Date: Tue, 27 Nov 2018 23:03:30 +0700 From: Victor Sudakov <vas@mpeks.tomsk.su> To: "John R. Levine" <johnl@iecc.com> Cc: freebsd-questions@freebsd.org Subject: Re: Invalid DKIM signatures in this list Message-ID: <20181127160330.GC78157@admin.sibptus.ru> In-Reply-To: <alpine.OSX.2.21.1811262122261.73238@ary.qy> References: <20181126125259.GB86999@admin.sibptus.ru> <20181126172133.CDCDB2008E6098@ary.qy> <20181127015856.GA79319@admin.sibptus.ru> <alpine.OSX.2.21.1811262122261.73238@ary.qy>
next in thread | previous in thread | raw e-mail | index | archive | help
--61jdw2sOBCFtR2d/ Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline Content-Transfer-Encoding: quoted-printable John R. Levine wrote: >On Tue, 27 Nov 2018, Victor Sudakov wrote: >> The problem is in FreeBSD's mailing list manager which is broken IMHO. > >If you are saying that it's broken because it's not deleting old DKIM >signtures, I'm sorry, but you're simply mistaken. I helped write the DKIM >specs so I'm not guessing here. > >> See RFC 6377 >> >> "The best general recommendation for dealing with MLMs is that the MLM >> or an MTA in the MLM's domain apply its own DKIM signature to each >> message it forwards and that assessors on the receiving end consider >> the MLM's domain signature in making their assessments. (See >> Section 5, especially Section 5.2.)" > >I helped write that RFC. It was and is just guessing. While it would >be a good idea for the lists to add their own signature, they're not >broken if they don't. And that says nothing about deleting old >signatures. With all due respect to you as the co-author of the RFC, it does say=20 something about deleting old signatures. I'm not quoting for you=20 (this would be odd) but for the general public here who are reading this th= read. In "5.7. Signature Removal Issues" the document says=20 "However, if the MLM is configured to make changes to the message prior to reposting that would invalidate the original signature(s), further action is RECOMMENDED to prevent invalidated signatures from arriving at final recipients, possibly triggering unwarranted filter actions. " and it mentions=20 "5. Remove all previously evaluated DKIM signatures;" as one of the possible solutions (among 5 other suggestions). and then again: "Removing the original signature(s) seems particularly appropriate when the MLM knows it is likely to invalidate any or all of them due to the nature of the reformatting it will do. " --=20 Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/49@fidonet http://vas.tomsk.ru/ --61jdw2sOBCFtR2d/ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBAgAGBQJb/WrSAAoJEA2k8lmbXsY0MVYIAKkfYiE/sxD1ya3tw/qEQ8x4 6kydBkhZWxRJ1f18WmEhLW5x6cEyPNcgSRAS/XhxzxCWP/jG1JkvnKvGK909STeD YoxENYinqOyAE+A6t7ptY8IwFaPEY/zdbgLDbLim/GaLLrDRLTGwEmTKhYgvqUWN e0eo5a6OOPrbsiNSuSZo9wMbxCCB3xrtb0CxbVhPMuBnz2ie+W8g69RXNSlmos/J oNMTCr6hn5zBtI9ZlXQs+xc8JRQgx2yYKZUNTXjDI5TaQ8+89GHAAs3dI7ll+bmr H8eqN+WwU3Kcue9QitUMg9o+YWTrGpaBdIWYK310/XBi5nEOk1s8/g1LseLexcM= =3MX+ -----END PGP SIGNATURE----- --61jdw2sOBCFtR2d/--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20181127160330.GC78157>