Email and reputation (was Re: Service outages planned for April 25)

[Vittorio Bertola <[e-mail]>]

> Il 28/04/2022 13:39 Keith Moore <[e-mail]> ha scritto:
> 
> 
> 
> On 4/28/22 07:27, Carsten Bormann wrote:
> 
> > 
> > > 
> > > While large players can create problems, the problem is certainly not limited to one "large player".   Why, for example, do "players" of any size feel the need to manually maintain lists of IP addresses of any color?
> > > 
> > 
> > Because this appears to them to be a viable strategy for mitigating a fundamentally (outside FUSSP) unsolvable problem.
> > 
> 
> Or because they don't have better tools.   Or if better tools exist, they're not widely or uniformly used by senders.
> 
> Also, why should it be a dark art to have legitimate email successfully delivered?
> 
I see this as one of the many manifestations of possibly the biggest shortcoming in the original design of the Internet's architecture, i.e. not having an "identity layer" taking care of user authentication and information sharing in a uniform way below all application protocols. Of course, this need only became fully apparent much later than when the architecture was designed, so the architects are entirely excused; also, this is not just a technical problem, and the organizational architecture is not fully ready even now.

Still, if I had a standard way to sign my email and privately, securely disclose who I am to the recipient, we would not have had the need to build alternative identity systems such as DKIM, based on unacceptably vague proxies for the sender's identity (i.e. the domain of their email provider). Identity is a precondition for any reputation system - if you attribute reputation to the wrong identity you are going to blame someone for someone else's actions, which is exactly how antispam filters mostly work today.

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] mailto:[e-mail]
Office @ Via Treviso 12, 10144 Torino, Italy