Re: [dmarc-ietf] Ticket #55 - Clarify legal and privacy implications of failure reports

[Alessandro Vesely <[e-mail]>]

On Thu 24/Dec/2020 19:55:07 +0100 John R Levine wrote:
>> On Thu 24/Dec/2020 03:39:03 +0100 Tim Wicinski wrote:
>>> I Believe I agree with the current version, but can someone post what we 
>>> think is the final text?
> 
> See below, with the two changes mentioned before and Mr Copy Edit's minor 
> tightening up which I hope are not controversial.
> 
> Ale said:
>> I posted it here:
>> https://github.com/ietf-wg-dmarc/draft-ietf-dmarc-failure-reporting
> 
> Hold it. I don't recall that we agreed to break failure reports into a separate 
> document.


The fact that draft-ietf-dmarc-failure-reporting-00 exists on IETF datatracker 
seems to confirm WG consensus.  But see also:
https://mailarchive.ietf.org/arch/msg/dmarc/2DsSazvE9QxFjVSeg_mdNlRMETM


> It makes more work and I see no agreement to change anything beyond the
> security paragraph.  In particular, we have nothing to offer on what one
> might or might not redact.


I still think it'd be a good idea to mention RFC 6590...

Anyway, the change at hand arose from a ticket, as per Subject:.  After a long 
discussion, the new paragraph was explicitly proposed for the Introduction of 
the separated document, where it is most effective.  IMHO, Ned's wording —which 
you said to ship— is more comprehensive than the abbreviated version quoted 
below, hence preferable.

Why did you change your mind?


Best
Ale


> Security considerations
> 
> Failure reports provide detailed information about the failure of a
> single message or a group of similar messages failing for the same
> reason. They are meant to aid domain owners to detect why failures
> reported in aggregate form occurred. It is important to note these
> reports can contain either the header or the entire content of a
> failed message, which in turn may contain personally identifiable
> information, which should be considered when deciding whether to
> generate such reports.
> 
> _______________________________________________
> dmarc mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dmarc