RMS Weighs In On SPF/Sender-ID License

NW writes "In a recent message to the MARID list RMS weighs in on the licensing issues of Sender-ID/SPF and Microsoft: 'Microsoft's Sender-ID license is directly incompatible with free software regardless of which free software license is used. Free software means users are free to run it, study and modify the source, and to redistribute it with or without changes. Free to do so means there is no requirement to ask or tell anyone that you are doing so.'" "MARID" stands for MTA Authorization Records in DNS; here's the IETF MARID working group's charter. (Read more below.)

Stallman's message continues: "The Microsoft license for Sender-ID directly forbids release of software with all these freedoms, so it is impossible for any program to be free software under Microsoft's regime. I've been expecting to see something like this ever since Gates started talking about spam. This license is an example of Microsoft's strategy for killing off free software as an alternative to Windows. Microsoft first patents something, then incorporates it into a format or protocol, then tries to make it de rigueur while excluding those it wishes to exclude. In the absence of resistance, Microsoft has a good chance of imposing whatever standards it likes. Let us, therefore, resist it here and now."

Comments

What's the big deal?

[FyRE666]

I've STFC (Scanned the charter) and from what I can gather, it's simply a new record type on the DNS'. Surely the MTA would then query the DNS responsible for the domain for this record, and act accordingly; so what's the problem? I'm sure Sendmail can be made fully capable of this, or any other lookup tool.

Re:What's the big deal?

[Smallpond]

From the copyright for RFC2821: (SMTP):

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works.

From the copyright for Sender ID:

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights

Note that "the authors" is:
J. Lyon
Microsoft Corp
M. Wong
pobox.com

I used to be an SPF fan, largely because it was the source of many hilariously mistaken /. posts, but now I think I need some clarification.

Re:What's the big deal?

[Anonymous Coward]

The primary authors of SPF saw the deal with Microsoft as an opportunity to get Microsoft to incorporate SPF into their SMTP servers and mail clients. They were trying to get SPF as widely used as possible, to reap the maximum benefits. This is good. Plain old SPF is extremely lightweight, extermely effective, and can put a bullet through almost all the domain forged spam on the planet.

Microsoft wants to incorporate CallerID, which is theirs, proprietary, and allows owners of CallerID tickets to be allowed to get past SPF. Its a typical use of their monopoly power to warp a standard, but the SPF authors accepted it to get wide usage. It's too bad: CallerID is Microsoft patented XML code in the email header, which means adding a patented XML parser to SMTP servers and email clients, and which means you can't do filtering with it at connect time the way you can with SPF. It means you have to *take the whole email message* before you can filter it, which is a stupid burden for a mail server being spammed to pieces by email viruses.

Now, anyone sane writing software that does this will leave in a switch to say "Use SPF only, and ignore Caller-ID", and leave Microsoft to stew in its own silliness. Expect the open-source toolsets to do this, and Microsoft to mandate the Caller-ID check, which will help accelerate people away from Microsoft mail servers.

Also, fortunately, the MARID proposals threw out most of the Caller-ID features in the proposal because of the underlying stupidity of using XML in your mail servers. There are things XML is good for, but Microsoft is betting the farm on XML in many of their products such as Microsoft Word, because they own patents on it and can keep out open source readers that way, and because it solves a lot of problems for dealing with their bloated document formats.

The SPF authors made a nasty deal with Microsoft to get their stuff into use and try to turn the tide on spam. And frankly, I think they were right. The time saved dealing with email viruses and spam can be spent doing real work, like getting rid of more fundamentally Microsoft software in the workplace.

Re:What's the big deal?

[voixderaison]

Your analysis seems to make sense if the patented components of Caller ID strictly concern the XML stuff which is not included in the Sender ID draft specification. In an effort to learn more about this, I looked over the Microsoft site for a pointer to the relevant patents or patents pending, and didn't find one. So then I googled around looking for this, and found mostly references to, and quotes from, the same Microsoft Caller ID license page.

Caller ID licensing for software developers
"If you are a software developer and are interested in implementing this specification in software, please review the terms of the Caller ID for E-Mail Implementation License before you begin, as the patent license discusses the rights that Microsoft would grant you or your organization."

Then I tripped over this article, which is a bit clumsy, and a dated reference to Caller ID (rather than a current discussion of Sender ID), but which contains an interesting and relevant idea.

Eben Moglen on Microsoft's Caller ID Patent License
"Note, however, that a developer could specifically *disclaim* the Microsoft patent license, which--since it does not actually identify any patent claims being licensed--could be said to be a nullity in any event. Such a developer could legitimately distribute under GPL, which would arguably be the wiser course."

That makes some sense, although I suspect that Microsoft has a large enough patent archive and accompanying staff of attorneys that they could bog down or possibly shut down almost any Sender ID project they choose by taking them to court, citing relevant patents at that time.

Then I tripped over another reference that indicates that there may be other IP issues which could affect Sender ID.

Bill Gates Is A Thief
"We believe that, totally bereft of their own ideas and lacking any in-depth understanding of the issues, Mr. Gates and company were absolutely desperate to appear relevant in the struggle against SPAM, if nothing else to deflect culpability and bad press for the unrelated, clumsy, and manifestly irresponsible security issues and quality failings in virtually every Microsoft product to date. In an odd twist of the same logic that two weeks ago had them beating up a 17-year-old over his website MikeRoweSoft.com (because it merely sounded like Gate's company site), they presumed FailSafe Designs would be too small and too timid to stop them from taking yet something else they wanted that wasn't theirs (as has been Microsoft's habit since inception). Had they merely asked, we would have considered selling or licensing our products, trademarks, patent rights, and other intellectual and real property, but Mr. Gates never stoops to common decency whenever any opportunity to bludgeon someone avails itself."

I suppose these other IP claims against Microsoft regarding their Caller ID specification might invalidate the presumed Microsoft patents relevant to Sender ID as "prior art". However, they might also directly encumber Sender ID if it includes components contributed by Microsoft but patented by another party.

In any case, it seems that this standard is important enough that it should be clearly unencumbered. This will require clear statements from Microsoft about which patents, if any, apply to Sender ID, and to which portions of Sender ID they apply. This disclosure seems to be required by the IETF. However, if Sender ID is to be adopted universally in the SMTP universe, a license that allows free software to use the patented methods without restriction is also clearly required -- and this situation at present seems anything but clear.

Re:What's the big deal?

[menkhaura]

What else would we expect from the makers of the most malware-friendly software in the world?

Re:What's the big deal?

[Ogerman]

In any case, it seems that this standard is important enough that it should be clearly unencumbered. This will require clear statements from Microsoft about which patents, if any, apply to Sender ID, and to which portions of Sender ID they apply.

There's a bigger issue here. Software patentability itself needs killed -- as soon as possible. But this will take time and a lot of legal wrangling. The SenderID mess is only the tip of the iceberg. Microsoft is hiring thousands of "R&D" people to think up and patent every obvious/trivial "innovation" past the current state of the art in order to create a legal minefield for their competitors (read: F/OSS). The Open Source community needs to wake up. Merely "offering an alternative" is no longer a valid strategy. It is time to go for the preverbial jugular. We need to act collectively and decisively to rapidly usurp as much of the desktop market as possible. The only immediate defense to this software patent garbage appears to be a strong offense.

So how can we do this? Let me apply the KISS principle in this explanation: We need to have the best office suite--one whose choice is a no-brainer for business types. That's pretty much it. Sure, the desktop environments need more polish, but they are adequate. OpenOffice is not. Sure, there's a lot of third party Windows software out there, but it can be easily ported to follow the desktop platform demand.

Re:What's the big deal?

[JesseMcDonald]

Here's a reasonable proposal to facilitate the decline of software patents, and/or enchance the public domain: allow copyright, patent, or trade secret (pick one). Software copyrights and patents require a WORKING COPY OF THE CODE, to be held in confidence by the Copyright Office until the copyright expires. For patents, a reference implementation must be provided, which would immediately become public domain. Of course, this exact implementation cannot be used until the patent expires without violating the patent, but it can be distributed freely and derivative works can be made from it that do not themselves violate the patent.

By doing this, we guarantee that, eventually, a usable version will be available. Companies might choose to just copyright their implementation rather than giving a working version to the public after ~7 years. (That is the term of a patent, right?) We would then be free to reverse-engineer it and make an alternate implementation without worrying about patents.

The main problem with this is the (common) case where something is composed of several different patents. It might be necessary to enforce a strict separation -- each patent must be a distinct component. I also say that the copyright term should be shorter, even with these modifications, and it should not be possible to copyright something not created by a human, such as machine code, or an intentionally crippled work, such as artificially-obfuscated code. Machine code should, instead, be considered a "derivative work" of a specific version of the copyrighted, human-written source code, and subject to the same restrictions provided the source is actually under copyright.

Re:What's the big deal?

[Ogerman]

Those are some interesting ideas. If you haven't already, see to it that they get "out there." Although I personally think copyright is all software needs for the time being. Patents on software techniques are highly dangerous and entirely detrimental to the industry -- not to mention there are good arguments that they can be seen as unconstitutionally limiting personal free speech. To violate a patent for a machine, you need a factory and other commercial means. To violate a patent on computer software, you need only express your thoughts using a keyboard. The basic premise of software patents is that all code is written for profit and for sale as a commercial work.

Re:What's the big deal?

[JesseMcDonald]

I agree, but this would make a good first step. Wean the companies off of software patents before removing them entirely. In the meantime, we would at least have a reference implementation and some decent example code to work with.

Here we go

[LardBrattish]

The battle lines are drawn. Good vs Evil.

Re:Here we go

[Anonymous Coward]

Personally I think it's Evil vs Evil. I think microsoft is evil but I also think RMS and the FSF in general is evil.

Re:Here we go

[0racle]

Thank god RMS told me this is wrong, I might have been pragmatic about it and used something that worked without my sacrifice to the Church of RMS.

I hope he'll next tell me what car I should buy, who to marry and what diet I should be on. I'm looking forward to when he moves all his followers to a compound in Texas or South America, its gonna be sweet.

Re:Here we go

[menkhaura]

What is Good, then? BSD's Beastie? A whole new way of seeing demons...

Doubts

[toetagger1]

So if that's true, how will Mac users or *nix admins in any size company be able to read their E-mails?

Re:Doubts

[Ianoo]

There we go, you're catching on to Microsoft's strategy!

Re:Doubts

[toetagger1]

Well, maybe I should have spelled out my conclusion, for people like you: This won't work, b/c of what I said above!

Re:Doubts

[vsprintf]

I think the point is that Microsoft wants a situation where there is Microsoft email and the other kind of email. With 90% of the lusers on the planet complaining that their MS email is not getting through, MS expects the rest of the world will cave in and be forced to use Microsoft email. I'm not saying it would work, but I don't even want to test it.

Re:Doubts

[ElvenMonkey]

Unfortunately I can just conceive that far too many sys-admins will cave in and do exactly what dear Aunty Microsoft tells them to do, forcing those of us without our heads stuck in the sand to fight a rear-guard action.

A link to Sender-ID info

[pongo000]

I'm surprised the author didn't link directly to Microsoft as well...here's the missing link.

It's pretty simple

[Featureless]

If we let Microsoft, through some machinations during our anti-spam re-engineering or in any other manner, take any measure of control over what has, until now, been an 100% open-standard email infrastructure, email will be fragmented and ultimately ruined, far worse than any cadre of spammers could ruin it.

It is trivial to do what "caller ID" does in an open fashion. And it is absolutely crucial that we do exactly that. No "complicated" licenses, no fancy agreements, no lawyers. Just pick a standard, and follow it.

Letting Microsoft have any involvement in the email infrastructure - other than using it - will be a disaster. And it wll be all the more terrible because of how easily it can be prevented.

Re:It's pretty simple

[thogard]

The problem is no one has done it yet.
Every poject seems to get hijacked into committees that never get the real work done.

Take SPF for example. It was mostly pushed by one guy into some code and that is starting to move on, but why do I need to do that much extra work when the existnig DNSBL stuff works and could be used in nearly every MTA as is without doing any extra code?

I worked on the X.400 Gossip committee back in '92 or so. The result was the system was too big to be useable and the complexity was so bad that no one ever got it right. The fundamental with email is that I want any person in the world to be able to send me a message but I don't want spam. The problem is there is no tehcnial way to tell them apart.

I do agree with RMS that going down the MS path is a dead end that will only result in MS getting more money and gives them the ability to kill off all open source systems with their patents and I know they will use them. The one thing we have learned about patents is that it doesn't matter at all if someone gives us rights to use it, they can change their mind and then we have to pay.

