Re: [dmarc-ietf] Ticket #42 - Expand DMARC reporting URI functionality

[John R Levine <[e-mail]>]

>> I'm sorry but this makes no sense at all.
>
> I said so because you said https is faster.  The spec is unclear about intervals, but this is matter for another ticket.

For any given report, stuffing it into a web server with a PUT or POST 
will be faster than base64 encoding it and relaying it through mail 
servers.  This is just arithmetic.

>> Why do you believe that people would not send reports by mail and by https
>> at the same time?
>
> Oh my.  Hadn't thought about that.  It will certainly cause duplicates.

I meant "at the same time" as in during the same reporting run.  As Dave 
noted, if you sent any particular report by https, there's no need to send 
it again by mail.

Systems receiving reports have to be prepared for duplicates anyway since 
double deliveries of mail messages happens.  That's the point of the 
filename on the report, to provide a unique name for each report so it's 
easy to tell if you've seen a report before.

> $ gpg -u 500982D49712C507C236B2D6B8ABBBF9A091CC0D --clearsign < this text
>
> Can you verify it?  I cannot find how to transform the delta selector public key into a pgp public key block.

It says it can't find a public key which is not surprising.  I still don't 
think this is a productive direction to go.

If people really are worried about fake reports, there is a well defined 
way to put a signature in an XML document.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly