4 ms·

"The IETF likes separation of concerns" but they're letting Google et al. ram through MTA-STS, which fails to define a standard port number for SMTP-over-TLS an

"The IETF likes separation of concerns" but they're letting Google et al. ram through MTA-STS, which fails to define a standard port number for SMTP-over-TLS and instead requires MTA implementations to also be able to fetch port numbers over https, a completely unrelated protocol. All because the authors believe mortal men are not capable of understanding DNSSEC. Leaving aside the unholy alliance of Google + Microsoft + Verizon + Comcast, the fact that the IETF made Fastmail ditch authentication from a mail protocol while letting Google subsume DNS and web-based port knocking into another mail protocol definitely tells me there's nobody behind the wheel any more. I'm happy that the Fastmail team is doing work that excites them, but does anyone know if the IETF has any plans to use ports other than 443 ever again?

icebraining 8y ago
You may disagree, but there are other reasons not to rely on DNSSEC besides "mortal men not being capable of understanding it": https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/ HTTPS does seem like overkill, but on the other hand, it's likely already running (even I, who host my own mail, have an HTTP daemon on the same server), so in the common case, it doesn't increase the attack surface.
- AndyMcConachie 8y ago
  The blog you quote is from 2015. Let's look at some recent numbers on DNSSEC/DANE deployment. https://stats.dnssec-tools.org/#graphs https://stats.dnssec-tools.org/#graphs
  - dullgiulio 8y ago
    These graphs don't address any of the points. Even worse, those numbers don't say anything about how many DNS requests are actually verified... A good guess is that those crypto keys sit idle.
romeisendcoming 8y ago
Welcome to the machine. Glad I'm leaving this industry. It's becoming unrecognizable.
acdha 8y ago
> "The IETF likes separation of concerns" but they're letting Google et al. ram through MTA-STS This is a fundamental misunderstanding of how the IETF works. The IETF codifies industry standards but, as with the W3C, it doesn't have some sort of veto authority over what companies actually implement. If major vendors are using MTA-STS, it's in everyone else's interest that it be described in a public standard. The IETF does get high-quality feedback and I see no reason to question the sincerity of Fastmail's stated reasoning and expressed appreciation. Similarly, “the authors believe mortal men are not capable of understanding DNSSEC” might be an amusing rhetorical flourish but it's not as convincing as the actual numbers showing that DNSSEC is not reliable on the internet now whereas HTTPS has near-universal deployment _and_ doesn't have the various design flaws which the DNSSEC community is slowly fixing. If you want to protect users, it's usually better to pick something which doesn't require hundreds of parties around the world to make significant changes — and that certainly fits with the “rough consensus and running code” ethos.

icebraining 8y ago

You may disagree, but there are other reasons not to rely on DNSSEC besides "mortal men not being capable of understanding it": https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/ HTTPS does seem like overkill, but on the other hand, it's likely already running (even I, who host my own mail, have an HTTP daemon on the same server), so in the common case, it doesn't increase the attack surface.

AndyMcConachie 8y ago
The blog you quote is from 2015. Let's look at some recent numbers on DNSSEC/DANE deployment. https://stats.dnssec-tools.org/#graphs https://stats.dnssec-tools.org/#graphs
- dullgiulio 8y ago
  These graphs don't address any of the points. Even worse, those numbers don't say anything about how many DNS requests are actually verified... A good guess is that those crypto keys sit idle.

romeisendcoming 8y ago

Welcome to the machine. Glad I'm leaving this industry. It's becoming unrecognizable.

acdha 8y ago

> "The IETF likes separation of concerns" but they're letting Google et al. ram through MTA-STS This is a fundamental misunderstanding of how the IETF works. The IETF codifies industry standards but, as with the W3C, it doesn't have some sort of veto authority over what companies actually implement. If major vendors are using MTA-STS, it's in everyone else's interest that it be described in a public standard. The IETF does get high-quality feedback and I see no reason to question the sincerity of Fastmail's stated reasoning and expressed appreciation. Similarly, “the authors believe mortal men are not capable of understanding DNSSEC” might be an amusing rhetorical flourish but it's not as convincing as the actual numbers showing that DNSSEC is not reliable on the internet now whereas HTTPS has near-universal deployment _and_ doesn't have the various design flaws which the DNSSEC community is slowly fixing. If you want to protect users, it's usually better to pick something which doesn't require hundreds of parties around the world to make significant changes — and that certainly fits with the “rough consensus and running code” ethos.