Re:It's pretty simple

[nlinecomputers]

[i]It is trivial to do what "caller ID" does in an open fashion. And it is absolutely crucial that we do exactly that. No "complicated" licenses, no fancy agreements, no lawyers. Just pick a standard, and follow it.[/i]

Exactly my thought. So why is this an issue? Can we not write on own code for sendmail and other open email servers? Why does this sound like RMS is FUDing us just a bit? Sure MS' software will be non-GPL be we expect that. How does this stop anyone from writing SenderID checking software that is GPL'd or GPL friendly?

Re:It's pretty simple

[Featureless]

All true, but we can probably stop address forging.

If no one's done it yet, then this is basically the call to arms. If we don't do it now, Microsoft will coopt and destroy email.

Re:It's pretty simple

[Anonymous Coward]

They've already done enough to cock email up with HTML. Tell them to RTFF (FAQ) and FOAD.
Microsoft are the reason why we have 90% of the viruses and trojans. Tell them to fix Outlook and it's kindred or piss off.

Re:It's pretty simple

[Anonymous Coward]

It seems that the spam problem has presented Microsoft with a unique oppurtunity to, to use your word, "re-engineer" the email infrastructure. Clearly, this is advantageous to Microsoft as it facilitates the locking of people within their proprietary solutions. Given that it is so advantageous the obvious question to ask is whether the spam problem has been deliberately created by Microsoft in order for them to solve it, in an almost chivalrous manner.

I personally believe that this is a probable scenario. Certainly, Microsoft have the resources to send spam in the quantities required and more worringly, they have control of a all the many Microsoft installations that are responsible for sending spam anonymously via all those pesky trojans that have been rampant of late. I must admit though that I find it difficult to believe that Microsoft would take advantage of their own security holes in order to press the advantage in the email wars as it damages their reputation in other areas. None-the-less, it's a possibility that requires serious investigation.

I appreciate that this seems very "tinfoil hattish" but it can't be helped if my brain is so large that I can imagine these things. I can only hope that their are people reading this who's at least as smart as I am and also has the power and resources to investigate this further. The whole world waits in anticipation.

Re:It's pretty simple

[Iphtashu Fitz]

but why do I need to do that much extra work when the existnig DNSBL stuff works and could be used in nearly every MTA as is without doing any extra code

First of all SPF targets an entirely different problem inherent to spam than DNSBL's do. SPF specifically targets forged "From" addresses. DNSBL's target the originating IP of the e-mail. You can't target one type of spam using the other method.

Second, even support for DNSBL's didn't exist in the vast majority of MTA's until spam became a problem and the first DNSBL's like MAPS came along. If SPF becomes more and more widespread in its use then I'm sure you'll start seeing support for it getting rolled direclty into MTA's rather than having to use add-on's.

Re:It's pretty simple

[gaijin99]

How does this stop anyone from writing SenderID checking software that is GPL'd or GPL friendly?

It stops it because MS has patents on some of the critical aspects of the "standard", and their license for using the "standard" can be modified to preclude someone from implementing a GPL'd implementation. It doesn't now, but they explicitly reserve all rights, and state that they can modify the license at any moment, so what keeps them from screwing us with this?

Look at what SCO is doing now, claiming to own ELF, using that as an attempt to demand money from Linux users. If we let MS's non-open "standard" become a real standard they'll wait a few years until everyone depends on it, then use it as a weapon to try and crush competition. I'm not being paranoid here, I'm simply extrapolating from MS's history; they do that sort of thing on a regular basis.

Re:It's pretty simple

[c]

Letting Microsoft have any involvement in the email infrastructure - other than using it - will be a disaster. And it will be all the more terrible because of how easily it can be prevented.

To be honest, I'm still not convinced that letting them just use e-mail wasn't a disaster.

c.

Re:It's pretty simple

[Skapare]

The fundamental [thing?] with email is that I want any person in the world to be able to send me a message but I don't want spam. The problem is there is no tehcnial way to tell them apart.

If you are presuming that SPF, or the like, would determine what is, or is not, spam, then you are misunderstanding what they do. But I'll guess you are just pointing out the misdirection of SPF.

But let me add on to the technical problem you pointed out. The very same message from the very same sender may be spam to you and not spam to me. Yes, I do get marketing email because I have requested it. I just do that far less these days because of so much distrust created by the spam problem. I'm glad you aren't proposing some content analysis solution.

My point is, we really should not be even trying to tell whether something is, or is not, spam. Instead, we should focus our efforts at those who are clearly sending things they know people do not want. The technical term for spam is Unsolicited Bulk Email (UBE). Nothing in that term has anything to do with the content. If I were to send a copy of this post to the millions of recipients on one of the spammer lists, it would be UBE despite not being a commercial marketing message.

Our real focus should be on those who do the spamming that steals our time, our computer processing resources, and our network bandwidth resources (this theft persists even if the mail server refuses to accept the mail, as mught be done with a DNS based blacklist), and on those who provide them with the finances and services to keep the spamming activities going (meaning: also include those who pay spammers for services, and those who provide services to spammers). Doing that will be hard, since most of the largest ISPs in the USA are hosting spammers and refusing to stop their activities. MCI/UUNET is apparently the worst right now.

Re:It's pretty simple

[darksaber]

So why doesn't someone make a DNSBL taking names of the form ip.ip.ip.ip.fromdomain.myfunkydnsbl.net? If I recall correctly, it isn't too hard to add such a rule to sendmail.

If you were ever a sendmail admin before they added the most recent set of macros, its probably the same amount of effort. Basically, you were saying "do a check on $4.$3.$2.$1.rbl.net", so if you can do the same check adding from domain, then you could leverage most of the same code.

Re:It's pretty simple

[Zeinfeld]

Exactly my thought. So why is this an issue? Can we not write on own code for sendmail and other open email servers? Why does this sound like RMS is FUDing us just a bit? Sure MS' software will be non-GPL be we expect that. How does this stop anyone from writing SenderID checking software that is GPL'd or GPL friendly?

I am a member of the MARID WG. I have been working on this for two years. RMS has made no attempt to talk to anyone in the group to find out the real situation. All he did was to wade in and make a statement to promote his own agenda.

I'll not pretend that I am not pissed off with RMS, he is to the anti-spam world what Ralph Nader is to the anti-Bush world.

The real situation is that the licensing issue was considered when the original submissions were made. Then when Caller-ID and SPF were merged for sound technical reasons the licensing issue has to be revisited. We asked Harry and Jim to take up the licensing issue with their lawyers about a week ago. They are meant to come back with a reply before we have the MARID meeting at the San Diego IETF the week after next.

Obviously the group is not going to accept an encumbered specification. The brutal fact is however that if you do not patent the ideas behind a protocol someone else will. Remember the $500 million Eolas judgement? So now we have to go through the licensing issue every single time we write a standard.

The fact is that I have never been in a situation where we have failled to get a satisfactory license grant with respect to any technology that was held by a vendor who actually makes products. I have negotiated with Microsoft on this issue many times and have always ended up with a license acceptable to all parties including OSS.

Now less than 24 hours after Microsoft go off to talk with their lawyers people start campaigning to take the Microsoft technology out using the licensing issue as an excuse. This came mainly from a group of tourists who had had nothing to do with the group previously. It is very obviously a campaign by people whose priority is not getting the best MARID spec we can.

This type of scheming is both unprofessional and damaging. Microsoft are on notice that they have to deliver a satisfactory license in the next 9 days. It has been made clear that this will have to have a sublicense clause and allow both commercial and GPL implementations.

The purpose of MARID is to address the spam problem. People who have other agendas, particularly using it as a forum to attack Microsoft are so not wellcome. The IETF is already in a very weak state, over the past ten years its influence has declined from being the most influential Internet standards body to being a distant third. One of the reasons commercial vendors have learned to avoid the IETF is that more effort is spent on ideological food fights than engineering issues. The point of MARID was to try to prove that the IETF can produce specifications in a timely manner relevant to real world issues - i.e. less than five to ten years. That point is lost if we have people trying to prevent commercial vendors having any influence in the process. At the end of the day the only reason any standards group has influence is that it can influence vendors and major OSS projects that have influence.

The complaints are not about the license issue, that is being addressed. This is the machinations of a faction who want to use MARID for conducting a vendetta against Microsoft and don't care what the effect on MARID is.

Re:It's pretty simple

[Anonymous Coward]

Microsoft owns patents on the XML used in Caller-ID. That can be used against people who write open source tools, and Microsoft has somehow managed to make any statements clearly opening up the license for this. It does permit *some* use, but not enough. They're stonewalling: it's one of the reasons the MARID group threw out so much of the Caller-ID cruft in the proposal.

Very, very little of the Caller-ID spec remains in the proposal. It's been fascinating to watch the back door dealing: as an observer, I swear they're saying "get Microsoft to commit, then throw out the stupid stuff so they're stuck with the good stuff of SPF".

Re:It's pretty simple

[grahammm]

But XML is one of the features from Caller-ID which MARID has rejected. So if that is all Microsoft are claiming rights to, Sender-ID will not need a license from Microsoft - end of problem. But as Microsoft are still claiming a license is required, there must be something licensable still in Sender-ID.

Re:It's pretty simple

[LO0G]

Mod Parent Up. Straight from the horses mouth.

Re:It's pretty simple

[a_n_d_e_r_s]

Actually publishing an idea will prevent it from being patentable by others accordingin to the law.

And yes I know it practice that may not always be the case - but its not even safe if you have a previous patent for it to not be patented.
A guy describe how he got a patent on an already patented idea, some patent-lawyers managed to change the wording of the patent application so it was not obvious and got the patent. It may be unenforceable in a court because of that but hey the company got another patent.

Re:It's pretty simple

[Zeinfeld]

Actually publishing an idea will prevent it from being patentable by others accordingin to the law.

In theory yes, in practice no. Microsoft had a $500 million judgement against them on the Eolas patent before that got squashed. They were not even allowed to present their evidence of prior art. There are plenty of judges who are as stupid as the USPTO examiners.

We spent millions 'winning' a bogus patent case.

The situation in the MARID WG is like the UN weapons inspectors in Iraq. We have given Microsoft a deadline to comply with the request in a satisfactory manner. If the war is started before that deadline expires who exactly is acting in bad faith?

Re:It's pretty simple

[wayne]

PHB?

RMS has made no attempt to talk to anyone in the group to find out the real situation.

I'm not sure how you know this. Apparently he was communicating with Michel Bouissou.

We asked Harry and Jim to take up the licensing issue with their lawyers about a week ago. They are meant to come back with a reply before we have the MARID meeting at the San Diego IETF the week after next.

For those who aren't in on who's-who on the IETF MARID working group, Harry and Jim are two of the folks from Microsoft who are working on the SenderID proposal.

However, I know that I have been asking for resolution for this licensing issue on the working group for much more than a week. This is not a new issue.

Now less than 24 hours after Microsoft go off to talk with their lawyers people start campaigning to take the Microsoft technology out using the licensing issue as an excuse. This came mainly from a group of tourists who had had nothing to do with the group previously. It is very obviously a campaign by people whose priority is not getting the best MARID spec we can.

This is almost completely not true. Microsoft lawyers have been in discussions over the license issue since early June (6 weeks ago). While there were indeed some luckers who posted first about the license issue, many of the active participants in the working group started the license discussion. People who object to the current SenderID license for MS do want the best proposal possible. If no one objected to the license, we would have a bad proposal.

Re:It's pretty simple

[dnoyeb]

The more common occurance is the company that promises not to enforce their patent, sells their patent. Or goes out of business.

The new company never made such a promise, and further, they bought the patent with the expectation to enforce it for profit.

We dont expect MS to go out of business, but they could loose interest and sell the patent at any time.

Re:It's pretty simple

[Zeinfeld]

I'm not sure how you know this. Apparently he was communicating with Michel Bouissou.

If he had made any effort to find out the Microsoft position he would know that the Microsoft lawyers were working on the situation. He could have found that out by reading the post on the matter from Ted Hardie the IETF area director.

RMS never bothers to find out what the situation is that he is wading in to.

This is almost completely not true. Microsoft lawyers have been in discussions over the license issue since early June (6 weeks ago). While there were indeed some luckers who posted first about the license issue, many of the active participants in the working group started the license discussion. People who object to the current SenderID license for MS do want the best proposal possible. If no one objected to the license, we would have a bad proposal.

Nobody has any problem with the way you raised the issue. The issue was raised earlier, but it is only a bit over a week since Microsoft took an action item from the group to raise specific license terms with their lawyers.

Sure this could have been handled better, but what do you expect when we don't have a proper issues list, we don't have regular conference calls and the internal working processes of the WG are amateurish in the extreme? If we were in OASIS then you would have raised the issue on the WG list, we would have discussed it the next week in a con call and Harry would have been given an action item to follow up. The Jabber sessions simply don't provide an acceptable substitute.

