Re: [Asrg] misconception in SPF

Christian Grunfeld <christian.grunfeld@gmail.com> Sun, 09 December 2012 15:43 UTC

Return-Path: <christian.grunfeld@gmail.com>
X-Original-To: asrg@ietfa.amsl.com
Delivered-To: asrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B03C221F87E1 for <asrg@ietfa.amsl.com>; Sun, 9 Dec 2012 07:43:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.249
X-Spam-Level:
X-Spam-Status: No, score=-3.249 tagged_above=-999 required=5 tests=[AWL=0.350, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6RVIzj1W9k4Q for <asrg@ietfa.amsl.com>; Sun, 9 Dec 2012 07:43:11 -0800 (PST)
Received: from mail-ie0-f176.google.com (mail-ie0-f176.google.com [209.85.223.176]) by ietfa.amsl.com (Postfix) with ESMTP id 8368021F8681 for <asrg@irtf.org>; Sun, 9 Dec 2012 07:43:11 -0800 (PST)
Received: by mail-ie0-f176.google.com with SMTP id 13so5949502iea.7 for <asrg@irtf.org>; Sun, 09 Dec 2012 07:43:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=K5hBGavCyCSJO/eeNM0RcmNoslj8frfiOlWiqCsBs6I=; b=KmICVOBE30f7Qkt1jyBKC8/Zq4l/L2DO+pJqHHHqmIkegHTmdF2nCLi6KzjXHfhjRA 5kcLP7vN8LabHlvUAYiYC5tBhBagxDk3s6r0rKD/OtZdIhSeu7rsD1VS+rN7yWEAaTQx p+Jl3S6G7f/w9oc1lHWF41ohpKXsaPELUHIgXySXvRyDFkTjAXIys4SW0cHzCSUPYvOy 2J8gKqOtmYPoGtUX69xwdRE7ZLfj2Mkw1PiV+G5B2L1SznWuLTw0IhwNntMygupQM0zu B4f5lWKYe07jvGZZRtXmXjhwEQSC3JXxUpEtI/QoFrVg3gpbAB2ou5ymXeSm/zsXn1HC fq/w==
MIME-Version: 1.0
Received: by 10.50.40.225 with SMTP id a1mr4251766igl.7.1355067790481; Sun, 09 Dec 2012 07:43:10 -0800 (PST)
Received: by 10.231.65.79 with HTTP; Sun, 9 Dec 2012 07:43:10 -0800 (PST)
In-Reply-To: <50C4A7F8.3010201@dcrocker.net>
References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net>
Date: Sun, 09 Dec 2012 12:43:10 -0300
Message-ID: <CAFdugamTbTirVV2zXKOmc9oTaCS+QiTemhT=jvYJnHYscHQK7g@mail.gmail.com>
From: Christian Grunfeld <christian.grunfeld@gmail.com>
To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
Content-Type: text/plain; charset="ISO-8859-1"
Subject: Re: [Asrg] misconception in SPF
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Sun, 09 Dec 2012 15:43:12 -0000

2012/12/9 Dave Crocker <dhc@dcrocker.net>:

> Strange thread.  Mostly seems to be based on using SPF in ways that it is
> not designed to be used.  It's always problematic to criticize a technology
> for failing to provide services that it is not intended to provide.
> An essential point, above, is worrying about "semi-tech-savvy people".
> First, SPF is not for end-users.  It is for receive-side operators and their
> filtering engines.

When operators believes that SPF and their filtering engines are well
configurated but a forged email pass anyway (by means of this thread),
it finally reaches a "semi-tech-savvy user" who is more trusting of
Twitter mail coming from 'bibble.twitter.com' than if it came from
'random.ru'. None of us are saying that simple users deals with SPF
directly !


> Second, embedded technologies, like SPF, cannot be mail fool-proof against
> poor use by operators who misunderstand one or another aspect of the
> technology.  Better software and better documentation are the best one can
> do for them.

yes, this is a misunderstanding and I believe this is a good place to
discuss, isn't it?....but I think is a misunderstanding of a huge part
of the operators..excluding you of course !