone: 425.882.1032 x 109
15311 NE 90th Street Cell: 425.239.2575
Redmond, WA 98052 Fax: 425.702.8455
(e)Mail Insecurity: http://blogs.3sharp.com/blog/deving/

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


scott at kitterman

Oct 31, 2006, 8:34 PM

Post #19 of 31 (2956 views)
Permalink
Re: Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On Tuesday 31 October 2006 22:18, Devin Ganger wrote:

> Can you be more precise? Are you saying that MS implementations (such as
> Exchange) do PRA checks on v=spf1 records instead of MAIL FROM checks, or
> are you saying that they do PRA checks on v=spf1 records for Hotmail/MSN?

It's both.

> I'm giving a session on Sender ID and SPF next week at Exchange Connections
> in Las Vegas, and if the Exchange Sender ID implementation is broken in
> this fashion, I'd like to let people know.

That would be good.

> If anyone wants to look over the PowerPoint slides for the previous version
> of this session (I gave it last April), it's at:
>
> http://www.3sharp.com/files/deving/exc02.ppt
>
> I would VERY much appreciate any comments, clarifications, and advice. I've
> already marked away some time this weekend to update the presentation with
> the talking points from the SPF vs. Sender ID page.
>
When do you need comments by?

Scott K

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


deving at 3sharp

Oct 31, 2006, 8:51 PM

Post #20 of 31 (2933 views)
Permalink
Re: Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On 10/31/06 10:23 PM, "Scott Kitterman" <scott [at] kitterman> wrote:

> On Tuesday 31 October 2006 22:53, Devin Ganger wrote:

>> Does anybody have any pointers to constructing a test case that can clearly
>> demonstrate this? If I have time, I'd love to be able to get a working demo.
>> Conferences love a good show and tell.

> Something like this:

<snip test cases>

Perfect. I'll get this set up and tested in the next couple of days, then
rattle some cages with my contacts at Microsoft.

Thanks again for the assistance.

--
Devin L. Ganger Email: deving [at] 3sharp
3Sharp LLC Phone: 425.882.1032 x 109
15311 NE 90th Street Cell: 425.239.2575
Redmond, WA 98052 Fax: 425.702.8455
(e)Mail Insecurity: http://blogs.3sharp.com/blog/deving/

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


nobody at xyzzy

Oct 31, 2006, 9:05 PM

Post #21 of 31 (2937 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

Devin Ganger wrote:

> http://www.3sharp.com/files/deving/exc02.ppt

Hi, some IETF "edu" slideshows are also PowerPoint. I like
them better than PDF, because they always come with a HTML
version. I don't know how they do the conversion, maybe it's
just a "save as" option, or it's a secret(ary) IETF tool. :-)

Frank


-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


scott at kitterman

Oct 31, 2006, 9:23 PM

Post #22 of 31 (2936 views)
Permalink
Re: Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On Tuesday 31 October 2006 22:53, Devin Ganger wrote:
> On 10/31/06 9:34 PM, "Scott Kitterman" <scott [at] kitterman> wrote:
>
> > On Tuesday 31 October 2006 22:18, Devin Ganger wrote:
>
> >> Can you be more precise? Are you saying that MS implementations (such as
> >> Exchange) do PRA checks on v=spf1 records instead of MAIL FROM checks, or
> >> are you saying that they do PRA checks on v=spf1 records for Hotmail/MSN?
>
> > It's both.
>
> Wow. That's completely in violation of the way MS's own documentation
> describes their Sender ID implementation working.
>
> Does anybody have any pointers to constructing a test case that can clearly
> demonstrate this? If I have time, I'd love to be able to get a working demo.
> Conferences love a good show and tell.

Something like this:

spf.example.com IN TXT "v=spf1 a:example.com -all"
nospf.example.com - NO TXT record

Construct a mail message as follows:

Mail From: testuser [at] nospf
....

From: testuser [at] nospf
Sender: testuser [at] spf

Send it to an Exchange box with the MS SID implementation enabled. I expect
you will get a SID PASS result. This shows v=spf1 used for PRA.

Then try:

Mail From: testuser [at] nospf
....

From: testuser [at] spf
Sender: testuser [at] nospf

Expected result is NONE. This shows why PRA is useless (most MUAs don't
display sender).

Then try:

Mail From: testuser [at] spf
....

From: testuser [at] spf
Sender: testuser [at] nospf

This should remain none. This shows Mail From not checked.

Finally try:

Mail From: testuser [at] spf
....

From: testuser [at] spf

This should get a SID pass and reinforce it's just PRA they are doing.

Scott K

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


alex at ergens

Nov 1, 2006, 3:55 AM

Post #23 of 31 (2948 views)
Permalink
Re: Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

Please all: verify my scenario. It would be sad if there
is an error in it, or even a typo.


