Re: [Ietf-dkim] Headers that should not be automatically oversigned in a DKIM signature?

Steffen Nurpmeso <steffen@sdaoden.eu> Mon, 05 February 2024 21:39 UTC

Return-Path: <steffen@sdaoden.eu>
X-Original-To: ietf-dkim@ietfa.amsl.com
Delivered-To: ietf-dkim@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFE2AC14F6B0 for <ietf-dkim@ietfa.amsl.com>; Mon, 5 Feb 2024 13:39:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.91
X-Spam-Level:
X-Spam-Status: No, score=-6.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A8S98xPrjYGY for <ietf-dkim@ietfa.amsl.com>; Mon, 5 Feb 2024 13:39:22 -0800 (PST)
Received: from sdaoden.eu (sdaoden.eu [217.144.132.164]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7F2F8C14F6A5 for <ietf-dkim@ietf.org>; Mon, 5 Feb 2024 13:39:20 -0800 (PST)
Date: Mon, 05 Feb 2024 22:24:12 +0100
Author: Steffen Nurpmeso <steffen@sdaoden.eu>
From: Steffen Nurpmeso <steffen@sdaoden.eu>
To: Dave Crocker <dhc@dcrocker.net>
Cc: ietf-dkim@ietf.org
Message-ID: <20240205212412.Kq4PkTNC@steffen%sdaoden.eu>
In-Reply-To: <e59bbaa2-945c-4ed8-85b4-3a79ebc8bfbd@dcrocker.net>
References: <20240119192026.DEDFF810437D@ary.qy> <20240120000053.FrDLzS4U@steffen%sdaoden.eu> <3f72e0c3-d245-16f7-57b2-831bfa53efbd@taugh.com> <4F161749-91D6-4E2D-AF70-89C5F172B971@isdg.net> <64f0cfd3-9d86-4d5e-b213-d0e53972c65a@tana.it> <af70d974-b2cb-4ac3-af9f-f0461238ebbb@isdg.net> <0cb52576-67af-4248-9866-5d2e2ef1adfd@tana.it> <8EA4F7EB-CBAF-4CBA-AD3B-03ECC8B05172@isdg.net> <012291f4-5098-4e6b-b9b9-a7e1fd681138@tana.it> <e59bbaa2-945c-4ed8-85b4-3a79ebc8bfbd@dcrocker.net>
Mail-Followup-To: Dave Crocker <dhc@dcrocker.net>, ietf-dkim@ietf.org
User-Agent: s-nail v14.9.24-596-g7894190075
OpenPGP: id=EE19E1C1F2F7054F8D3954D8308964B51883A0DD; url=https://ftp.sdaoden.eu/steffen.asc; preference=signencrypt
BlahBlahBlah: Any stupid boy can crush a beetle. But all the professors in the world can make no bugs.
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf-dkim/CtlrghSr-78PLA9fGoZtZX7IdYw>
Subject: Re: [Ietf-dkim] Headers that should not be automatically oversigned in a DKIM signature?
X-BeenThere: ietf-dkim@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: IETF DKIM List <ietf-dkim.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf-dkim>, <mailto:ietf-dkim-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf-dkim/>
List-Post: <mailto:ietf-dkim@ietf.org>
List-Help: <mailto:ietf-dkim-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf-dkim>, <mailto:ietf-dkim-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 05 Feb 2024 21:39:25 -0000

Dave Crocker wrote in
 <e59bbaa2-945c-4ed8-85b4-3a79ebc8bfbd@dcrocker.net>:
 |On 2/5/2024 9:43 AM, Alessandro Vesely wrote:
 |> It is debatable whether it is useful to display authentication 
 |> information to the end user.  Personally, I like to see it. 
 |
 |At scale, there is no debate among UX professionals.  Its presence 
 |varies between useless and confusing, for typical users.

I *totally* disagree.
It is also a matter of education.
See in Germany (and Europe) we now have traffic lights on packaged
food, from red over yellow to green (in i think 6 steps), so
people will learn not to eat chips, sugarized cereals, and
chocolade.

 |Since some miniscule portion of the user population might like to see 
 |it, for whatever reason, it could make sense to make it available, but 
 |not as a default.

If a graphical user interface gives you a green "ok" button to
click, or "red" otherwise, that is even better as in browser URL
lines.  Then pop up a tree-view of message modifications and
alertize where it broke, checkbox for is-this-really-an-evil.

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)