Hi Steffen, On Sun, Apr 21, 2024 at 01:01:54AM +0200, Steffen Nurpmeso wrote: > Steffen Nurpmeso wrote in > <20240420191646.ZD-tN3eo@steffen%sdaoden.eu>: > |Kurt Hackenberg wrote in > | <zinqav87xkbv7...@rain.cave>: > ||I would like to hold off on this until the draft becomes an RFC, if \ > ||it does. > | --End of <zinqav87xkbv7...@rain.cave> > > But i thing we refer to different drafts now. I think you are all > talking about draft-autocrypt-lamps-protected-headers-02, whereas > i was at draft-ietf-lamps-header-protection-20.txt, and i find > that terribly and needlessly excessive. Note it also talks about > a future deprecation of any non-protected messages, which i find > too anticipatory, and needlessly so, too. > > #?0|kent:rfc$ wc -l draft-autocrypt-lamps-protected-headers-02.txt > 3864 draft-autocrypt-lamps-protected-headers-02.txt > #?0|kent:rfc$ wc -l draft-ietf-lamps-header-protection-20.txt > 11200 draft-ietf-lamps-header-protection-20.txt
I thoroughly checked the autocypt one at the start of this discussion, IIRC. Then someone pointed to the ietf one, and after some simple inspection and web search, I think it's the evolution of the other, so my assumption was that the autocrypt one will never be standard. But yes, I prefer the simpler autocrypt one. > I mean, basically, isn't that just "duplicate the most important > headers of RFC 5322 into the signed part", aka "move practically > anything useful out of the main header, and place it within the > encrypted first multipart" (aka as via S/MIME and the Melnikov > draft) for generation, and "if you understand cryptographic > signatures and decrypting, use any such headers as the main > instances, and best if you somehow make that warp visible". > Which makes up six lines in this email. > The latter draft i find an overly complicated thing. > Btw i find that in general the ~1.4 decades brought lots of overly > messy complicated stuff in the email architecture (a bit like > DNS), and i find over and over again that we can be very lucky > that the old and good ones generated protocols which scale from > a dozen boxes to a billion ones, which all these, let me make it > plain, crappy new things will *never* deliver, i bet. And as you, I don't like autocrypt either. I get my keys by human interaction, and have .gnupg tracked by git(1) for any modification. But in this matter, I think this autocrypt draft was sane. > A nice Sunday everybody, if you can. Have a lovely Sunday! Alex -- <https://www.alejandro-colomar.es/>
signature.asc
Description: PGP signature
