Re: (DMARC) Why mailing lists are only sort of special

"Murray S. Kucherawy" <superuser@gmail.com> Wed, 16 April 2014 18:41 UTC

Return-Path: <superuser@gmail.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D96F81A0277 for <ietf@ietfa.amsl.com>; Wed, 16 Apr 2014 11:41:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.399
X-Spam-Level:
X-Spam-Status: No, score=-1.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, J_CHICKENPOX_14=0.6, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 19pKkxGH4h3i for <ietf@ietfa.amsl.com>; Wed, 16 Apr 2014 11:41:24 -0700 (PDT)
Received: from mail-we0-x233.google.com (mail-we0-x233.google.com [IPv6:2a00:1450:400c:c03::233]) by ietfa.amsl.com (Postfix) with ESMTP id 6EC761A0227 for <ietf@ietf.org>; Wed, 16 Apr 2014 11:41:24 -0700 (PDT)
Received: by mail-we0-f179.google.com with SMTP id x48so11400197wes.10 for <ietf@ietf.org>; Wed, 16 Apr 2014 11:41:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=bnzYhLMdeXU10WcP0+1DkYc3NCA4A5pxj1ys7FoEtV0=; b=dX4E++5T6cWOIpD7oKF3Numx7n+qowQxV0GqHSpOaQaCOYhhfNdE+IbpNa8Ugvqsyq YV41ZF86+mbbO+eELzAHaLkLVNdBEwo8eTha4d0NpfrM6ZQvH/C3wQnRoQLYfcuCvXfW anBGCMZao5z7gGKyIPLhqDvDUf/o4oF5ooXYnec3UhUGL1kBkgEM6eXL42CAxXFfymLR SuEKQJSapaFK/sG7NtalT5Fnw4ZP+6KM6t2e42JY4IZBftF7yUhAnOJSsnECG+CcKhQJ 704nHu2TR/Ij6g8g7JyHZV/yg7YuMwyLXQYLxnU2wv/Frv77wmXCrPg3j34U9gQnIauo zRow==
MIME-Version: 1.0
X-Received: by 10.194.109.227 with SMTP id hv3mr8539264wjb.10.1397673680596; Wed, 16 Apr 2014 11:41:20 -0700 (PDT)
Received: by 10.180.90.140 with HTTP; Wed, 16 Apr 2014 11:41:20 -0700 (PDT)
In-Reply-To: <alpine.BSF.2.00.1404151832460.38826@joyce.lan>
References: <CE39F90A45FF0C49A1EA229FC9899B0507D45766@USCLES544.agna.amgreetings.com> <20140414214949.32126.qmail@joyce.lan> <CE39F90A45FF0C49A1EA229FC9899B0507D460CB@USCLES544.agna.amgreetings.com> <alpine.BSF.2.00.1404142150430.32657@joyce.lan> <CAL0qLwbPMm_i0fqNSGQPv=xZaiNASy=icsRNudaNJ_3PNtX3Og@mail.gmail.com> <alpine.BSF.2.00.1404151832460.38826@joyce.lan>
Date: Wed, 16 Apr 2014 11:41:20 -0700
Message-ID: <CAL0qLwZUptJVw85T2FjB2HRGoOvcOUHKiQXeadM0QE9BsFVM9w@mail.gmail.com>
Subject: Re: (DMARC) Why mailing lists are only sort of special
From: "Murray S. Kucherawy" <superuser@gmail.com>
To: John R Levine <johnl@taugh.com>
Content-Type: multipart/alternative; boundary=089e0102ee283e73fb04f72d436f
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf/kAMAmwHITR2hYy9hgksHEmvMoro
Cc: "ietf@ietf.org" <ietf@ietf.org>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Apr 2014 18:41:28 -0000

On Tue, Apr 15, 2014 at 7:18 PM, John R Levine <johnl@taugh.com> wrote:

> The reason it's not special is that it's just the most visible example of
> a wide variety of legitimate useful mail that DMARC can't describe, and
> that are broken by DMARC policies other than p=none.
>

As I see it, this is probably the core of the stalemate.  I agree that
DMARC, and its various antecedents that we all know and love, can't
precisely describe mailing list traffic as it's currently defined.  What I
observe, though, is that there's typically lots of talk about what we can't
do to add that capability, and almost none about what's actually possible.
People get discouraged and give up.  This isn't a path to success.

I'm all for being as incremental and non-destructive as possible when
building these things.  I also don't think it's possible to be completely
invisible 100% of the time.

Sure, whitelisting is one possible solution.  Publishing a whitelist is
easy, but populating it, managing it, making it robust, making it fair, and
protecting it against fraudulent entries needs to be sorted out, whether
it's a public whitelist or a private one.  Are we certain, though, that
it's flatly impossible to adjust lists in such a way that their traffic
could be described by these mechanisms?

-MSK