On Tue, Oct 31, 2006 at 08:53:09PM -0700, Devin Ganger wrote:

> Does anybody have any pointers to constructing a test case that can clearly
> demonstrate this? If I have time, I'd love to be able to get a working demo.
> Conferences love a good show and tell.

------------------------------------------------------------------------
Two domains:

example.com
example.net

Use one of them for your RFC821 "MAIL FROM" address,
use the other for your RFC822 "From:" address.

example.com TXT "v=spf1 ip4:192.0.2.1 -all"
example.net TXT "v=spf1 -all"

A machine with address 192.0.2.1 connects and says:

1: HELO example.com
2: MAIL FROM:<user [at] example>
3: RCPT TO:<some receiver verifying SPF>
4: DATA
5: ...
6: From: "me" <user [at] example>
7: ...
8: .

Lines 5 and 7 contain irrelevant stuff. They do not contain lines
that would make SID not look at line 6.

Result:

-1- SPF: looks only at lines 1 and 2. Both match, SPF gives a PASS
-2- SID/PRA: looks at line 6. Results in FAIL.

Why has "example.net" published the record as is? Because example.net
is never used as sender address (RFC821). That's why. And this is
what SPF records are about, so this setup is quite clever and quite
legal as far as SPF is concerned. Without SPF, it is legal as well.

But now we cannot send to hotmail, because MS looks at line 6, not 2.

OK, let's try and opt-out of SenderID:

example.com TXT "v=spf1 ip4:192.0.2.1 -all"
example.net TXT "v=spf1 -all"
example.net TXT "spf2.0/pra ?all" [TODO: verify and/or correct]

Reasoning: microsoft will use the 3rd TXT record for its protocol, SPF
uses the 1st and 2nd. This is bad: in stead of opting in, I have to
opt out. But alas, let's do this anyway. I publish PRA and opt out.

Not so !!! Hotmail will not use the spf2.0 record, thus not only does
MS abuse SPF records in a totally wrong way, we can't even opt-out.
------------------------------------------------------------------------

I believe we have seen something similar, years ago, on this list.
Frank if memory serves me well?


regards
Alex

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


jmacdonald at e-dialog

Nov 1, 2006, 7:45 AM

Post #24 of 31 (2946 views)
Permalink
Re: Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

On Wed, Nov 01, 2006 at 12:23:29AM -0500, Scott Kitterman wrote:
> Then try:
>
> Mail From: testuser [at] nospf
> ....
>
> From: testuser [at] spf
> Sender: testuser [at] nospf
>
> Expected result is NONE. This shows why PRA is useless (most MUAs don't
> display sender).

Some MUAs will display this (outlook for example):

From: <value of sender header> on behalf of <value of RFC822 From header>


--
:: Jeff Macdonald | Principal Engineer, Messaging Technologies
:: e-Dialog | jmacdonald [at] e-dialog
:: 131 Hartwell Ave. | Lexington, MA 02421
:: v: 781-372-1922 | f: 781-863-8118
:: www.e-dialog.com

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2


nobody at xyzzy

Nov 1, 2006, 7:49 AM

Post #25 of 31 (2943 views)
Permalink
Re: MS Puts SID Patents Under Open Specification Promise [In reply to]

Alex van den Bogaerdt wrote:

> I believe we have seen something similar, years ago, on this list.
> Frank if memory serves me well?

My case or the almost identical "Olson-objection" was that:

xyzzy.claranet.de : "v=spf1 something -all" (not under my control)
mailoutx.hamburg.example + hamburg.example : "" (no SPF policy)

EHLO mailoutx.hamburg.example
MAIL FROM:<me [at] hamburg>
DATA
...
From: nobody [at] xyzzy
...

The MSA.hamburg.example "enforced submission rights" to harden its
SMTP-after-POP setup, therefore I had to use <me [at] hamburg>
as MAIL FROM, as specified in RFC 4409 6.1 (at that time 2476 6.1).

Otherwise my MUA doesn't care which provider I use to send pending
mails in its "outbox", it won't add any "Sender" header field. The
MSA also didn't care what I do within my mail, it only verified the
MAIL FROM.

Therefore the PRA was nobody [at] xyzz, and any SenderID PRA check of
"my" SPF policy - the "my" is limited to "I proposed it, and my ISP
implemented it" - would result in a PRA FAIL.

In theory that's still the case, in practice I don't use this MSA
anymore. Nobody bothered to tell my ISP that they might wish to
"opt-out" from PRA because that was proposed in some obscure draft
published about six months after "my" perfectly fine SPF policy.

Frank


-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss [at] v2

First page Previous page 1 2 Next page Last page  View All SPF discuss RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.