Re: [apps-discuss] Updating the status of SPF

[Dave CROCKER <[e-mail]>]

Scott,

I have some questions about the current draft of the charter.  For the moment, 
I'm merely trying to get a better understanding of what is intended:


>       Determining the trustworthiness of content on the Internet remains a

What is meant by "trustworthiness of content"?

Two examples are that it might mean that it really was created by the purported 
author.  Or it might mean that its contents are "valid" (which might invite some 
discussion about "validity", of course.) There are other possibilities.



> 	(RFC4871).  However, legitimate and illegitimate users alike can

What is an "illegitimate user"?


> 	take advantage of these schemes.  What is also required is a
> 	meaningful assessment of the trustworthiness of the identifier's
> 	owner.  This in turn permits making a meaningful choice about what
> 	to do with the associated content.

Is the work of the group intended to cover "what to do with the associated content"?


> 	The advent of the requirement described above creates a need to have
> 	reputation data providers make available to consumers data about

Does "consumers" mean end-users, operators of receiving services, or some other 
group?

If it means end-users, how are they expected to employ this information within 
the current context of the tools end-users have?


> 	An existing, standardized reputation query mechanism is
> 	Vouch-by-Reference (RFC5518), which provides a simple Boolean
> 	response concerning the acceptability of different types of mail.
> 	Other application spaces -- such as Web interactions -- could
> 	benefit from common reputation query mechanisms, especially those
> 	for which replies need to be more elaborate.

Given the existence of VBR, why is an additional reputation query mechanism 
needed?  What will be different in the the mechanism and why is the difference 
important?

Perhaps the new mechanism will be identical to VBR, but merely will have the 
meaning of the response be more general than just email?


> 	This working group will produce a set of documents defining and
> 	illustrating the requirement and defining mechanisms to satisfy it.
> 	Two mechanisms are proposed:
>
> 	* simple -- a reputation is expressed in a simple manner such as
> 		an integer
>
> 	* extended -- a response can contain more complex information
> 		useful to an assessor

Who is going to use each of these mechanisms and why?  Are they participating in 
the discussions so far?  Have they expressed interest in implementing the output 
of the working group?


>
> 	The mechanisms will be designed to be application-independent, and
> 	portable between reputation providers.

For this topic, what does 'application-independent' mean?

What does portable between providers mean?


> 	The group will also produce specifications for reporting reputation
> 	data from end-points (usually end users, such as someone clicking
> 	a "report spam" button in response to unwanted email, or a
> 	"thumbs-up" button in an online rating system) to reputation
> 	data aggregators for use in computing updated reputations.

Reporting to whom?

What will be the basis for choosing among the different possible and existing 
models for reporting spam?

The language appears to equate reporting by end-users with some other forms of 
reporting.  Is there really a basis for conflating these?


> 	Reputation systems such as Realtime Block Lists (RBLs, RFC5782)
> 	can be problematic when not operated properly.  For example, an
> 	RBL that lists a specific source without justification can do harm

By 'source' I assume the meaning is of an listed problem domain, rather than the 
source of the report that the domain is a problem?


> 	to a legitimate business, provoking damages and possible litigation.
> 	This important topic will need to be discussed in the informational
> 	portions of the work produced here, in terms of advice both to

What is meant by "informational portions of the work"?  What output does that 
refer to?

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net