[lamps] Murray Kucherawy's Discuss on draft-ietf-lamps-e2e-mail-guidance-15: (with DISCUSS and COMMENT)

[Murray Kucherawy via Datatracker <[e-mail]>]

Murray Kucherawy has entered the following ballot position for
draft-ietf-lamps-e2e-mail-guidance-15: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-lamps-e2e-mail-guidance/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I'll do what Robert chose not to do and ask that we briefly discuss the status.
 Specifically: Why isn't this a BCP, or perhaps an Applicability Statement? 
It's peculiar to have BCP 14 language in an Informational document, and this
does seem to be laying out a bunch of best practices.


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for this.  It's well written and provides good coverage of the material.
 I'll be going to YES once the DISCUSS is resolved.

I'm curious: If there are no committed or planned implementations, what was the
source for most of this advice?  Prior working groups in the area of email
security, like DKIM and DMARC, have firmly avoided providing any sort of user
interface advice on the basis that we simply do not have experience from which
to develop such advice.  I'm wondering what's different now.

The discussion about lock icons and such was interesting.  Over on the DKIM
list, there was some recent discussion about whether such user indications are
useful at all, whether they highlight security or non-security of a message. 
Some studies were cited that suggest these simply have never worked.