The point is that one the issue is raised, a means of addressing it is accepted and there is a deadline for a response people should not go arround asserting that it is obvious that they are acting in bad faith and that the group should proceed on the assumption that this is the case. But thats enough about the treatment of the UN weapons inspectors in Iraq, lets get back to the MARID WG.

The sublicensing issue is an important one for all the parties - the commercial software providers and the OSS projects. Lotus and Sendmail will have the same issue.

Re:It's pretty simple

[10am-bedtime]

"sound technical reasons" for a "license". that shows how confused you are.

please understand licensing is a political (root stem: "pol", common in policy, police, metropolis, and so on) question not a technical one. sound technical reasons are appreciated by both computers and people. licensing is only ever (un)appreciated by humans, though of course, computers are integral to implementing the schemes.

you whine about RMS pushing FUD and yet you sully the purity of a computer's one-and-zero worldview w/ the issue of licensing. as a fellow human, i can understand and sympathize w/ your confusion. get well soon!

Re:It's pretty simple

[CAIMLAS]

As far as I know, it's not legally possible for someone to make a retroactive license.

Thus, if someone takes the standard and makes a GPLed application with it, the principles and code within that application are then made public domain. MS has patented it, yes - but it would also seem that they would be either not protecting their patent intentionally, or giving blanket rights to the patent to anyone that asks via the GPL.

Re:It's pretty simple

[topynate]

So make them dedicate the patent.

Re:It's pretty simple

[Anonymous Coward]

I'll not pretend that I am not pissed off with RMS, he is to the anti-spam world what Ralph Nader is to the anti-Bush world.

What, pro-something and constructive?

Re:It's pretty simple

[Saucepan]

So make them dedicate the patent.

As a geek, I too tend to have trouble grasping the political realities inherent in the standards process. But even I can see that the IETF is in no position to "make" MS dedicate a patent. If the IETF makes outrageous demands, MS will just take their ball and go home (or, more likely, to a more vendor-friendly standards organization like OASIS), and the IETF will see the further erosion of its influence over the real world of deployed Internet software.

Re:It's pretty simple

[topynate]

It's not really an outrageous demand, if Microsoft only filed for the patent to prevent someone else doing it. If they intend to make money off it in some other way than charging every mail server operator, though, then it wouldn't be an acceptable condition. In that case, licensing is the solution, but that license must be irrevocable. Can't have MS coming along 10 years later and changing the terms unilaterally.

Re:It's pretty simple

[black mariah]

they do that sort of thing on a regular basis.

Name one instance where MS has pulled a Rambus and had their patented process integrated into a standard, then sued everyone over implementing the standard.

Re:It's pretty simple

[SteveAstro]

The World != USA In the rest of the world, EOLAS wouldn't have a cat in hells chance, ANY publication of an idea in Europe or Japan BEFORE filing ( the only other markets that matter, probably) AUTOMATICALLY invalidates the patent.

Steve

Re:It's pretty simple

[eric76]

Placing something under a GPL license is nothing like making it public domain.

Public domain means that the authors have surrendered their copyrights over the material.

With the GPL, the authors still retain full copyrights to the material. The license defines how you are permitted to use it. If you do not follow the license, you have no permission to use it.

Re:It's pretty simple

[Zeinfeld]

It's not really an outrageous demand, if Microsoft only filed for the patent to prevent someone else doing it.

It is a demand that they have already conceeded. The argument has been created by a tiny number of people with a political agenda.

Microsoft was given some time to go talk to their lawyers. Instead of waiting for them to get back to the group these people start a flamewar and then when they are told to shut up and wait by the AD they take it public.

These guys are not doing this to help MARID or make MARID open source. They are doing it because they don't want Microsoft or for that matter any vendor having any influence in the standards process. Only they want us to then go and use our influence in the market to promote whatever decision they made.

Real life does not work that way.

Re:It's pretty simple

[LO0G]

Actually the IETF has a mechanism in place to deal with patents that cover IETF protocols, what Zienfeld is describing is simply the process at work.

RMS jumped the gun (again) and produced a knee-jerk reaction - Microsoft, by the very fact of it's existance must be bad, thus it must be opposed.

Zienfeld is stating the reality: The IETF has a process for dealing with IPR that conflicts with the IETF's mandates (open protocols) and this issue is being worked through that process.

No controversy, except among those that want to create controversy for the sake of creating controversy.

Re:It's pretty simple

[shaitand]

"With the GPL, the authors still retain full copyrights to the material. The license defines how you are permitted to use it. If you do not follow the license, you have no permission to use it."

bzzz wrong. The GPL is a license which defines terms to DISTRIBUTE and COPY the material. Copyright law doesn't give the holder of a copyright any authority over how you USE software.

EULA's state terms of use (the GPL is not a EULA), there is no backing for them under copyright law. If they have teeth at all it's in contract law, not copyright law. Whether they do have said teeth is something which hasn't been settled in court yet.

Re:It's pretty simple

[shaitand]

Although not a published standard to my knowledge, they did this de facto with the FAT filesystem.

Re:It's pretty simple

[shaitand]

EOLAS got squashed?

The last news i had was here on slashdot less than a week ago, Microsoft was appealing the decision and Eolas was trying to prevent Microsoft from even being able to attempt an appeal.

That is far from over and hardly squashed?

Re:It's pretty simple

[shaitand]

You have to admit Zein, if there is a vendor you don't want involved in the standards process, it's Microsoft.

Their entire business model to date has relied on breaking standards.

Re:It's pretty simple

[Anonymous Coward]

Parent has concisely stated the heart of the issue, please mod up with extreme prejudice.

Re:It's pretty simple

[thogard]

I was thinking more along the lines of $4.$3.$2.$1.$USER._at.$DOMAIN. For sites with fixed user lists, this is trivial and provides user level control as well. It also has the potential to let a user specify other addresses they will be mailing from so they can email form home but they can't joe-job everyone else from home.

Re:It's pretty simple

[eric76]

I miswrote what I meant.

When I wrote "use", I was thinking in terms of those rights that the copyright holders control including copying, distributing, and modifying.

Re:It's pretty simple

[Ann Elk]

I'll not pretend that I am not pissed off with RMS, he is to the anti-spam world what Ralph Nader is to the anti-Bush world.

Wow, you managed to insult RMS and Nader in a single sentence. I now have my first Slashdot Friend. Thanks!

Re:It's pretty simple

[duffahtolla]

Rambus wants to get paid a cut for every DDR chip sold.

Rambus, it was revealed during the trial, charges a 3.5 percent royalty on DDR DRAM and a 0.75 percent royalty on SDRAM, fairly high by industry standards. In the end, that means Rambus gets about $2 per PC with DDR DRAM and 17 to 20 cents of SDRAM-equipped PCs.

MS wants to get paid a cut for every PC sold.

Virtually all major PC manufacturers find it necessary to offer Microsoft operating systems on most of their PCs. Microsoft's monopoly power allows it to induce these manu- facturers to enter into anticompetitive, long-term licenses under which they must pay royalties to Microsoft not only when they sell PCs containing Microsoft's operating systems, but also when they sell PCs containing non-Microsoft operating systems.

With Rambus it was all about the money.

But MS already has an incredible cash cow, so with microsoft, its all about control. Most of the shenanigins we see are just BG making sure no body screws with that cow. Tying future versions of a 100% standards compliant email server to windows would be one such way.

Try writing microsoft to get a license for an opensource, gpl'd, linux based email server compatible with "sendit-id".

There wont be a lawsuit. No theatrics, no RABMUS or SCO styled lawsuits. But there also wont be that license. Because by default, the new "standard" will not be compatible with GPL.

MS wins without a fight. Look to see alot more of MS tactics like this one.

Re:It's pretty simple

[thogard]

I'm aware that SPF isn't useful for spam fighting. The 1st message to hit my server after I put in SPF checks was spam form a throwaway domain with a valid SPF record.

My web site has fairly high rankings in google with several sets of obscure technical terms. That means I get spam from people who personally write the message to me. They looked at the web site and sent me email trying to sell me something. It may be a spam run of one, but it still ends up in my mail box.

Reading /. you can tell most people have no clue about the economics of spam and who's getting paid to do what. From what I can tell you have a spamer operation that finds clients that want to spend $1,000 to $10k to advertise and they take that money, buy domains, bonds, T1s, colo servers or whatever they need and then send out millions of messages. Thats how most of the bulk stuff works and unless the price of doing that is too high, there is no way the bulk stuff will go away. That is another problem that is hard to fix because the seller of the resources can't tell a spam operation from a legit operation for some time.

Re:It's pretty simple

[shaitand]

I still have to be anal about it, today people start saying "use" meaning thos aspects of it which copyright allows control over.

In a couple years the distinction is lost and it becomes common knowledge copyright is meant to allow control over the "use". Next thing you know laws start being made and interpreted to that effect.

Seeing myself say that would make me laugh if this weren't already happening with copyright law :(

Re:It's pretty simple

[Anonymous Coward]

...Microsoft lawyers were working on the situation.

What a relief!

Re:It's pretty simple

[killjoe]

" IETF will see the further erosion of its influence over the real world of deployed Internet software."

I am not trying to be a troll but honestly what good is the IETF. You can't make MS do anything it does not want to and MS can choose to ignore any standard they want.

The ugly reality is that the computing world is at the mercy of Bill Gates. If he chooses to play with you then it's his ball, his playground, his game, his rules, his referees. It's his world and he just lets you live in it.

Until you have some way to make MS conform to your standards you indeed have no influence.

Honestly. What good are you? What good is a standard if there is no punishment for breaking it?

Re:It's pretty simple

[Anonymous Coward]

that's not really spam then is it?

Unsolicited e-mail, often of a commercial nature, sent indiscriminately to multiple mailing lists, individuals, or newsgroups.

What your descibing is annoying, but its much less annoying than spam.

Re:It's pretty simple

[checkup21]

The IETF is already in a very weak state, over the past ten years its influence has declined from being the most influential Internet standards body to being a distant third.

And this is the reason you are passing _them_ the lever ? Have the last 10 years not been a lesson to us all ? And now you say "we're too weak, we have to do what they want".... listen what i say : "f**** off". Have a nice day.

Mr. Polemic strikes again

[Bender_]

Why cant RMS just try to improve the situation, make a counteroffering, give suggestions instead of ranting about everything that is not exactly along his line of view?

Re:Mr. Polemic strikes again

[dmaxwell]

Would you have considered this basic message if anyone other than RMS brought it up? Letting MS flibbertyhammer things so that you have to give MS money to use email is just plain rotten no matter who points it out. Bandwidth usage or not, Filtering gives me a spam free inbox right now and I didn't give MS one red cent to have it.

Letting MS jigger open protocols so they can say who can participate is just plain wrong. It's even wrong if they fix it so you can say "neener, neener" to RMS.

Re:Mr. Polemic strikes again

[Anonymous Coward]

Isn't calling attention to the problem - and urging people involved to be careful, consider consequences etc. - not improving the situation? He is giving suggestions: don't let email be controlled in this way; instead let's find an open and free solution.

Re:Mr. Polemic strikes again

[Anonymous Coward]

Why cant RMS just try to improve the situation, make a counteroffering, give suggestions instead of ranting about everything that is not exactly along his line of view?

By your own metric you should have STFU because you don't seem to be offering a solution. RMS is always set-up by people who are afraid of politics as a straw-man "loonie". Hardly any of these people have heard him speak, or read his work. All I can say is he has his convictions and he stands by them and makes valid points on their behalf.

Which is a damn bit better than whinging on slashdot all the time WITHOUT a reason and WITHOUT argument.

Yes I am AC, I don't have an account, cue the "hi RMS" jokes to make it look like he is "alone". You american's have a stange culture of being afraid of people with political convictions - seeing as many of you are "nerds" who's interests are also considered "conversation killers" I would imagine you would have more sympathy for Mr Stallman. However, it seems certain cultures of being anti-political and beating down on principled people are alive and well in the "land of the free" as you so eloquently, and often, put it.

Politics is not something above and beyond the "nation-state" in the three arms of government your American civic class might have said (if you listened). Politics is everywhere, in the words we use, the actions we take. To divorce politics from the everyday, is to divorce personal responsibility from politics. This is the essence of a refined citizenship. And one of which Mr Stallman is a premier example.

So offer your solution, or STFU.

As to me, I am allowed to speak because I offer a solution to a different problem I have identified. The problem is that we must not divorce politics from our own actions, for this is the meaning of citizenship. And to attack another citizen for doing so is a meaningless and ill informed attack on the heart of what democracy *is*. For it is nothing more than good men standing by their beliefs. Hence, what you do when you play into this "attack the outsider" paradigm is to attack democracy itself.

