IETF Logo Mail Archive

Re: DMARC: perspectives from a listadmin of large open-source lists

Theodore Ts'o <tytso@mit.edu> Tue, 15 April 2014 23:14 UTC

Return-Path: <tytso@thunk.org>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26EB61A0029 for <ietf@ietfa.amsl.com>; Tue, 15 Apr 2014 16:14:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.573
X-Spam-Level:
X-Spam-Status: No, score=-1.573 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, J_CHICKENPOX_16=0.6, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ujQeFACMmjEW for <ietf@ietfa.amsl.com>; Tue, 15 Apr 2014 16:14:43 -0700 (PDT)
Received: from imap.thunk.org (imap.thunk.org [IPv6:2600:3c02::f03c:91ff:fe96:be03]) by ietfa.amsl.com (Postfix) with ESMTP id 15BDE1A002F for <ietf@ietf.org>; Tue, 15 Apr 2014 16:14:42 -0700 (PDT)
Received: from root (helo=closure.thunk.org) by imap.thunk.org with local-esmtp (Exim 4.80) (envelope-from <tytso@thunk.org>) id 1WaCYo-0003LY-Ia; Tue, 15 Apr 2014 23:14:38 +0000
Received: by closure.thunk.org (Postfix, from userid 15806) id D724A580893; Tue, 15 Apr 2014 19:14:37 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=thunk.org; s=ef5046eb; t=1397603677; bh=ZSJqey6qDtP+BATFteylskabDjDwT8mYMKpiaJ0Q45E=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=ekHRRGvjQWNMv2d2vJTcN6KYkZn4UROIrKC78ourNUd6s9FyeeXmFJw41JlF+l3Cr SspGwbswU9/9vwsZkGvZ+JrJflU/8/bIBSB6T2boGANgjsfH52GIHmFSWbwZT7APbf gmDOErTpzLxxFOynIKTmTBynEHmbJ5hG708C1Ka8=
Date: Tue, 15 Apr 2014 19:14:37 -0400
From: Theodore Ts'o <tytso@mit.edu>
To: Hector Santos <hsantos@isdg.net>
Subject: Re: DMARC: perspectives from a listadmin of large open-source lists
Message-ID: <20140415231437.GP4456@thunk.org>
References: <robbat2-20140408T031810-279861577Z@orbis-terrarum.net> <alpine.BSF.2.00.1404072357400.73388@joyce.lan> <01P6EEIPML6600004W@mauve.mrochek.com> <6.2.5.6.2.20140408101346.0ccb5e88@resistor.net> <alpine.BSF.2.00.1404081325130.76892@joyce.lan> <5347C698.6040108@tana.it> <534ACB5F.7060400@isdg.net> <534CE53A.7090000@tana.it> <534D9D12.4080602@isdg.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <534D9D12.4080602@isdg.net>
User-Agent: Mutt/1.5.23 (2014-03-12)
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: tytso@thunk.org
X-SA-Exim-Scanned: No (on imap.thunk.org); SAEximRunCond expanded to false
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf/UedbNpx40rvoMdRDXQmP0sTTUyg
Cc: ietf@ietf.org, Alessandro Vesely <vesely@tana.it>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Apr 2014 23:14:47 -0000

On Tue, Apr 15, 2014 at 04:56:50PM -0400, Hector Santos wrote:
> 
> I think adding temporarily helps and the additional text about DMARC
> certainly helps.
> 
> But the problem is YAHOO doesn't want you to do this (rewrite).

That's OK, we didn't want Yahoo turning on DMARC p=reject.  Life's
tough sometimes.

> 
> Case in point, lets say a real bad message got into the list, unsigned,
> purported from Yahoo, the 5322.From was rewritten and distributed to other
> list users and some of those users were "harmed" in some fashion that it
> worth the effort to sue.   Guess who would be at legal fault here?  Not
> YAHOO. They are legally protected.  The MLM, who wistfully and intentionally
> ignored policy and even went as far to break the security, is now at risk.

The message was unsigned before it hit the mailing list, and it's
unsigned after the mailing list altered the from field.  So the
mailing list software did nothing to "break" security in that case.
Furthermore, the from field would be "username@yahoo.com.INVALID".  So
obviously there is nothing that can be said about whether the message
came from a yahoo user or not.

Cheers,

							- Ted

v2.23.0 | Report a Bug | By Email