Declan McCullagh, who is covering this week's Email Authentication Summit sponsored by the FTC, has a piece in
today's CNET News in which he asks the question "Should Microsoft own anti-spam?"
It's a good question, and the article shows, as predicted, that having failed to gain widespread acceptance for its
Sender I.D. scheme by the people who actually have to implement any email authentication scheme, having only partially
succeeded in attempting to undermine the ever-spreading adoption of the competing SPF scheme by borging it, and
having completely alienated the open source communities including Apache and Debian, Microsoft has taken it to the FTC
Summit where they are pitching hard to have Sender I.D. nonetheless declared a, if not the, authentication
standard.
And, when you get right down to it, it really doesn't matter if the people who actually know about these things - like
the IT people, and the lawyers - voice strong concerns or even rejection of Sender I.D. because of those concerns -
like how its licensing scheme and pending patents make it incompatible with life as we know it on the Internet.
If, as has always been their strong suit, Microsoft can convince the corporate decision-makers and the legislatures to
see things their way, it's quite likely that Sender I.D. will become a, if not the, standard. This,
of course, would be quite a coupe for Microsoft.
The question which remains is whether or not it would be good for the rest of the Internet community.
1. The concerns raised are valid.
It is clear Microsoft wants control. This became self-evident during the policy panel at the FTC/NIST Summit.
Microsoft has the power to achieve its goal.
Unless ...
The unless? An organized grass roots campaign based on a principled position.
Yes, many folks support SPF. Unfortunately, SPF does have some flaws.
As designed, it only allows for last hop validation. SIDF builds on this flaw.
So, from a security perspective, we want to look closely at CSV.
(A quick visit to the csv mailing list will show that both Yahoo! and AOL like CSV.)
Now, as a prudent buyer, before making a purchase you test the product.
Email is a core part of the Internet infrastructure.
The community at large can't afford for any authentication scheme not to work and we need the best product.
So, while we all want to move ahead, ASAP, the steps taken must be prudent.
Microsoft is recommending immediate adoption of SIDF as the IP based authentication standard.
But the AOL representative at the Summit made it clear all the proposals are experimental and need thorough testing, while the IESG wants a focused technical review. Hmm ...
Is it any wonder the major corporate SIDF supporters are senders? I mean why should the Direct Marketing Association or Email Service Provider Coalition care which standard is adopted, unless ...
Sound typical? Get market control, even if the product is not tested and then fix it up afterwards. But this is email folks.
John Glube
Toronto, Canada
For The Record, Will Microsoft Own Email?
http://www.learnsteps4profit.com/wme.html
For more on CSV visit:
http://csvmail.org
For the views of the SPF community on SID:
http://openspf.org
Posted at 4:51AM on Dec 19th 2005 by John Glube