Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Dave Crocker <[e-mail]>]

On 7/18/2022 9:23 AM, Ken O'Driscoll wrote:
> Non-affiliated MUAs already trust the MTA to deliver messages. Many 
> also trust the MTA to filter spam, virus, phishing etc. The MTA 
> authenticates the MUA. Why does BIMI require an additional MUA-level 
> check at all? What specific risk is it supposed to mitigate?


The concept of end-to-end distinguishes end points from transport 
infrastructure.  There should always be careful consideration of where 
to provide functionality -- endpoint vs. infrastructure. (*)

"Trust" of the infrastructure is not monolithic.  The fact that an MTA 
is trusted to move a message correctly does not mean that it is trusted 
to evaluate and vet the contents of the message. The fact that it is 
assigned some trust for assessing spaminess does not mean it is assigned 
complete trust for all aspects of the content or even all aspects of 
spaminess.

If a design essentially requires an MUA to impart complete trust for 
mail content validity to the platform provider, that's quite a 
substantial departure from historical distributed system design choices, 
even though it is a common implementation choice for some popular services.

At the very least, a specification should explicate its trust choices 
carefully and thoroughly.

d/



(*) The seminal paper on this architectural design issue is:

End-to-end Arguments in System Design
http://web.mit.edu/Saltzer/www/publications/endtoend/endtoend.pdf

This topic is often referred to as the End-to-End Principle and taken as 
a mandate, but the wording of the title is more nuanced, choosing 
'arguments' rather than 'principle'. What it really requires is 
considering tradeoffs in the choices for placement.

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net