Not so grand as a world war, but this rot is more dangerous to democracy than any other history will ever see.

Re:Mr. Polemic strikes again

[Anonymous Coward]

Your hatred of RMS has blinded you. RMS states that the license is not compatible with free software. Obviously a different license solution unencumbered by Microsoft IP restrictions needs to be found.

Re:Mr. Polemic strikes again

[Anonymous Coward]

I don't care about whatever RMS is commenting on this time, and I'm an AC too...

But I actually work near, and have talked to, RMS... and this:

"RMS is always set-up by people who are afraid of politics as a straw-man "loonie". Hardly any of these people have heard him speak, or read his work. All I can say is he has his convictions and he stands by them and makes valid points on their behalf"

is flat-out ridiculous. An example: here (at MIT), RMS routinely bombards lab-wide discussion lists with wide-eyed, foaming-at-the-mouth rants about how "Charles Vest is a veritable Nazi, dedicated to eradicating free-speech at MIT," or how the Boston Police use "Gestapo" tactics to break up non-violent protesters, as an extension of the "brutal US Empire" and its interests.

These mass-emails are received by many people who, despite your 'nerd' label, actually are interested in politics, are fairly smart, lean pretty far to the political left (not many fans of the Bush administration, here)... and many of them are also ideological supporters of Free Software, oppose Microsoft in all its forms, etc...

And yet, even here, RMS is known as a bare-foot loon. His emails only tell half the story, he's completely immune to reason, and many of the people who agree with him have unsubscribed from the discussion lists just to be rid of his (and other similar senders') constant stream of invective. So don't get all 'You Americans' and 'people use RMS as a straw-man' on me... even those who work around him, and agree with many of his basic political tenets, think he's an off-the-deep-end zealot.

Re:Mr. Polemic strikes again

[Anonymous Coward]

A member of the working group mailing list already answered your question here

He said:
It is my understanding that MS lawyers have been in contact with at least the lawyer from the Open Source Initiative and the FSF for about 6 weeks now. I think we have shown a great deal of patience, but this WG is supposed to have a last call this month and time has basically run out.

Re:Mr. Polemic strikes again

[Zeinfeld]

Why cant RMS just try to improve the situation, make a counteroffering, give suggestions instead of ranting about everything that is not exactly along his line of view?

That would require him to take the trouble to find out what is actually going on.

It is much easier to just wait for someone to prod him with a stick, tell him something bad is going on and ask him to drop an email into the working group.

I doubt that RMS will bother to reply to the argument he hopes to start. Incidentally it is somewhat ironic to have RMS complaining about inflexible licensing conditions when he is by far the worst offender.

The license issue was brought up a week ago, Microsoft went off to talk to their lawyers about getting acceptable license terms. Then a group of newcomers suddenly arrived and started a flame fest. This went on for a few days until the Area Director read the riot act, the type of personal attacks that were appearing are OK on slashdot, they are not acceptable in a professional forum.

Given the way RMS works it is quite likely that RMS was making a belated response to a message he had been sent at the start of the flame fest.

Re:Mr. Polemic strikes again

[Anonymous Coward]

cue the "hi RMS" jokes to make it look like he is "alone".

Don't worry, you are obviously British, and RMS isn't, so you're not him unless he is trying to make himself look British in your post.

BTW, it's "whose interests".

Re:Mr. Polemic strikes again

[NecoX]

Because he uses Linux? ;)
Bad joke, I know, but so often I see Linuxfanboys whine about Microsoft... then 5 minutes later they boot back into Windows do play some games.

Re:Mr. Polemic strikes again

[Anonymous Coward]

I second... I was at Harvard, heard RMS speak several times, have had a discussion with him after one of his speeches, and I fully concur with your take on his attitude and opinion. He is beyond a doubt a loon, and equally importantly, a not very socially aware one. I'm glad there are people out there representing the interests of FOSS, and I know he is one of the father's of the movement, but his uncompromising positions and incredibly recalcitrant demeanor make him beyond annoying to relate to. In short, he's smart, frequently he's right, but he's just so damned annoying he shouldn't really be serving as a spokesperson.

Re:Mr. Polemic strikes again

[shaitand]

"then 5 minutes later they boot back into Windows do play some games."

Thats not really an OS issue. Thanks to winex it's really not much an issue at all ;)

Re:Mr. Polemic strikes again

[weijiao]

RMS may have a particular point of view. Most people who try to bring about change do.

He has had a big impact on FOSS as we know it and is to be respected for that. Any standard, commercial or otherwise, that is incompatible with FOSS is potentially dangerous.

It is possible to make it comply - if it does not it is safe to assume that there is a reason that is not in the best interests of FOSS.

Re:Mr. Polemic strikes again

[CountBrass]

Where are my "-1 flamebaiting, self-important moron" mod points when I need them?

Re:Define 'free'

[lachlan76]

Free as in speech is what we want.
Not free as in beer.

What about RFC 3668 ?

[dago]

IANAL and don't want to be, but I always wondered what were the implications of this RFC (which is about intellectual property rights & IETF publications)

Wow, this is shocking

[Kadmium]

Newsflash: OSS community dissatisfied with Microsoft's actions. The shock caused by this devastatingly original sentiment is almost immeasurable.

Re:Wow, this is shocking

[Anonymous Coward]

Rather than posting something so obvious - Slashdot doesn't like Microsoft, film at 11 - why not learn more about the issue and submit something a bit more constructive.

Re:Wow, this is shocking

[Kadmium]

*shrugs*. It was a social commentary. I doubt anything I say or do here has any measurable effect whatsoever upon the issue at hand. Also, I don't really have an opinion on the issue, other than the fact that a good portion of the people reading the article (or, indeed, not reading it) will mindlessly dismiss any positive contribution Microsoft are making to the spam problem simply because it's them doing it.

First we wanted them to do something about spam, now we're pissed off that they're not doing it our way. If they did it under the GPL, we'd probably get pissed if they used SourceSafe instead of SourceForge. Maybe we'd be mad that they're writing in C# instead of C. I just wanted to point out that it doesn't matter what the issue is - if it's Microsoft doing it, they're Wrong.

Re:Wow, this is shocking

[Taladar]

That can be a simple and convenient answer to any of these Posts. IF however you read further and decide for yourself in each case, you might see that some of Microsoft's ideas ARE the BS they are called at /.

This system will either not work at all or kill email. The only reason email is still around is the "everyone can send an email to anyone else anytime". Email is far from technical superiority. But it is the lowest common denominator in the World of Internet Communication. That is it's only strength and if MS (or anyone else for that matter) kills this advantage email will be dead. The only remaining question is wether the old email systems will stay or will be killed in the process as well.

Re:Define 'free'

[Anonymous Coward]

Yeah, it doesn't exactly mean Open Source.
See http://www.gnu.org/philosophy/free-sw.html for the definition of Free Software.

Re:Define 'free'

[BabyDave]

When RMS talks about 'Free Software', he means 'Free' as in 'freedom', not 'free' as in 'costs nothing'.

Re:Define 'free'

[AKnightCowboy]

Strange, I thought free meant you didn't have to pay for it. 'Free' does not necessarily mean open source.

Not exactly. To the Free Software Foundation, "Free" has *always* been about being "open source" as you would put it. "Open source" was a relatively recent term adopted by people because people kept confusing zero cost with freedom to modify the source code and do what you want with it. RMS has been using the term "free" to describe that for decades.

it means sick

[wolverine1999]

MARID means sick in my language.. so it
does sound funny to me.

Re:it means sick

[Zorilla]

At least it's still a better acronym than MERDE.

OK lets look at the license

[blowdart]

Here is the microsoft license. It applies to the original Microsoft Sender ID spec. This is not the new spec, where they merged with SPF.

So, the license RMS is ranting about doesn't apply, and there doesn't appear to be another license on the Microsoft site. Having said that the Microsoft license does not stop the distribution of source, in fact there's a specific clause allowing it (2.2), you just have to include a paragraph in the source code. Nor does RMS say what his problem is, aside from "Grrr, it's Microsoft".

Of course the SPF implementation is still "non-licensed", there's no mention of restrictions, although they do point out there are patents all over the anti-spam arena.

But hey, we don't expect people to look at this stuff, lets just add yet another protocol.

Re:OK lets look at the license

[dilvie]

Thank you for the clarification. This post is more informative than the original article. Incidentally, I think MTA authentication is a good idea, but I also think that all e-mail should be authenticated at every step, and encrypted using public-key encryption.

Validation, encryption, and a great anti-spam measure all in one. Is my logic flawed?

Re:OK lets look at the license

[Anonymous Coward]

2.2 clearly states "nontransferable"!

Re:ITS TEH ITCHIES!!!

[Anonymous Coward]

He's not asking for advice on what he *should* have done, you insensitive clod. Damage control!

standards and stuff

[gbjbaanb]

its probably a good thing. If anyone could amend the software, they could, for example, add a section that says 'but accpet all spam.com emails'.

I understood that the protocol was to be made into a standard, so how would changing the software help us?

The Licence (pdf) says that MS grants you a non-transferable licence to use it and sell it on to end-users.

If you do redistribute the source code, its fine, but you must add a clause to your licence that says the software may contain IP owned by MS, and that anyone obtaining such derived source must go ask MS for permission to use their bits directly - you can't give that away.

So I can only surmise that when RMS says it is incompatible with free software, he means the GPL. It is acceptable to use the software, look at it, but you can give it to someone else, but they cannot take away the terms MS set. Sounds a bit like the GPL, but with different terms. (hey RMS, you don't want to agree to those terms, you don't have to use the software).

Re:standards and stuff

[Anonymous Coward]

hey RMS, you don't want to agree to those terms, you don't have to use the software

Then how will we send email from GPLed MTA's? This isn't copyrighted code, this is a supposed MS patent on a well understood idea so it's actually nothing like the GPL, not even close.

Re:standards and stuff

[Pharmboy]

After a quick view of the license, here are the obvious problems I found with it, and why it is not compatible with Free software:

1. You can only use the code for software that is related to Caller ID (section 2.1)

2. Annoying advertising clause that says if you want to rebrand the code you must get permission from Microsoft. In other words, you can't fork the code under a different name. (section 2.2)

3. Overall reading seems to indicate that you must accept the license in order to USE the software, even though you did not sign anything. This is directly in opposition to the GPL.

4. The focus of the document is how you have the "right" to use their "patented" code. If this doesn't throw up red flags, nothing does. This means they can withdraw the license at any time, since it is more of a contract to use patented software than it is a license to distribute.

5. The clause in section 2.4 "Defensive Suspension" gives Microsoft broad discression to "terminate all license grants" if _they_ are sued in any way regarding the technology. This means, "sue us over the restrictions and we can instantly take away your right to use it, and thus your right to transfer email". It guarantees a bullet proof monopoly on the Patented technology.

And yes, there are plenty of other things that are at odds with the GPL, those are just the EASY to find items. See it yourself at the PDF link you provided.

Re:standards and stuff

[Smallpond]

Before you go all Sally Field on Microsoft, can you name another common Internet spec that you have to sign an agreement to use?

You call it a License, which it is not, Microsoft calls it an Agreement.

A License is a one-way set of conditions. Anyone can use the product under the terms of a License. The GPL is a license to use copyright works.

An Agreement (or License Agreement, or Legal Agreement, they all mean the same thing) is a contract with mutual obligations. You can make any set of conditions that you want in a contract as long as both sides agree and sign.

Re:standards and stuff

[tc]

2. Annoying advertising clause that says if you want to rebrand the code you must get permission from Microsoft. In other words, you can't fork the code under a different name. (section 2.2)

So it's more BSD-like then, big deal.

3. Overall reading seems to indicate that you must accept the license in order to USE the software, even though you did not sign anything. This is directly in opposition to the GPL.

Why is that different to the GPL? They're both licences that apply to the use of software. Without a license, you can't legally use any non-public domain software. The GPL is one such license, this is another.

4. The focus of the document is how you have the "right" to use their "patented" code. If this doesn't throw up red flags, nothing does. This means they can withdraw the license at any time, since it is more of a contract to use patented software than it is a license to distribute.

Newsflash: licences are contracts. The GPL is a contract. Of course this one reads like a contract to use patented software - what else would you expect it to be?

5. The clause in section 2.4 "Defensive Suspension" gives Microsoft broad discression to "terminate all license grants" if _they_ are sued in any way regarding the technology. This means, "sue us over the restrictions and we can instantly take away your right to use it, and thus your right to transfer email". It guarantees a bullet proof monopoly on the Patented technology.

