Re: [dmarc-ietf] Time for a change

[Dotzero <[e-mail]>]

On Sun, Aug 16, 2020 at 3:09 PM Douglas E. Foster <fosterd=
[e-mail]> wrote:

>
> The reality is that IETF has mostly provided followership, not leadership,
> on matters of security.  This forum is replicating history.   As has been
> mentioned in the historical review, SPF, DKIM, and DMARC were independently
> successful projects, as was SSL.  IETF provided after-the-fact blessing.
> It is time to follow the same model.
>

Doug, as someone who has been involved in this space for decades, I think
you are sorely mistaken in your understanding of things. Many of the people
involved in the email authentication space interact with each other in
other places, both online and in person and have been doing so for a very
long time.
We don't always agree on the path forward but that is because we come from
different perspectives. IETF did not provide "after-the-fact" blessing. SPF
was experimental for a very long time. DMARC is still informational. One of
the mantras for IETF is "running code and rough consensus". There is
running code for DMARC but what we are lacking so far is rough consensus.

If there is an opportunity to accelerate DMARC adoption, I think it is in
> the area of third-party authentication, presumably based on ATSP.   To move
> the possibility forward, we need to move off this list.  The target
> audience for this capability will be organizations that are non-DMARC or
> DMARC p=none specifically because DKIM delegation is an obstacle.    I have
> no idea whether that category is a trivial or non-trivial group, so we
> would need to find out.  Major ESPs are successfully implementing DKIM
> scope delegation to comply with DMARC, so maybe it is not the issue.   DKIM
> delegation creates complexity which becomes an obstacle to new entrants, so
> big ESPs may like the status quo just fine.   These are all things need to
> be assessed, and are more important than writing a new specification.
>

You can move anywhere you want and write any specification you want but you
still have to attract meaningful interest and adoption in order for it to
become a standard.



>
> Then, we need to expand the base of participants to include people who
> would be willing to implement the third-party authentication scheme after
> it is defined.   I think that list would need to look something like this:
>
>
>    - A national government representative to ensure that any new proposal
>    is not vetoed,
>
> What? Which national government are you referring to? Do you understand
that the IETF is international in it's participation? If you are referring
to the U.S. Government, can you show me a single example of the government
vetoing a technical standard?

>
>    - A financial services industry representative
>    - An Email Service Provider industry representative
>    - A large organization that is holding back on DMARC p=reject because
>    DKIM delegation is an obstacle.
>    - One or more commercial product representatives
>    - I would love to have Verizon Media participate, but I have asked and
>    had no response.
>
> and why would you expect them to respond to you?


> If you want to participate, send me a direct email.    More importantly,
> if you have connections with people who could play the role of influencers,
> reach out to them.
>
> If there are other topics that would move DMARC forward, we can put them
> up for consideration.  If you want to discuss special treatment for mailing
> lists, you are specifically disinvited.
>
>
> Doug Foster
>

Or you could apply for M3AAWG membership where all of those constituencies
participate already.

I wish you luck in your endeavors but I think you are doomed to failure.

Michael Hammer