Re: Realistic responses to DMARC

[Theodore Ts'o <[e-mail]>]

On Sun, Dec 18, 2016 at 02:24:03AM -0500, John R Levine wrote:
> > Therefore, a developer-friendly mail service MUST NOT have a p=reject
> > or p=quarantee DMARC policy, and MUST also ignore DMARC policies on
> > the receiving end.  Fortunately, these mail services do exist, even if
> > they aren't the big, free consumer ones.
> 
> Linux may be enough of a cult that developers will put up with having to use
> a mail account different from the one they use for everything else, but as
> I've said a couple of times already, I don't think the IETF can stand the
> blood loss.

It has nothing to do with Linux being a cult.  It's a matter of
Linux's economic importance.  If you look at who actually writes the
Linux kernel[1], you'll see the vast majority (over 80%) are doing
this work because they are being paid to do it, with over 200
companies contributing work to every Linux kernel release.  These are
all companies that have products using Linux, and if they want to
participate in the development process, then they darn well better
figure out a way to deal with the fact that vger.kernel.org is
unrepentantly *NOT* DMARC-compliant.

[1] https://www.linux.com/publications/linux-kernel-development-how-fast-it-going-who-doing-it-what-they-are-doing-and-who-5

>From looking at the numbers over the past year, the Linux kernel has
been increasing the number of developers contributing in each retreat
during the entire time that we've been giving the middle finger to
DMARC, and it hasn't been a problem.

When I used to be attending the face to face IETF meetings ten years
ago, at that time my impression was that the IETF was that important
and vital as well, and I suspect that if people had been forced to
change mail providers because that was the only way they could get
work done, and the only way they could ship products, they would do
what they would need to do.

I can't speak to the power and respect and importance that the IETF
commands today, but what's important to remember here is that this is,
again, all about power politics.  So when David Crocker tells us that
the mail providers aren't going to back down, regardless of whether or
not it is true, *of course* the the mail providers will try to say
that, because they are trying to intimate people into knuckling under
and accepting DMARC.

Similarly, there is of course a similar game going on with the
vger.kernel.org mail administrators basically telling yahoo.com
subscribers, "sorry, find another mail provider", in that by not
backing down, hopefully that will change the position of the big mail
providers.

It's all basic power negotiating --- the sort of thing that Trump
would understand --- and this is what happens when something like
DMARC is promulgated across the e-mail ecosystem without a standards
process that respects all stakeholders.  The alternative to "rule of
law" or "standards" is "rule of the jungle".

And so at the end of the day, it's all about what your BATNA (best
alternative to a negotiated agreement).  If it really is true that the
IETF is so lacking in power, and is so enervated, that you are afraid
that you will bleed participants if you don't stand firm to DMARC ---
then you will have lost already.  And if it's true, then maybe the
IETF doesn't have the economic power of say, the Linux kernel in
today's computer industry.

I don't think that's true; I certainly hope that it's not true.  But
you're probably in a better position to make that judgement than I.

Cheers,

					- Ted