Hi Russell, Russell Coker wrote: > On Friday 03 October 2008 19:02, Thomas Viehmann <[EMAIL PROTECTED]> wrote: >> Of course, even more preferable would be if people designing standards >> would not expect users to change the ways they sign messages (l=) based >> on whether it's going to be sent to a list or not as the only way to >> accommodate common existing practices. > > I challenge you to design a way of signing messages that doesn't have this > issue.
> I can't think of a better way of doing this, and I am really interested to > hear any proposals of better ways of doing it. Last time I checked DKIM > wasn't finalised so you can suggest changes to it... I thought it was an RFC by now. The obvious way would be signing the footer part that we added (by, say, having a start and lenght field and allowing multiple signatures), having "well-signed" mean "signature headers covering everything". People wishing to implement some policy could impose restrictions of content covered by "auxiliary signatures". Naturally, another sane policy would be requiring timely delivery of messages relative to the oldest signature. But this is offtopic here, maybe it'd be worth wile to take it up to the dkim-people, but until they decidedly need input and are prepared to fix this, I'm not too sure it's good use of my time nor whether my ideas on the subject have significant drawbacks.[1] Yes, it's not ideal that we're appending stuff, but we still get mail from people not being able to figure out how to unsubscribe at a rate of about 1/per day. Kind regards T. 1. I once had a conversation with an IMAP expert participating in the standards process and was surprised how they did not have globally unique identifiers. There are some things to be considered, but the security concerns he cited seemed to be easy enough to eliminate. -- Thomas Viehmann, http://thomas.viehmann.net/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
