Re: [dmarc-ietf] Definitely no Delegated authentication for Gmail

[Douglas Foster <[e-mail]>]

Well John, we have some things to talk about, and it will have to be in
public.   You should remember that you blocked me from direct communication
when I tried to start a side conversation about improving ARC.

I conclude that I am one of the trolls that gets in your way, since I have
been driving the current topic.  You seem to be sorry for calling me names
in public, rather than repenting for the attitude behind it.
Consequently, the apology must have been intended for the chairs, and I
trust they will accept it.  For my part, I have learned to forgive quickly
because I have been forgiven of much.

For my part, I am sorry that you don't like me.    I try to follow the
Biblical maxim that says, "to the extent it lies within you, live at peace
with all men."  Usually, I am successful.  I have searched my own attitude
toward this group in hopes that I am not disliked with reason.

It certainly seems that our relationship soured because I was adamantly
opposed to Dave Crocker's proposal, which repudiated From authentication as
an illegitimate concept, and sought to replace DMARC with impersonation for
everyone.   I joined this group expecting to say little and learn much, but
suddenly I was the only defender of the status quo, so silence was not an
option.

You said in the course of that discussion, "Would you be surprised if I
told you that the From address is not important to me?"   I believe you
also said that DMARC has done more harm than good.

Oddly, the chairs were happy to let the Crocker discussion fester for a
long time.   Dave frequently repeated his original assertions, without
modification, even after they had been thoroughly debunked in the
discussion.   The chairs only objected when I accused Dave of not listening
to me, which was evident.   They assured me that participants had no
obligation to listen to each other.  Eventually, Scott jumped in and
settled the matter with, "this is not DMARC."

I remain a lot confused by your change in roles.   After being DMARC's
fiercest enemy, you became entrenched as the one who controlled what
DMARCbis has become, and the current draft is unimportantly different from
the original.  I was also surprised when Scott became your strong ally.

To be clear, this has become your document.  Your most powerful weapon is
silence, but when talk is needed you have allies who will solidify your
power and your control on this document.   Nothing made this more obvious
than when you said your personal preference would override any pretense of
consensus, and the chairs let that announcement stand unchallenged.
Unfortunately, limiting the document to one viewpoint has introduced
weaknesses.   I am confident that you can move DMARCbis to publication, but
I will most likely ask for my name to be removed, since I have been
prevented from having a meaningful role in avoiding those weaknesses.

The process of creating this document has been slow, so I sympathize with
your frustration.  My wife calls this group "my mistress", because it takes
so much personal time and because it has dragged on for so long.  (It was
illuminating to hear that the original document was completed in 18
months.)   But your control works against progress, not in favor of it.
Topics which are ignored tend to keep coming back.

We have a strange and difficult assignment: a very small group of people
are supposed to figure out what is in the general interest of the large
subset of 8 billion people who will either use email or be affected by
other's use of email.   The intended path to that outcome is collaboration,
with each of us contributing our individual understanding of what is needed
to achieve that goal.   Too much of this archive is filled with
combativeness, rather than collaboration, for which I mostly blame the
chairs.

Which brings us back to my part of the collaboration.   I came to this
group from my role as an evaluator of an incoming mail stream, frustrated
with the vendors who are supposed to protect us, and eager to find a way to
improve email defenses against the combined effects of malicious actors and
bungling vendors.  I had little experience with mailing lists, and my early
participation was not sympathetic to them.  But the Crocker discussion did
change me.   I have been looking, ever since, for ways to bring mailing
lists into the authentication world, even while expressing my frustration
that the problem is one of their own making.

After multiple other options have been considered and failed, I have landed
on ATPS as a solution which is pretty well suited to the problem that the
Crocker proposal was trying to fix.   It is a very serious proposal, and
not an attempt to waste your time.   I hoped you and other mailing list
advocates would be excited, and hoped that you specifically would turn your
considerable brain power toward turning the concept into reality.  Instead,
you are annoyed and the other power players have been oddly silent.

I am ready to collaborate on creating an actual solution to the mailing
list problem, which would make  my years-long investment in this group
worthwhile.  Let's please do this.

Doug Foster






On Sat, Apr 22, 2023 at 6:01 PM John Levine <[e-mail]> wrote:

> My apologies, that was not supposed to go to this list.
>
>
> It appears that John Levine  <[e-mail]> said:
> > [[ rather off list ]]
>
> _______________________________________________
> dmarc mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dmarc
>