Re: [ietf-822] don't need a permission to re-sign header

"John Levine" <johnl@taugh.com> Tue, 22 April 2014 20:24 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: ietf-822@ietfa.amsl.com
Delivered-To: ietf-822@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 308A01A025D for <ietf-822@ietfa.amsl.com>; Tue, 22 Apr 2014 13:24:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 2.343
X-Spam-Level: **
X-Spam-Status: No, score=2.343 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311, SPF_NEUTRAL=0.779] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wTl43fc-xSuB for <ietf-822@ietfa.amsl.com>; Tue, 22 Apr 2014 13:24:33 -0700 (PDT)
Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) by ietfa.amsl.com (Postfix) with ESMTP id A34491A0226 for <ietf-822@ietf.org>; Tue, 22 Apr 2014 13:24:32 -0700 (PDT)
Received: (qmail 25863 invoked from network); 22 Apr 2014 20:24:26 -0000
Received: from miucha.iecc.com (64.57.183.18) by mail1.iecc.com with QMQP; 22 Apr 2014 20:24:26 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=a79d.5356cff9.k1404; i=johnl@user.iecc.com; bh=yP9brV/5fnaatFoftGawBvszRQQ7/mpCeA3CSOrWZ+M=; b=aJeQNDiR7L4ox5tOnSwwsdLvX5xruw6O8g+nXMSVqxQtG4WASwMsvun4MafcUOlUD6eihlQfZGImpuN7ZkUI8cuW1NeNBxG21ER62hwiG8dY3gy45WOJjQe/25v8s7/Li63nBIFzKj1PaSRhJWnksMlIwDa9QvL31sfHccXns5z0OTGNikqQ0XextZxLYPdBCLKoumWNjPajI8U/3HFyQpltbK2xcFvME+uPGAzccydxQdgbTqvajtxlB7jHfhhi
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=a79d.5356cff9.k1404; olt=johnl@user.iecc.com; bh=yP9brV/5fnaatFoftGawBvszRQQ7/mpCeA3CSOrWZ+M=; b=uyHnGPRaniQSMBB7dQD5kAFcjWG5ZIj/yJ07w4VTbKMkGogxcy1aj4fMsalkTnON0PYtCxvssjnstPVtrLkByGTEWwjufYe1n5YIJsKX8HMyR136P6CHgxhpYrqOftO/d6WYneHZO+Rm/OlfF1tiy+oOTp/q3Jv88O1vVKFk7BQWNsOMxivdeErdrwIDkSZuzrOJHQK11IV4Hp96209znQetxPJ1a3x8t+VAnVRUiiFfKnlA+KBnAUoE/TZShArP
Date: Tue, 22 Apr 2014 20:24:03 -0000
Message-ID: <20140422202403.42908.qmail@joyce.lan>
From: John Levine <johnl@taugh.com>
To: ietf-822@ietf.org
In-Reply-To: <535646AA.2080400@pscs.co.uk>
Organization:
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset="utf-8"
Content-transfer-encoding: 8bit
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf-822/eJevT93TomnoF-CPcLx9yFHmQ9I
Cc: paul@pscs.co.uk
Subject: Re: [ietf-822] don't need a permission to re-sign header
X-BeenThere: ietf-822@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "Discussion of issues related to Internet Message Format \[RFC 822, RFC 2822, RFC 5322\]" <ietf-822.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf-822>, <mailto:ietf-822-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf-822/>
List-Post: <mailto:ietf-822@ietf.org>
List-Help: <mailto:ietf-822-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf-822>, <mailto:ietf-822-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Apr 2014 20:24:37 -0000

>I know people think I'm wrong, but I think it needs to be looked at a 
>different way. As a recipient, I don't want 'proof' that this message 
>came from Alessandro, I want 'proof' that it came from the 
>ietf-822@ietf.org mailing list.

I think you're right.  I've said for years that lists should sign
their mail with their own DKIM keys, and recipients should look at
those list signatures to filter the mail.  

None of the theories about why you would care about preserving
incoming signatures have ever impressed me as having any relationship
at all to the ways people actually use mailing lists.  It's either a
vague "more secure", or a passive aggressive list manager who is
skilled enough to jump through hoops to preserve the signatures but
too much of a doofus to keep junk out of the list.

R's,
John