Isn't that more of a self-defence clause in case people find bugs and want to sue Microsoft about it?

And yes, there are plenty of other things that are at odds with the GPL

Big deal. Why does everything have to be GPL compatible? What would be wrong with, say, a BSD-style license for this particular application?

Re:standards and stuff

[Pharmboy]

So it's more BSD-like then, big deal.

Actually, it is a big deal. The old BSD license that had the advertising nag is NOT GPL compatible, per the FSF.

They're both licences that apply to the use of software.

You need to READ the GPL. It flatly says you need NO license to use it, only to distribute it. This is a major difference in Free and non Free licenses.

Newsflash: licences are contracts.

Not according to the law. A license is a grant to someone to use copywrited material. There is more than enough case law on the differences that I won't go into detail here, google it.

Isn't that more of a self-defence clause in case people find bugs and want to sue Microsoft about it?

Yes. And it is so vague and broad in scope that the potential for abuse is a serious concern.

Big deal. Why does everything have to be GPL compatible? What would be wrong with, say, a BSD-style license for this particular application?

That would be fine. A modern BSD license *is* GPL compatible. (without the ad nag). This license is not "Free". Its not the worse license in the world, but its still not Free. When it comes to software that sets standards for the entire internet, it is much better for it to be Free, so that one company does not abuse it. Technically, this license would allow MS to change its mind once the technology is developed, and start charging people to use the technology. THAT is why the license must be free, to protect everyone who uses the internet, including your right to sell the software for any price you want.

I don't care about the license for MS Office, I can choose to use Open Office, but if MS patents this, then gets greedy, I can't run mail servers without paying a royalty (at least the servers wont be able to connect to other servers that require this 'patented' protocol). This is not acceptable to me, even if it is not likely to happen.

Re:standards and stuff

[Anonymous Coward]

So it's more BSD-like then, big deal.

BSD license is applied to copyrighted works, this is a patent license for your rights to impliment an idea that will be needed by all MTA's. Very big deal.

Why is that different to the GPL? They're both licences that apply to the use of software. Without a license, you can't legally use any non-public domain software. The GPL is one such license, this is another.

The GPL is a copyright license that applies to software, this is a patent license, a license on an idea!

Newsflash: licences are contracts. The GPL is a contract. Of course this one reads like a contract to use patented software - what else would you expect it to be?

Licenses are not contracts! In absence of the GPL you have no rights under copyright law, it is a license that permits redistribution and requires no agreement. If you require a different license some developers will enter into a contract and provide an alternate license for redistribution of their copyright work.

Isn't that more of a self-defence clause in case people find bugs and want to sue Microsoft about it?

Or an illegal condition by a monopoly that wants to move into collection patent licensing revenue.

Big deal. Why does everything have to be GPL compatible? What would be wrong with, say, a BSD-style license for this particular application?

Because internal MS memos have stated that they are going to use "intellectual property" to destroy linux hence the GPL.

Anything else?

Re:standards and stuff

[JasonStiletto]

And so, if the mailserver is under the GPL, it can't both use this as it stands and still be under the GPL. Are you advocating that any and all Mailservers that are under the GPL switch their license (which would require all contributors to agree) or that they simply don't implement a standard that would ultimately, hopefully, reduce the amount of spam coming into your in box? Or, of course, the third choice, implement it anyway, in volation one one or the other license? Maybe even both. This is a serious and important issue.

Re:standards and stuff

[Eric119]

So I can only surmise that when RMS says it is incompatible with free software, he means the GPL. It is acceptable to use the software, look at it, but you can give it to someone else, but they cannot take away the terms MS set. Sounds a bit like the GPL, but with different terms.

No, he means free software. If you have to ask someone permission to use or distribute part of it, it is not free.

(hey RMS, you don't want to agree to those terms, you don't have to use the software).

Saying, "Just ignore it." is not a valid response to a complaint. The mere existance of the terms is the problem. And you don't need to tell RMS not to use software under a non-free license; he's been doing that for years.

Re:standards and stuff

[shaitand]

"Why is that different to the GPL? They're both licences that apply to the use of software. Without a license, you can't legally use any non-public domain software. The GPL is one such license, this is another."

WRONG. The GPL does not apply to use, only to distribution and copying. Copyright law does NOT grant authority to control how material is USED. Licenses which put restrictions on use are relying on CONTRACT law to do so.

The difference (aside from which law to look at) is that you have to knowingly commit to a contract, by default you have the rights which the contract seeks to void, and EULA's restricting use only offer you rights you already have in return for those you give up. It's also questionable whether a click-through EULA or worse, one which is just tossed in the package are contracts which you've ever actually agreed to.

The GPL on the other hand works entirely within copyright law and doesn't rely on contract law. It puts no restrictions on use whatsoever because copyright law doesn't give it a right to. Instead it specifies terms under which you can distribute the software... without that agreement you have no right to do so. Without any license you have the right to USE the software.

If you have possession of copyrighted material, and it wasn't obtained illegally. You don't need a license to use it, further whoever holds the copyright has no legal right to restrict your use.

Pirated or stolen material is something altogether different, you never have a right to stolen material.

Re:standards and stuff

[shaitand]

Close but off on a few points:

"Newsflash: licences are contracts.

Not according to the law. A license is a grant to someone to use copywrited material. There is more than enough case law on the differences that I won't go into detail here, google it."

Not quite right. A license is a grant to distribute or copy copyrighted material. You do not need a license to USE copyrighted material. Copyright law grants NO control over the USE of a copyrighted work. It's not like the holder of a copyright OWNS the work, the public owns it (if anyone, since it's an idea and idea can't actually be owned or even unique), he just has the rights the public gave him in the copyright.

The GPL has no restrictions on use because the GPL doesn't rely on contract law, only copyright law. As I've already said, copyright includes no provisions for controling how material is used.

Commercial licenses on the other hand obviously do put restrictions on use. As such they depend on contract law for validity.

There are number of grounds under which they are of questionable legality because of this. First, the contract is asking you to give up some of your rights, and in exchange they'll give you some rights you already have in return (although there is always SOMETHING in there you don't already have to get around this).

Second it's questionable whether you've legally entered into the contract. Click through EULA's have not been tested in a high court as a legally binding contract. So you might still have all your rights.

Re:standards and stuff

[Anonymous Coward]

Licenses exist in copyright, trademark, and patent law, not contract law. You're describing a license agreement, which is a contract that imposes restrictions and then grants a license.

Re:standards and stuff

[Alsee]

You're describing a license agreement, which is a contract that imposes restrictions and then grants a license.

EULA are contracts, and in general they do not licence you anything.

Once you own a copy of software you do not need any licence at all to install and run it. You only need a licence to creat new copies, to distribute those copies, and for public performance. You'd be hard pressed to find an EULA licencing any of those rights, therefore they are not licencing you anything. They are pure contracts. And if you manage to install and run that software without voluntarily agreeing to be bound by that contract then the EULA is in no way binding on you.

The entire EULA legal theory is based on attempts to claim you did choose to agree to a contract first - "by breacking this seal you agree to blah blah blah". Such claims are legally questionable, but even if we accept that, if you manage to read the disk and install the software without breaking that seal, well you perfectly legally installed the copy of software you own and the EULA is not binding. You do not need the EULA. They generaly grant nothing you want or need.

-

Re:standards and stuff

[HolyCoitus]

Hey, that sounds like a good idea. Now you get a cracking on writing the MTA that everyone is going to use, since this won't work with any open source MTA that is in place.

Oh, and also keep in mind that you can't use this with Linux, and in order to send it to someone you need a license to do that, so I KNOW that OpenBSD won't be using it. I'm not sure on a lot of other things, but I can see that this will be a Microsoft only technology. No open source will use this at all. If that is how you like it, I don't know why you're even reading Slashdot... You're out of place if you have a twisted world view to think that closed source and closed standards are the way the world is going.

Sorry for the flame, I hate ignorace.

Link to license agreement

[Glock27]

Here's the link to the page for the actual license agreement in question - click on the "Royalty-Free Caller ID for E-Mail Specification License Agreement" link about halfway down to get the PDF.

A Sound Rejection may be in order

[dilvie]

It is absolutely essential that standards like this are open and available to everyone (including microsoft's competition). I haven't read the microsoft license yet, but if it indeed creates any type of obstruction for open-source (or any other) software, it should be soundly rejected.

It isn't clear to me from this story or the comments exactly how Microsoft would claim any type of control here. Can somebody clue me in?

Read the entire mail thread please

[MarsF]

* To: rms@xxxxxxx
* Subject: Re: Sender-ID and free software
* From: "Douglas Otis" <dotis@xxxxxxxxxxxxxx>
* Date: Sat, 24 Jul 2004 14:23:54 -0700 (PDT)
* Cc: "IETF MARID WG" <ietf-mxcomp@xxxxxxx>, team@xxxxxxxxxxxxx
* Importance: Normal
* In-reply-to: <>
* List-archive: <http://www.imc.org/ietf-mxcomp/mail-archive/>
&n bsp; * List-id: <ietf-mxcomp.imc.org>
* List-unsubscribe: <mailto:ietf-mxcomp-request@imc.org?body=unsubscri be>
* References: <>
* Sender: owner-ietf-mxcomp@xxxxxxxxxxxx
* User-agent: SquirrelMail/1.4.2

<* snip [ed] *>

Richard,

In the case of the PRA proposal, proponents have difficultly explaining
why this concept is better. PRA ensures there is NO relief with respect
to network overhead, even if messages are rejected. PRA ignores the
primary motivation for which identity is being spoofed, being a means to
avoid accreditation filtering, the RFC 2821 MAIL FROM. If accreditation
is allowed to become more effective with CSV, this oversight is
significant. A rather weakly supported claim is this will end phising.
Support for PRA checks overlooks the identity significant to the user, and
that many techniques still exist to allow phising, some without the need
to publish DNS records by the entity committing the fraud.

There is also a potential for network instability caused by early
termination of a series of DNS queries, that both allow accumulation of
outstanding UDP traffic and necessitate the resending of the messages. A
serious flaw made far worse with PRA. As PRA has been isolated, envision
rejection of both the Submitter and PRA draft. Take the BATV draft of
Dave Crocker and add a mode using an address based technique to include
the SPF record sets. This would allow Forwarding and List Servers for the
most part to continue working, without the use of Submitter. (EzMLM may
be an exception for signatures, but would still work with the SPF mode.)

Submitter and PRA should be rejected as being highly disruptive. Combine
SPF with BATV. Submitter and PRA fail to provide the most basic goal of
the MARID charter. That is to authenticate (and authorize) the MTA domain
(responsible for policy as implied with DNS), as compared to CSV that
ignores filtering objectives of messages, but accomplishes the basic goal
of the charter.

-Doug

Just a little contrast for those who read only one level deep.

Mars

Re:Read the entire mail thread please

[Zorilla]

Acronym count: MARID, RMS, Sender-ID, SPF, DNS, IETF, PRA, BATV, EzMLM, MTA, CSV.

Holy Jebus flying a helicopter! At least 11 acronyms in this thread so far!

Probably shouldn't worry yet...

[Ianoo]

So, we have Microsoft in the distinctly red corner with their proprietary standard.

Let's face it, as vocal as the OSS community is these days, there's not a lot that can be done to stop Microsoft from doing whatever the hell they like, so long as it's legal(!). Sure, sendmail is OSS software, but I got the impression that SPF is pretty much independent of the MTA software anyway.

But, in the blue corner, we have plenty of heavyweight companies who are big on Linux and big on e-mail who have teams of lawyers that have undoutedbly been over this license already, and found the problems.

We have IBM, the people who make Lotus Notes, which is still pretty widely used, IIRC. We have Novell, who now own SuSE/Ximian and are betting the shop on Linux, who produce NetWare. We also have Sun, who are getting vocal on OSS, which produces Solaris, which seems to power a large proportion of MTAs around the globe.

The best defense, surely, is to make sure these companies understand the issues with SPF, and don't implement it in their own products. After all, Microsoft won't get that far without support from other companies, since much as they'd like to, they don't currently control the world's Internet server market....

Ooops here's...

[Glock27]

the link

Too early in the morning I guess... ;-)

Because MS will hold the patent

[Anonymous Coward]

As the inventor, no doubt MS will hold the patent. So you have to license it, whether for GPL or otherwise.

If the license isn't GPL compatible then GPL software can't use it.

Re:Because MS will hold the patent

[Xformer]

M$ didn't invent SPF... they invented Caller ID. Sender ID is just the combination of those two things.

Re:Because MS will hold the patent

[Halo1]

If the patent even partly applies to sender ID, you're screwed nevertheless. And it's quite possible that the patent office will consider the combination of those two things non-obvious as well, resulting in another patent on the whole thing.

