[Bimi] Forest vs. Trees

[Dave Crocker <[e-mail]>]

Folks,


BIMI sits at the crossroads of challenging security and usability (human 
factors) issues.  It is far too easy to take the collection of submitted 
drafts and focus on their many details, without first establishing the 
basic functional goals and issues, design goals and issues, and 
operational goals and issues.

For all of the text that has been submitted, what is first needed is a 
document that discusses these at a level that allows meaningful 
consideration of its conceptual and operational foundations, so as to 
establish what aspects of BIMI are clear, well understood and tractable, 
vs. what aspects are not, and how the latter can reasonably be resolved.

Of course, the submitted drafts do contain some text tailored to this 
level of discussion, but only as an adjunct to the extensive detail in 
the specifications.  Hence they contain basic descriptions and 
assertions, but lack necessary detail and substantiation.

Merely by way of example, the opening sentence in the Abstract of 
draft-blank-ietf-bimi-00 says:

>    Brand Indicators for Message Identification (BIMI) permits Domain
>    Owners to coordinate with Mail User Agents (MUAs) to display brand-
>    specific Indicators next to properly authenticated messages.

So the principal actors are domain owners and MUAs?  That's probably not 
quite right, since there is reference to brands, without clarifying the 
relationship between brands and domain owners.  (What's intended is 
pretty obvious but actually needs extensive discussion, as John L's note 
from last night exemplifies.)

And then there's "properly authenticated messages" which is reasonable 
if the nature of "properly authenticated" is well understood, but which 
is we regularly see is highly problematic for an average reader who will 
think that the phrase means far more than it actually does.

Again, this is just an example.  Other summary text in the drafts 
invites similar concerns.

I strongly suggest collecting and developing such language into a 
separate, coherent concepts and facilities draft, so that discussion can 
focus on the BIMI forest, before inspecting its trees.


d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net