[lamps] Murray Kucherawy's No Objection on draft-ietf-lamps-e2e-mail-guidance-15: (with COMMENT)

[Murray Kucherawy via Datatracker <[e-mail]>]

Murray Kucherawy has entered the following ballot position for
draft-ietf-lamps-e2e-mail-guidance-15: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-lamps-e2e-mail-guidance/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for this.  It's well written and provides good coverage of the material.
 I'll be going to YES once the DISCUSS is resolved.

Given the use of BCP 14 keywords in this document, I would prefer this be done
as a BCP or a Standards Track document (specifically, an Applicability
Statement).  It really is specifying something that's got compliance
requirements and use of existing protocols to achieve a particular outcome. 
You might even consider Experimental if you're simply not sure about how robust
the advice in here is.  The IESG will take up some future discussion about what
guidance we might want to provide for future efforts like this one.

I'm curious: If there are no committed or planned implementations, what was the
source for most of this advice?  Prior working groups in the area of email
security, like DKIM and DMARC, have firmly avoided providing any sort of user
interface advice on the basis that we simply do not have experience from which
to develop such advice.  I'm wondering what's different now.

The discussion about lock icons and such was interesting.  Over on the DKIM
list, there was some recent discussion about whether such user indications are
useful at all, whether they highlight security or non-security of a message. 
Some studies were cited that suggest these simply have never worked.