Re: Bad/Good ideas and damage control by experienced participants

[Miles Fidelman <[e-mail]>]

John Levine wrote:
> It appears that Nick Hilliard  <[e-mail]> said:
>>> It seems like, these days, all people do is promulgate broken mechanisms
>>> (e.g., DMARC), in the name of blocking resource sharing & collaboration
>>> - bringing us back to the days of a walled gardens and closer to the
>>> days of the Tower of Babel, at the same time no less.  And they do it,
>>> largely, by going around IETF processes entirely.
>> the issue is not whether this is true, but how it is presented to people
>> who stumble on the same blocks that we stumbled on when we started.
> DMARC is an interesting example.  As originally designed and implemented,
> it was a reasonable approach to a real problem, phishing mail that
> impersonates famous brands, notably Paypal.  Unfortunately a few years
> later it was repurposed by AOL and Yahoo, after they each let crooks
> steal their users' address books, to outsource the costs of spam they
> were getting with mail "from" their own users.  I suppose it was
> inevitable in retrospect that someone would do that but I know I was
> not the only one who was surprised when they did, and particularly
> that Yahoo did it in full knowledge that it would screw up every
> discussion list to which their users were subscribed.
>
> Many of the people who designed DMARC were and are active in the IETF,
> but I don't blame them for not doing it here because they'd be overrun
> with people who have no idea what the issues are in running large
> mail systems and would just say it's broken, go away.  I am certainly
> not saying that DMARC is wonderful, and the band-aid ARC that is intended
> to fix some of the mailing list issues is rolling out much too slowly,
> but doing nothing was and is not an option.
>
Personally, having been hit by it as a list manager (currently having 
serious problems with list mail getting to gmail recipients)... I have 
to say that a process that allowed something as damaging as DMARC, to 
make it into widespread use - is just broken.  Heck, it broke THIS list 
- folks at both google (like Vint), and gmail were not getting IETF list 
traffic.

Talk about broken!

Miles Fidelman

-- 
In theory, there is no difference between theory and practice.
In practice, there is.  .... Yogi Berra

Theory is when you know everything but nothing works.
Practice is when everything works but no one knows why.
In our lab, theory and practice are combined:
nothing works and no one knows why.  ... unknown