That said, I have no idea whether their called-ID patent applies nor whether they already have another patent (pending) on the combination of SPF and called-ID.

Re:Because MS will hold the patent

[grahammm]

And much of the original Caller-ID has been rejected, so there is far more of SPF in Sender-ID than there is Caller-ID.

Also nowhere have I seen any indication from Microsoft as to exactly what they are claiming the IP rights for. All that I have seen is that they stated that parts of Caller-ID are covered by a parent application and require to be licensed.

Some people have suggested that the patent is on the PRA algorithm (which determines the 'responsible' sender of the email) but this is basically just a codification of the way sysadmins have determined it by manually examining the headers. So should not be patentable because it is obvious to "those practitioners skilled in the art".

Re:Define 'free'

[BenjyD]

The kind of freedom RMS is referring to can't be taken away or used to discriminate between users - free as in zero price can be.

Off topic -- Sveasoft

[djmurdoch]

See how James Ewing of Sveasoft treats people who follow the GPL!

Posting binaries without source is a violation of the spirit and letter of the GPL. Ewing is right to go after that jerk.

Re:Off topic -- Sveasoft

[dago]

The source has been published and is now on the page, so this problem is solved.

Re:Off topic -- Sveasoft

[djmurdoch]

Who produced the binaries? If they are the original Sveasoft binaries, the guy is still in violation of their copyright. The GPL gives him the right to publish source. It's up to the copyright holder (the one who produced the binaries) to give or withhold permission to distribute them, and pretty clearly Sveasoft didn't give their permission.

Re:Off topic -- Sveasoft

[Anonymous Coward]

Doesn't make Sveasoft any less of a bunch of fucking assholes? Did you read the emails and forums posts made by Sveasoft employees?

Re:Off topic -- Sveasoft

[Anonymous Coward]

Try reading the GPL sometime. Section 3 - "You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form..."

You just need to include the GPL and the offer of source that was attached to the original when you got it.

Re:Off topic -- Sveasoft

[Taladar]

If they published the software under the Terms of the GPL anyone is allowed to distribute the source and the binaries freely. Sveasoft can do nothing about that.

Re:Off topic -- Sveasoft

[djmurdoch]

Try reading the GPL sometime. Section 3 - "You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form..."

You just need to include the GPL and the offer of source that was attached to the original when you got it.

You might be right, but I don't think so. I think the "Program" is the source code, and the "work based on it" is something you produced yourself. That's what section 2 is talking about.

So yes, I'm allowed to recompile the Sveasoft code and distribute it (as long as I accompany it with source), but no, I'm not allowed to distribute their binary without obtaining permission beyond the GPL.

Otherwise, it would seem to say that I have the right to redistribute any program based on GPL code, whether the author has distributed it or not: and the GPL is pretty clear that authors are allowed to make local modifications and keep them to themselves.

Re:Off topic -- Sveasoft

[djmurdoch]

I think you are missing the point of the GPL. It's not a license to guarantee free beer for everyone, it's a license to guarantee free speech. It gives you the obligation to publish source code, and gives others the right to republish it, and to build new things from it.

Re:Off topic -- Sveasoft

[Anonymous Coward]

You might be right, but I don't think so.

Think again, retard. All you have to include is an offer for the source. You can even charge a reasonable amount for the media if you mail it to them. It doesn't even have to be available online, as long as it's available. Your stupid.

Re:Off topic -- Sveasoft

[Pharmboy]

I think folks are misinterpreting the terms of the GPL. Lets break it down: If you are Company A, and you sell a GPL product only to Company B, then Company B distributes it to everyone in the world, Company A is ONLY obligated to provide the source to Company B. You are only obligated to provide the source to anyone your provide binaries to, NOT everyone that wants it.

If you downloaded a copy from Company B, and you want the source, its is the responsibility of Company B, NOT Company A, because B is who distributed it from you.

If I write a GPL program and only upload it to "download.com", then ONLY download.com can force me to release the source. If you download it from there, you can't force ME to give you the source, because I did not distribute it to you, THEY did. You can force download.com to give you the source (comply with the GPL) or quit offering it for download. The GPL covers distribution, protecting your rights to distribute my software, but if you do, its YOUR responsibility to make the source available.

I know this sounds like an overly technical interpretation, but its the correct one. The reason it exists is simple: To protect the author. If I write version 1.0 of a program, you fork it and distribute it, people can't expect me to provide the source for version 2.0. I am only responsible for what I wrote, and only to who I distributed it to. Often this is the entire world, but not always.

Re:Off topic -- Sveasoft

[Anonymous Coward]

I think the "Program" is the source code

Did you miss the "in object code or executable form" part of the sentence you quoted? Section 3 is specifically about copying and distributing these, not source code.

Re:Off topic -- Sveasoft

[Anonymous Coward]

Did you actually read that page?

Ewing is a pirate and a criminal. The only thing that makes him slightly original is how audaciously he parades around under the GPL while he sells the work of the Linux community, trying to violate their license (the GPL) without getting caught... by using highly illegal means (threats, intimidation) as well as highly questionable means (lies, more threats, and spamming on P2P) to create a distribution monopoly.

Take your self-righteous bullshit about the spirit and the letter of the GPL and shove it. You read that page, so you know the score. If you're in bed with criminals, then you are a criminal.

Re:Off topic -- Sveasoft

[tricorn]

If they're required to distribute under GPL (because it includes code they didn't write themselves that was already under the GPL), then either they had to give you the source code to you, or they had to provide you with a written offer to give to any third party the source code at a later date (within three years) at no more than the actual cost of making a copy.

You can redistribute the binary if you either provide the source yourself, provide your own written offer, or provide the info on how to get the source code from the person who gave you the written offer. If you didn't receive a written offer from them because they gave you the source code and you no longer have it, you can't make copies of and distribute the binary. If they didn't give you source code and didn't provide you with a written offer, they are in violation of the GPL.

I don't understand your objection regarding undistributed GPL programs. If it is undistributed, how did you get a copy of it, along with source code or a written offer?

From the GPL, regarding binary distributions:
a. Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

b. Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

c. Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)

Re:Off topic -- Sveasoft

[tricorn]

Actually, only the person(s) who hold copyright on the GPL code you uploaded can force you to release the source code (and, actually, they can't force you to release the source code, though the consequences of not releasing it may be more than you want to deal with). If you're the sole author of the code, no one can force you to do anything with it (although if you didn't want to release the source code, why did you pretend to put it under the GPL?).

Assuming you're not the sole author, you were required to either upload the source, or include a written offer to provide the source to ANY THIRD PARTY; assuming download.com would qualify as non-commercial redistribution, then they redistribute your offer (technically, "the information [they] received as to the offer".

Note that this does not apply if someone modifies the program. In that case, they're responsible for providing the source code (as modified), not you. You're only responsible for providing the source code for the version you released.

Re:Off topic -- Sveasoft

[djmurdoch]

Sorry for the late reply, I've been out of town.

The question is about the rights to distribute a binary. Can I put more restrictions on a binary than I put on the source?

For example, it's generally a bit of work to compile a program in Windows, so most Windows users will download binaries, not source code. But we all know that there is all kinds of malware out there that might infect a binary. So users would like to be sure the binary comes from a trusted source. Can that source charge for the service of compiling, and forbid redistribution of their compiled binaries?

Re:Off topic -- Sveasoft

[tricorn]

Short answer: no. You can not restrict redistribution of the binary, the only restrictions are those the GPL makes, which are the ones regarding distributing source and not adding any additional restrictions.

Re:Off topic -- Sveasoft

[djmurdoch]

That seems like a clear answer, but it begs the question: why not? What is it in the GPL that compels me to allow someone to distribute a binary that I've produced? As far as I can see the GPL only compels me to allow distribution of source code.

Re:Off topic -- Sveasoft

[tricorn]

Section 3 says "you may copy and distribute the program in binary form."

Section 4 says "you can only distribute under the terms of the GPL."

Section 6 says "recipient automatically is licensed under the GPL, and you may not modify the terms."

Taken together, if YOU distribute it, you must do so under the GPL, and the person who receives it has full rights under the GPL, binary-only distribution or not. One of those rights is to redistribute the binary, subject to certain restrictions.

Re:Off topic -- Sveasoft

[djmurdoch]

Yes, on re-reading it I think you're right. I think I was misled by this part of the preamble:

"For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights."

I thought the second sentence (the right to get the source code) was a description of the rights, not just one of several.

The preamble should say next: "You must also make sure that they, too, can distribute anything that you have distributed."

To me, this sounds more like a guarantee of free beer than free speech.

Re:Define 'free'

[gbjbaanb]

Unfortunately, that message was screwed by the GPL licence - if he'd made the LGPL first, it would have been a lot better now.

'do what you want with it' isn't really appropriate under the GPL as you can't issue your work under a different licence. With LGPL you can, and still keep the freedoms of the original source.

Imagine a world where the TCP/IP implementation wasn't issued under a BSD licence ... we'd all be using IPX/SPX :)

M$: FUD, FUD, FUD, FUD!!!

[Anonymous Coward]

M$ lies us!!!

The M$'s contracts are illegal in many countries.

open4free ©

Sounds nasty

[NigelJohnstone]

"If you do redistribute the source code, its fine, but you must add a clause to your licence that says the software may contain IP owned by MS, and that anyone obtaining such derived source must go ask MS for permission to use their bits directly - you can't give that away."

Sounds nasty, an obvious play would be to get this non-standard widely accepted then for MS to refuse permission to new licensee's unless they pay a fee.

That would then lock out free software.

Because you need their permission to get the license, they can tack whetever terms onto the deal they like in order for you to obtain that permission.

Another popular trick of MS's is to claim that a new version of software is a different product. They have done this several times, most famously when they said Windows 98 isn't Windows 95.

So you could find that Sendmail future versions get cut out aswell.

Best to avoid this one.

MS license perspective from a SPF developer

[wayne]

I've been very active in the SPF project for a long time and have been very active in the IETF MARID working group that is standardizing the merged SPF and Caller-ID spect. In particular, I have been a very vocal critic of the MS license have have tried to work both within the IETF working group and outside to make the license compatible with all major mail servers (MTAs) and other packages, such as spam filters.

I have personally met several of the Microsoft employees who are doing the work on Sender-ID. I have ever reason to beleive that they are working in good faith to try and make sure this technology can be deployed by everyone, including GPLed software. The problem is that Microsoft is a huge company and things like the licensing issue are handled by Microsoft lawyers, not the people directly involved in SenderID.

I know that the SenderID MS folks are working with MS lawyers, and the MS lawyers are working with lawyers from the FSF, Open Source Initiative (OSI), and IBM (for postfix). The IETF working group co-chair has given MS until early August to get this problem resolved.

Personally, I'm going to give Microsoft lawyers a little more time before I try to outright kill the SenderID RFC.

Re:MS license perspective from a SPF developer

[Anonymous Coward]

Personally, I'm going to give Microsoft lawyers a little more time before I try to outright kill the SenderID RFC.

Time is running out, I like plan B. Plan B is firewalling based on passive TCP fingerprint, blocking any port 25 connection originating from windows machines. Now we've blocked around 90% of non-legit traffic (SMTP capable worms/zombies running on Windows), something MS themselves have been unable to do.

So much for Gates anti spam rhetoric, Microsoft are the problem. Desktop machines shouldn't be sending mail direct, with my scheme they would all be forced to relay through *nix MTA's. How about it?

PS: I'm not enough listmail from James, I find it very amusing, do you think you and shevek could reg jamescouzens2.org ?

Re:MS license perspective from a SPF developer

[toiletsalmon]

You have to admit though, if the licensing terms are not "drum tight", then Microsoft can just take anyone to court and financially bulldoze their way to a verdict of their choosing.

We've already seen how they "pimped" the US Government, and as far as lawsuits go, that didn't even take that long.

I think that's the thing that scares people.

Re:MS license perspective from a SPF developer

[peeping_Thomist]

I have personally met several of the Microsoft employees who are doing the work on Sender-ID. I have ever reason to beleive that they are working in good faith

Microsoft is a corporation, not a human person. Whether its minions have good faith or not is beside the point.

Re:MS license perspective from a SPF developer

[hammock]

I agree that block ALL port 25 traffic on your mail server from Windows computers is a good thing.

Or even configuring the mail to bounce back with a helpful message such as "Please upgrade to a secure operating system if you wish to send email to this domain."

Re:MS license perspective from a SPF developer

[Anonymous Coward]

You have to admit though, if the licensing terms are not "drum tight", then Microsoft can just take anyone to court and financially bulldoze their way to a verdict of their choosing.

Sort of like Eolas did with Microsoft? Mind you, Mozilla could have been next.

