Re: [Bimi] Bimi Goals (was: Re: Thoughts about MUA/BIMI)

[Dave Crocker <[e-mail]>]

On 8/12/2022 10:58 AM, Brotman, Alex wrote:
> My apologies, I was not trying to suggest that other options cannot be considered.  I was noting how the document/spec is currently designed, and that both goals are important (perhaps independently).  It's entirely possible that we could alter the method to work as you'd suggested a few weeks ago, and the independent MBP can impose their own restrictions which could include any manner of things including DMARC.

Alex,

Your note seems to suggest the idea of parallel mechanisms, as 
alternatives.  In my experience, those don't work.  It was, in fact, a 
hallmark of the excessive complexity created in some/many of the OSI 
specifications.

If you don't mean that, then I'm not clear what you mean, concretely.

Note that while some of my posting(s) today do cite inherent limitations 
of basing Bimi on DMARC, et al,  at least one other posting discusses an 
add-on, for interacting with unaffiliated MUAs, that does not require 
any changes in the existing DMARC dependency.

The larger point I've raised is, really, not a new one, although 
apparently came up fairly recently in Bimi discussion:  Namely the need 
to carefully consider the larger operational context that is to be 
supported and development of very -- very -- clear understanding of the 
needs of that context and the reasons for excluding any plausible cases, 
including threats, operational challenges, semantic challenges -- such 
as loss of rights to use of the image -- etc.

One can easily imagine making a set of choices that only suit a very 
limited set of platform providers.  In business terms, narrowing the 
market segment to be served is hardly unusual.

But to the extent that this work is being done in public -- and 
especially since the discussion here is hosted on an IETF platform -- 
the lack of clarity about those choices should be remedied, IMO.


d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net