Re: [Bimi] (non)desire for bimi

[Stephen Farrell <[e-mail]>]

Hi Terry,

Just on this point for now...

On 14/02/2019 23:36, Terry Zink wrote:
>> In fact, my reading of bimi is that it does attempt to force a
>> receiving MTA/MS to actively download the image(s) and replace
>> the URL with one pointing at the MS (or nearby) - not doing so
>> would expose users of the MUAs using that MS to tracking once
>> those MUAs de-reference bimi URLs from the sender.
> 
> Where does it say that in the BIMI spec?

I'd have to go check the drafts again, but that's how it
was described to me at [1] and that matches my recollection
of the drafts.

Cheers,
S.

[1] https://mailarchive.ietf.org/arch/msg/spasm/cf-jmY5tOx-zIdklMyfLGdp9YqY

> 
> 
> I helped write and edit some of the first documents for BIMI. For the brand, you upload an image somewhere, and create a DNS record that points to it. You then have it signed so that it can be verified by an email receiver. As a mail receiver, you use a bunch of DNS checks along with standard email auth checks to figure out where and if to pull the image.
> 
> 
> As an email receiver, you could choose to pull it from where the brand publishes it (and therefore deal with the unreliability of everyone else's architecture), or you could pull it locally and replicate it on your own infrastructure. Indeed, that's already done today. If I'm an email receiver and I'm showing images based upon my best guess of what a brand's logo is, and a brand instead tells me what the authoritative source is, then I go pick it up from there instead of scraping it from the web.
> 
> 
> If BIMI requires the things you say it does, I'd like to understand where.