Re:Define 'free'

[bigpat]

"Strange, I thought free meant you didn't have to pay for it. 'Free' does not necessarily mean open source."

Free as in freedom. To be free of cost, doesn't just mean cash. Free to use, free to innovate, free to copy, free to acquire.

Many seem to think that freedom to choose means the choice between budweiser and heinekin, but free is being able to brew your own and share it with your friends or sell it if you choose.

finally

[CAIMLAS]

Finally, now I know what to think about all this.

I was beginning to wonder if I was supposed to think MS had done something right for once... :P

Microsoft's Strategy

[Anonymous Coward]

First they helped the spammers to gain e-mail adresses with the numerous Outlook worms. Then they again helped the spammers to send their messages through open IIS and Exchange relays. Now they are trying to take over a part of the internet by excluding the open source world from the protocol modifications that shall solve the problem they caused in the first place.

Microsoft arrogance

[Anonymous Coward]

'Microsoft's Sender-ID license is directly incompatible with free software regardless of which free software license is used.

And that is why it will fail. Only Microsoft would be arrogant enough to try to tell the whole world to use it's closed source method. I would say Microsoft is still blissfully ignorant.

The truth is, the open source method will win here - even in spite of Microsoft if for nothing else in that most of the world does NOT use Microsoft for mail relay as it is too insecure and unstable. And those that do have lots of staff to nurse the systems.

With any mail solution, it must be open and universal or it will not work.

Re:Define 'free'

[Anonymous Coward]

Strange, I thought free meant you didn't have to pay for it.

No. Now go away and educate yourself.

Re:Define 'free'

[khuber]

That message was not "screwed" by GPL, it was ensured.

One question for all of you...

[gillbates]

Why shouldn't free software be the first to implement secure email? Imagine how much easier Linux advocacy would be if we could say: "SPAM? - I thought that was a Windows problem?..."

Imagine this conversation:

Tech: What's the problem?

User: I get all this SPAM, and I can't read my real email.

Tech: Let me guess, you're still using Windows, right?

User: How'd you know?

Tech: Because you're still getting SPAM. If you upgrade to Linux, which uses the SPAM-blocking mail protocol, your SPAM problem will go away... I'll send you a CD in the mail.

What really irks me is that rather than invent new solutions to existing problems, the free software community waits for a commercial vendor to implement a solution, and then copies it. What we should really be doing at this point is implementing a SPAM-free mail protocol in free software, which, once it became the standard, would force commercial companies into compliance, rather than trying to play a game of dodge-the-patent-lawsuit by copying someone else's improperly done anti-SPAM protocol.

Let's face the facts here, folks: if we wait for Microsoft to implement an anti-SPAM protocol, they'll do it wrong, and the free software world will be stuck trying to ensure compatibility with an interface that is fundamentally broken in the first place.

Re:One question for all of you...

[Scarblac]

Imagine how much easier Linux advocacy would be if we could say: "SPAM? - I thought that was a Windows problem?..."

Of all the reasons for implementing a secure, spam-free alternative to the current version of SMTP, I think "acting smug towards Windows users" must come last.

Sheesh, since when is easy advocacy a goal by itself?

Re:One question for all of you...

[Cid Highwind]

What really irks me is that rather than invent new solutions to existing problems, the free software community waits for a commercial vendor to implement a solution, and then copies it.

In general, you're right. In this specific case, you're totally backwards. SPF (most of what is now sender-id) was published as a free and open standard months before AOL and Yahoo got on board. Microsoft has only been participating for a very short time, compared to how long SPF has been around.

Re:One question for all of you...

[melted]

>> Let's face the facts here, folks: if we wait for Microsoft to
>> implement an anti-SPAM protocol, they'll do it wrong

Why is this a fact? They've been doing a lot of things RIGHT lately if you didn't notice. .NET Framework, WinXP SP2, Win2K3... They just keep cranking it out all the time.

Re:One question for all of you...

[Zebbers]

Are you an idiot?
As if the solution is that simple.

What the fuck is on that magic cd of yours? An email client that connects to special spamproof linux email servers? What about the other million email servers out there. Or is it a beefed up filtering client? Huh?

I'm sorry. The answer is not that easy. There are two choices, clientside or serverside. Clientside masks the problem, serverside is what groups like this are working on and are EXTREMELY difficult to coordinate and do properly. They are trying to change a core service of the internet.

I bet to you its pretty simple though.

AND the community is waiting, thats what this article is all about...there are active groups searching for a solution..... Microsofts monopoly does make it pretty vital that they be a part of it.

Re:One question for all of you...

[Pharmboy]

What really irks me is that rather than invent new solutions to existing problems, the free software community waits for a commercial vendor to implement a solution, and then copies it.

I'm sorry, but you totally miss the point here. First, you have to realize the original source of FOSS, which was Unix, before AT&T started suing people. Code was shared freely, thus the standards that the entire Internet are based on are either Free or PD. Apache isn't exactly a rip off of IIS. Sendmail is a clone of what? Inn, Perl, awk, sed? Most widely used software in the Free movement were designed to provide interoperability, or scratch an itch that a group had.

Yes, many products are like Open Office, designed to provide a Free (as in speech) alternative to commercial products. Most of the tools I use for mail servers, sendmail, spamassassin, clamav, etc. may have proprietary equivelents, but that is far from them being a clone of a proprietary program.

Isn't IE a proprietary implimentation of Mozaic? Doesn't Microsoft's FTP have a copyright notice to BSD inside? (yes, it does). What about MS's telnet client? Are these not proprietary implemintations of Free programs? What about ActiveState's port of Perl to win32? Wasn't MS chat a proprietary implimentation of IRC? I could go on and on.

When it comes to internet technology, the Open source community has contributed more than any close source company CAN, simply because everyone can participate freely. I think its fine that MS participates, the problem is: MS tends to be the last one to come to the party, and yet tends to think the party is in their honor. They use BSD code, but are not willing to contribute back. When it comes to internet standards, we should not have to PAY for using a standard. Use a proprietary product that uses the standard? Fine, charge what you want. But the standard itself MUST be truly free (any Free license) or the community is not going to be willing to participate, which of course, is MS's goal. "We had to set the standard, no one else would".

This kind of licensing is like the boss who says "we are partners" without a contract, and as soon as he starts making money, fires you.

Re:One question for all of you...

[gillbates]

Only about as simple as Linux is to Linus. Let's face it, it's useless to build a new OS kernel from scratch, because everyone already has Windows, right? I mean, every computer comes with a copy of Windows, so why would you bother writing another OS?

Right?

Well, Linus showed that argument to be wrong. Granted, it isn't simple, but some FOSS authors aren't idiots, either. Some of us make our living solving problems far more complicated than MTA's and MTU's.

There are two choices, clientside or serverside.

What was I thinking? - if I can't imagine the solution, it _clearly_ can't be done! ..... Oh, I see: it couldn't be both client and serverside, like MS did with Outlook and Exchange....

I've yet to see something that FOSS couldn't do successfully - provided they had some idea of what the program was supposed to do. Your post points out what is painfully obvious to the outside world about FOSS - the projects suffer not from lack of skill, but insight. If someone else hasn't done it first, they don't think it can be done.

Now, I realize this doesn't apply to all FOSS - don't get offended if you can think of several innovations actually created by FOSS. But, the most visible parts of the system to end users - Open Office, Mono, KDevelop, etc... seem to be little more than copies of existing proprietary software. And the reason why these projects don't innovate is because of people like the parent poster who religiously believe that any untried improvement to the product would be doomed to fail.

Re:One question for all of you...

[Anonymous Coward]

All valid points.

But, 100 years from now, Bill Gates will be remembered as the man who invented the computer. He'll also be remembered as the man who invented the first computer language - BASIC.

Henry Ford didn't invent the automobile. He stole the idea from others, broke patents, was sued, etc... Yet, the world believes that he invented the automobile - not because he actually invented them, but because his efforts made them popular. The same way Bill Gates' Windows on cheap PCs made them popular. Had Steve Jobs underpriced the PCs, he'd be remembered instead.

And, the problem is that FOSS only encourages this view by copying Windows for the parts of the system that are visible to the end user. The end user never sees Apache or the Linux server they're connecting to - they see the web page rendered by IE and think that Microsoft invented the internet (for those who don't know about Al Gore...).

Boycott Caller-ID for E-mail

[Rayban]

The site Boycott Caller-ID for E-mail has been saying this for a very long time. Since the merging of SPF and Caller-ID into Sender-ID it's been getting a bit out-of-date, but the patent issues are still valid.

Re:Define 'free'

[Matt Perry]

Free in this context means free as in freedom, not price. As the GNU people like to say, "Think of free speech, not free beer." You can read more about all that at the FSF web site.

Explanations/hyperlinks?

[D4C5CE]

Now could someone please translate this acronym-laden message for those of us who do not happen to have spent their entire lives following this particular mailing list? (Don't get me wrong, of course it's only natural and quite alright for them to develop their own abbreviations and conventions, and no doubt some will already be familiar with them, but how is a wider audience supposed to understand it, this way, taken out of context and posted here?)

Without a truckload of background information, it is hard to figure out how Doug's reply even relates to the parent message by RMS.

RFC 2821 is about the only thing which is referred to in a way that can be looked up without analyzing approximately half of the list archive... but if the intention is to convince the world that M$'s about to do some dastardly deed, and how it could be averted, this information will need to be presented in a much more enlightening and accessible fashion.

Re:Explanations/hyperlinks?

[wayne]

Now could someone please translate this acronym-laden message for those of us who do not happen to have spent their entire lives following this particular mailing list?

Yes! Someone HAS created such a web page. See: http://www.technoids.org/maridterms.html

hey rick, what do you think of robbIE's PostBlock

[Anonymous Coward]

censorship devise?

it's whoreabully abused, & quite frankly, infactdead, we think.

makes us think the corepirate nazi swastika lowgo fits here?

ask him rick. tell 'em robbIE?

The problem IS the paragraph

[NigelJohnstone]

'Microsoft license does not stop the distribution of source, in fact there's a specific clause allowing it (2.2), you just have to include a paragraph in the source code. Nor does RMS say what his problem is, aside from "Grrr, it's Microsoft". '

The problem *IS* that paragraph, it makes the license extendable, since anyone who wants to use/give away/do anything with, it in future would have to get permission from MS.

"Our provision of this source code does not include any licenses or any other rights to you under any Microsoft intellectual property. If you would like a license from Microsoft you need to contact Microsoft directly"

There is no limit set on that permission, so MS can change the license terms using that paragraph at any time for any future product.

"So, the license RMS is ranting about doesn't apply"
Yes it does (Published 23rd June 2004):

http://www.microsoft.com/mscorp/twc/privacy/spam _s enderid.mspx

"If you are a software developer and are interested in implementing this specification in software, please review the terms of the Caller ID for E-Mail Implementation License before you begin, as the patent license discusses the rights that Microsoft would grant you or your organization."

Re:The problem IS the paragraph

[blowdart]

"So, the license RMS is ranting about doesn't apply"
Yes it does (Published 23rd June 2004):

Clause 1.7 of the license (damned non-cut and paste pdf)

The "Caller ID for E-mail Specification" means the specification having submission ID "draft-atkinson-callerid-00.txt" and entitled "Caller ID for E-Mail," published by Microsoft Corporation on May 19 2004 and located at the following link: http://www.ietf.org/internet-drafts/draft-atkinson -callerid-00.txt.

From (an admittedly quick) reading the draft it is not the merged SPF protocol, it's the original XML based protocol. The merged draft is "draft-ietf-marid-core-01.txt". The license referred to does NOT apply.

Re:RMS craziness

[Anonymous Coward]

He wrote emacs. That's proof enough that he's crazy without making stuff up.

Re:Define 'free'

[gaijin99]

All the GPL does is ensure thaat you can't steal someone's GPLed work. People put their work under the GPL not out of alturism, but in the expectation that they will get source code in return. Having source available to experiment with, learn from, etc is essential to hacking. You don't like that, you can go pay for access with someone who wants money in exchange for source. It isn't complex: GPL = source for source, propriatary = money for source, BSD = no payment for source. The problem with the BSD license is that it means that only other really alturistic people will release their source, the GPL ensures a supply of new source.

You're also deliberately misunderstanding the difference between a standard and an implementaiton of that standard. The TCP/IP protocol is completely open, and anyone can write any sort of implementation they want to. Which is kind of the point of this whole thread. MS's proposed "standard" isn't necessarially open, they've got patents on many of the critical aspects. Today they say "oh, don't worry about those patents, they're just a formality, we'll never charge a license fee for that. And we'll certainly never outright deny licensing to our competitors, never!", tomorrow what keeps them from demanding fees for using their patented ideas? Bugger that. The underlying protocols *must* be completely open and completely free of patents or else we run into massive incompatibility problems, fragmented internet, etc. Your mention of the GPL is simply to allow you to take a cheap swipe at RMS, a fetish I'll admit I don't see the attraction of.

