[Bimi] Re: Intentions for an IETF BIMI Working Group

["Murray S. Kucherawy" <[e-mail]>]

Well it's been a few weeks since Seth asked this question, and I was hoping
others might provide their own perspectives before I replied.  But none
have appeared, so here goes:

On Thu, May 16, 2024 at 4:18 PM Seth Blank <[e-mail]> wrote:

> So, yes. We want this work to be done at the IETF. And we understand that
> means it may change significantly. The charter of the AuthIndicators
> Working Group is specifically designed to output a draft spec or specs that
> will then be released freely to go through a public standards body process
> with whatever changes those entail.
>
> Many conversations here have frankly felt like the intent is to pile on
> with all the reasons BIMI won't work, and that no one personally wants
> BIMI. If that's the pretext, we should shut this list down.
>
> However, if there's actually interest on this list in digging in and
> solving these problems collaboratively, having a new BOF, and considering
> chartering a working group, we may be ready to do that for 121.
>
> What's the productive path forward from here?
>

I guess that depends.  I haven't really spoken to anyone about BIMI since
that BoF, and I'm not privy to discussions that have taken place about it
other than what we can see in the archive on this list.  With that context
in mind, here are my thoughts:

I recall that the "B" in "BIMI" stands for "Brand" (https://bimigroup.org)
which just sounds like something with a primarily commercial or advertising
slant to it.  I think that will put people off of working on a protocol in
an open standards body where the outcome mainly benefits operators with a
brand to protect; such a thing doesn't "make the Internet work better".
For instance, the link I referenced above features a page where claims of
logo placement and brand recognition dominate over things like user
security, inter-operator trust, interoperability, efficiency, or any of the
other things the IETF tends to care about advancing.  A possible solution
to this might be to isolate the security problems from those of
presentation, so at least the pure security work will be separate from the
"taint" of what appear to be purely commercial objectives.  Perhaps that's
the "come back when you have this" work to which you refer?  What's the
status of that?

I also think that the IETF in general sees DMARC as a failure, despite the
problem space it does solve, which started about ten years ago now and has
not been cured.  The workarounds are undesirable, and there's almost
certainly some distrust as a result.  As an IESG member, I know that it
remains a recurring topic in management even after all this time.  I think
landing a win in terms of a standards track DMARC that reins in the earlier
problems would go a long way to fixing this, but so far such a solution has
proven elusive, and the energy to drive it appears to be waning.

I would welcome the perspectives of other IETF participants who are also on
this list.  Have I got this wrong?  Or are there other considerations?

-MSK, ART AD