Re: [Shutup] [ietf-smtp] Proposed Charter for the "SMTP Headers Unhealthy To User Privacy" WG (fwd)

Simon Josefsson <simon@josefsson.org> Wed, 02 December 2015 16:59 UTC

Return-Path: <simon@josefsson.org>
X-Original-To: shutup@ietfa.amsl.com
Delivered-To: shutup@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A48E21B2C65; Wed, 2 Dec 2015 08:59:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.551
X-Spam-Level:
X-Spam-Status: No, score=-1.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_SE=0.35, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d8ZlokIHA6ex; Wed, 2 Dec 2015 08:59:41 -0800 (PST)
Received: from duva.sjd.se (duva.sjd.se [IPv6:2001:9b0:1:1702::100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D76231B2C56; Wed, 2 Dec 2015 08:59:40 -0800 (PST)
Received: from iller (c-c5b7e355.014-1001-73746f1.cust.bredbandsbolaget.se [85.227.183.197]) (authenticated bits=0) by duva.sjd.se (8.14.4/8.14.4/Debian-4) with ESMTP id tB2GxajT003484 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=NOT); Wed, 2 Dec 2015 17:59:37 +0100
Message-ID: <1449075573.7123.27.camel@josefsson.org>
From: Simon Josefsson <simon@josefsson.org>
To: "Derek J. Balling" <dredd@megacity.org>
Date: Wed, 02 Dec 2015 17:59:33 +0100
In-Reply-To: <565F1D1F.6080307@megacity.org>
References: <20151130042819.10658.qmail@ary.lan> <1448858775386-ceecd236-8b11ac04-a03b4438@fugue.com> <01PTPUIP3IUK01729W@mauve.mrochek.com> <11d014e5-9a6a-4b78-92a1-8e0a1e0a905d@gulbrandsen.priv.no> <lGTaHvC8ygXWFAuu@highwayman.com> <565EBD82.2030600@pscs.co.uk> <1449065151122-b9505bf5-be5f0e83-f9cdd79b@fugue.com> <565EFD93.2060507@pscs.co.uk> <1449070095816-c64690a8-829c0c47-fd944ab9@fugue.com> <565F162F.7010109@dcrocker.net> <565F1D1F.6080307@megacity.org>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="=-pcDIt7HcwaIrmbUop140"
X-Mailer: Evolution 3.12.9-1+b1
Mime-Version: 1.0
X-Virus-Scanned: clamav-milter 0.98.7 at duva.sjd.se
X-Virus-Status: Clean
Archived-At: <http://mailarchive.ietf.org/arch/msg/shutup/LMVsa-KTwzkTJFjf08V7j25Jvvc>
Cc: shutup@ietf.org, ietf-smtp@ietf.org
Subject: Re: [Shutup] [ietf-smtp] Proposed Charter for the "SMTP Headers Unhealthy To User Privacy" WG (fwd)
X-BeenThere: shutup@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: SMTP Headers Unhealthy To User Privacy <shutup.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/shutup>, <mailto:shutup-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/shutup/>
List-Post: <mailto:shutup@ietf.org>
List-Help: <mailto:shutup-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/shutup>, <mailto:shutup-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Dec 2015 16:59:42 -0000

I believe that spending any time on answering #2 in a quantitative way
is a waste of time and will derail useful work in this area.  For me to
be able to geolocate Derek with sufficient probability as being close to
Kingston, NY, USA by looking at the email he sent below is sufficient
motivation for me to work on this.  I do appreciate and welcome help
from experts on #3 so we can describe the best solution to this problem.

I hope that some well-known larger domains will implement
draft-josefsson-email-received-privacy-01 (or something like it that we
can describe) so we can get more data to #3.  However, I suspect that we
will find that the majority of "use-cases" for Received data are harmful
to users, and that we can support the few good use-cases (like loop
detection) anyway.

/Simon

ons 2015-12-02 klockan 11:32 -0500 skrev Derek J. Balling:
> I've been uncharacteristically (for me) quiet up 'til now, so let me --
> perhaps naively -- say what, to me, seems like a simple thing.
> 
> 1.) It's axiomatic that Received headers disclosure some level of
> private data
> 2.) It's a matter of debate how valuable that data is to those who would
> abuse it
> 3.) It's a matter of debate as to what impact redaction/removal of that
> data from message headers would cause
> 
> Why isn't this as simple as chartering the WG to go off and:
> 
> 1.) Document the answers to questions 2 and 3 above, with data
> 2.) If they so choose after doing #1, propose remedies or changes to the
> existing methodologies consistent with the data they found above
> 
> At that point, everyone can observe the data, attempt to replicate it
> (almost like a peer-review process, one would think) and then the
> discussion can be about whether or not any proposal that came out of the
> WG meets the larger goals of the net at-large.
> 
> It seems that it shouldn't be this hard to charter them to go off and
> "crunch data" and "come up with a proposed solution consistent with that
> data".
> 
> Nobody's "committed" to anything by letting folks go off and work on
> this. so why is there such vociferous debate over letting them go do
> that? What am I missing? (it's possible I have missed something, because
> this debate is the most traffic we've seen in years on this list).
> 
> D
> 
> 
> _______________________________________________
> Shutup mailing list
> Shutup@ietf.org
> https://www.ietf.org/mailman/listinfo/shutup