[Emailcore] Re: [Last-Call] Re: Re: Re: draft-ietf-emailcore-as-28 ietf last call Secdir review

[Eliot Lear <[e-mail]>]

Hi Christian

On 30.04.2026 19:52, Christian Huitema wrote:
>
> I think the important point is that administrators make these 
> decisions. All these variations in software architecture and 
> deployment are valid ways through which the administrators can choose 
> to support ClearText, or not. 

But they can't without great difficulty if the distributions compile out 
capabilities that those same administrators need. That is precisely my 
concern here.  It's worse if the software is proprietary, where you 
don't have access to source.  That's far from the worst case.

A worse case is when people have to fall of the distribution support 
system by compiling their own source.  At that point they won't keep up 
with patches.  The worst case would be if the OSS players decided to 
remove support in their code, making patches yet more unlikely.

> I don't think that the IETF should mandate that the software must have 
> a run time configuration knob, rather than for example a compile time 
> or deployment time knob, especially since having run time options tend 
> to make the code larger and less secure. That's why I don't much like 
> drafts that make requirements such as "implementations must have knobs."

I can't stand knobs.  I hate them with a passion.  But this is not a 
simple ecosystem, there is a wildly massive installed base, and our 
protocol police powers are limited[1]. The RFC series has to give 
unambiguous practical advice to both implementors and operators so that 
those administrators of which you speak can make good choices.  That has 
to transcend academic argument, which, forgive me, it feels as though we 
are having.

What's particularly frustrating about this entire debate is that we 
*all* want people to use STARTTLS as early and as often as possible.  
That's the best route forward.  Reality means that administrators have 
to pick their poison.  And that leads me to two final points:

 1. I would like to know how many people here have actually *tried* to
    disable reception of plain text to know what effect it would have on
    themselves.
 2. I looked at this for myself.  About 90-95% of incoming mail that
    doesn't use STARTTLS is spam.  The rest, however, is important
    enough that I'm not willing to disable plaintext.  I am, however,
    willing to up-rate it in my spam engine.

Eliot

[1] https://www.rfc-editor.org/rfc/rfc9948.html