Seriously, do you *want* to see us go back to the bad old days of multiple, incompatible, network communication? Because that's what MS is leading us to.

mod parent down

[Anonymous Coward]

he's been cross-posting this shit all day...

Re:mod parent down

[Anonymous Coward]

Thanks for the advice, Mr.Ewing.

Re:Define 'free'

[KarmaMB84]

They *should* have called it "Freedom Software" rather than hijacking the word free and beating everyone over the head with insane "free as in..." rants when people are rightly confused.

Nothing to see here?

[pandrijeczko]

Correct me if I'm wrong but Microsoft is hardly the majority player when it comes to sending email across the Internet.

Sure, it's big with Exchange in corporate enterprises and in the client arena with Outlook & Outlook express.

But sendmail running on some UNIX-type server provides the majority of backbone email routing, especially at ISP level, and DNS is invariably done with BIND on other UNIX boxes. This does not strike me as an area that MS have much capability of muscling in on with a proprietary protocol.

Or am I missing something here?

Re:Nothing to see here?

[BCW2]

M$ is always trying to change that. Everywhere they don't dominate, they buy the one that does, or start a new standard compatable with no one else, put it un Winblows and tell the rest of the world: you will follow this standard if you want to deal with Winblows users. They shove it down everyones throat.

Standard operating proceedure from Redmond. If they can't dominate something, change the rules.

Re:Nothing to see here?

[Anonymous Coward]

> Or am I missing something here?

Publishing a few TXT records is nothing, they only achieve meaning when interpreted by the SenderID parser at the receiving side, where Exchange penetration is far greater.

Yes, ISP's tend to run mail on unix (not just sendmail, iPlanet is quite popular too), but they're outnumbered by the enterprises that run Exchange on their MTA's (which actually seems to work ok, Exchange is finally pretty stable, as long as you're VERY careful about how you configure it AND the server it runs on).

The IETF's position on the MS license issue

[Anonymous Coward]

There was a big discussion on the IETF MARID mailing list about the problems with the license. Finally, the IETF posted this: IETF 's says we shouldn't worry about the license

From: Ted Hardie
Subject: Regarding the recent licensing thread
To: ietf-mxcomp@imc.org
Date: Mon, 19 Jul 2004 11:27:41 -0700

Some points on the recent licensing postings:

1) This discussion has been unprofessional in the extreme. Contributors to this working group have been accused of failing in a duty they did perform, and that is rude and unproductive. The Microsoft IPR filing related to callerid was posted with their first ID, which is exactly what is required. Those who have been waiting for such a statement either don't understand the process or have not been paying attention, and their acting offended about things now carries no weight. A refresh with the new name and some details on coverage is warranted for clarity before the documents go to the RFC editor, but that is a paper trail issue, not substantive.

2) The IETF is an engineering body, and it makes engineering decisions. It cares about licensing only as it affects the ability to implement and deploy a standard. Religious opinions on the sanctity of specific license texts belong elsewhere. The sudden appearance of this as a separate topic without reference to the engineering choices misses the point of how the IETF makes these calls: in the context of the engineering decisions. Comments based solely on the licensing terms without regard to the engineering choices they affect *do not speak to the question working groups need to decide*. The sudden appearance of new working group participants after postings inviting them to comment is welcome *if they contribute to the engineering discussion*. But if you are here to comment on licensing outside of the engineering context, you are wasting your electrons.

3) The IETF has published standards with defensive patents many times, and the use of a reciprocal/royalty free license is a common way for contributors to protect themselves from later claims while still encouraging the creation of an interoperable, open standard. Trying to persuade the working group that something is outside the norm when the IETF IPR page is full of contrary examples insults the intelligence of the group, as well as insulting the contributors who are providing a royalty free license.

4) Armchair lawyers often assume things about patents and licensing which aren't true. Get a real lawyer to read things you're concerned about and have them talk to the contributor's lawyers about things that concern you. The creation of a licensed "libipr" called by other applications may be all it takes to have licenses with severe restrictions co-exist with royalty free/reciprocal licenses; this isn't something you can assume one way or the other. You really have to have professionals check. And when you find things that concern you, be aware that this license isn't responsible for ways you may already have bound yourself; if you signed an agreement with HP Lovecraft that said "I will only acknowledge Chthulhu in my code", don't blame Microsoft for requiring an IPR notice. Take it up with the Elder Gods.

5) Generic rants about patents belong on your national I-hate-the-patent-office list. Rants about the IETF's standing decision *against* requiring a specific license or class of licenses belong on the IPR list, but are very likely to be redundant to arguments already made. Read the archives.

New drafts are now out, waiting for careful review. I urge the working group to review them carefully and to focus on how they can be interpreted, coded, and deployed. We have a lot of work to do.

Ted Hardie

Re:Define 'free'

[Anonymous Coward]

lgpl is for libraries you include, but don't modify. it is not entirely clear from your post that you understand that.

It's the MTA, not the MUA

[frankie]

The OS on the end-user PC is irrelevant. Any serious spam-BLOCKING proposal (as opposed to spam-FILTERING) takes action long before the mail hits your inbox, much less gets displayed.

So you ask, why not run spam blocking on all open source MTAs? Simple: it takes two to tango. Email is a communication medium, emphasis on that prefix "co-". Your new Final Ultimate Solution to the Spam Problem is useless if the other guy's server doesn't support your protocol. And I suspect most of us are unwilling to cut off all email with half of our friends/family/business just because their mail admin isn't as smart as yours. Anyone with that philosophy is already using SPEWS.

Re:It's the MTA, not the MUA

[gillbates]

Granted, it does need to run on the server. But why not simply add to the existing infrastructure?

The web has mostly replaced ftp by now. Yes, it's still available, but far more people like to browse the web than ftp'ing files and viewing them later.

It's the same principle. There's email, and then there's securemail. Write the protocols, the clients, and the servers, and let it take off like P2P did. There's no need to completely replace email at first, but after a while, it would go the way of the BBS - yes, they're still around, but no longer the dominant means of communication.

Re:RMS craziness

[PrvtBurrito]

I know you are trolling but I find it ironic that the GPL spends a lot of time limiting freedoms (ie viral licensing, giving up copyright, etc), rather than providing them. Everytime I hear RMS speak he talks of "freedom," probably as much as GWB does.

Standard / IPR link

[Anonymous Coward]

The IPR disclosure as sent to the IETF Caller/Sender ID IPR.

That will eventually lead you to Microsoft's page on Sender ID. The actual licence agreement is halfway down the page (they refer to it as caller id and sender id interchangeably it seems).

If you do read the licence agreement you'll see that not only does an MTA developer have to sign/return it but so does an end-user _if_ and _only_ _if_ they want the source to their MTA.

That is, just about everyone. Additionally the language in the license explicitly makes it impossible to use with LGPL/GPL'd MTAs.

Re:Define 'free'

[Anonymous Coward]

The two go hand in hand, as you can't make money with "freedom" software, so invariably you have to give it away for "costs nothing".

OSS is fine, but you have to come to the realization that 99/100 companies will not be able to make money off of the software, and the other company barely makes enough to get by on.

MOD PARENT UP, please

[Anonymous Coward]

enough said

Re:RMS craziness

[Narchie Troll]

Giving up copyright? You mean the option to give up copyright to the FSF? It's an option, asshole. You're perfectly free not to take it. Hundreds of people don't.

The GPL is more free than a standard copyright situation, which doesn't allow copying at all. Stop the bullshit.

Where forged sender spam comes from

[Skapare]

I think we need to take a look at where forged sender spam comes from before we are willing to consider trying to detect forgery as a means to detect a message as being spam. In the past, small time spammers did forgery to avoid flooding their one mailbox. Now days, bigger spammers have domain names (often thousands of them) and don't have to worry about that issue. But there are still spammers doing forgery. Most of these using the infected zombie machines on insecure home computers often connected 24x7 via "always on" DSL or Cable.

If the providers hosting these users would:

• block outbound port 25 from these users (with certain exceptions)
• require SMTP AUTH to log in to their provided mail server
• rate limit mail sent through that mail server (for example no more than 30 messages per hour)

then this would go a long way to defeat the utilization of these infected machines as a spamming tool.

I mentioned an exception to the port 25 blocking. They should simply allow port 25 for anyone who mentions certain keywords indicating they need it. While there is some spamming that originates at the DSL or Cable user, that doesn't account for much right now. So sure, someone intent on spamming can call in to customer support and ask "please enable SMTP for my access account". But they would be fewer in number than those who ask the same because they just want to run their own home mail server without having to forward through the ISP's mail server. And one simple way to do this is to ship DSL/Cable modems with SMTP access disabled except for the provider mail servers. And manufacturers could do that if providers would set up private IP addresses to access their mail servers (so by default SMTP would be allowed to 10.0.0.0/8, 172.16.0.0/12, 169.254.0.0/16 and 192.168.0.0/16). Someone who wanted to run their own mail server could simple change the settings. The average user who lets machines become infected would know nothing about it.

Like anything else, this isn't a solution to spam. But it is a viable alternative to forgery detection in terms of catching most of the spam from most of the sources being used by the spammers that do use sender address forgery.

Re:Where forged sender spam comes from

[julesh]

If the providers hosting these users would:

* block outbound port 25 from these users (with certain exceptions)

This is unacceptable. I pay for an internet connection, I expect to get one. Having arbitrary ports blocked because they might be used for a purpose you don't like is unacceptable; what will be next, blocking ports used by P2P networks?

* require SMTP AUTH to log in to their provided mail server

Doesn't help; the username and password would be stored in the user's MTA settings and could be easily retrieved.

* rate limit mail sent through that mail server (for example no more than 30 messages per hour)

Sorry, I sometimes need to send batches of 1-2 thousand e-mails as part of an informational mailing list I run. This is an entirely legitimate use of e-mail that should not be prevented unnecessarily.

then this would go a long way to defeat the utilization of these infected machines as a spamming tool.

It would also go a long way towards losing customers for the first ISPs that did it, which is why it won't happen.

Re:Where forged sender spam comes from

[Skapare]

Maybe you need to read my post again. There is an exemption for people like you (and me). If you know what it means to have total access on all ports, then you should have it (unless you abuse it). It's just the average user (who outnumber us over 10000 to 1) who shouldn't have it because they don't need it and they don't know how to prevent its abuse. Allowing millions of zombies to be online just because you can't be bothered to simply give some evidence that you know what you are doing when signing up for your access account just isn't acceptable. In such cases people like me will block that entire provider's customer IP space ... which I do know for hundreds of such providers. So as it stands now, you don't really have total access because of such blocking. But if your ISP would do as I suggest ... followed by you specifically asking for the services you need to have (by their name to show you at least know what it is), then you would get more access.

Think of it this way: I have no way to distinguish the 0.01% of cable and DSL customers that do know what they are doing (such as you). But the cable/telco company does by the plan I suggested. For you, things will work better with the plan.

SMTP AUTH is not to prevent a spammer from submitting email. It's there to quickly and readily identify who has let the spammer submit email. It's also there for stateful rate limiting so the rate is applied per customer, not per IP address.

If you enable SMTP outbound access, you won't be affected by the rate limit on the provider's mail server since you won't be using it.

Right now many ISPs like comcast and charter are losing access because they are being massively blocked. I even had to go so far as to block charter's own mail servers due to the abuses that they would do absolutely nothing about. Are you going to use an ISP like that?

Re:RMS craziness

[Anonymous Coward]

oh shut the fuck up man.
The GPL limits freedoms to ensure that those freedoms arn't all taken away later down the road. If you can't understand that, cut your balls off because you're a descrace to the human race and we don't want any more of you.

GWB might be bad, but man is Kerry a douchebag.

Re:RMS craziness

[Aim Here]

"ie viral licensing, giving up copyright"

If you don't like being infected with the GPL, you're perfectly free to reinvent the wheel and rewrite whatever GPLed code you were thinking of using. Or contact the author and cut a deal.

You'd have to do either of those anyway if you wanted to use [insert proprietary licensed code here] for any reason at all.

And mowhere does the GPL force anyone to give up any copyright at all, period.

The FSF does want you to assign your copyrights to them if you want your code included in a GNU project, but that's a different matter.

Insightful? More like f*cking insane!

[Anonymous Coward]

"...If you upgrade to Linux, which uses the SPAM-blocking mail protocol, your SPAM problem will go away... I'll send you a CD in the mail..."

And BTW, you can't run any of the apps you used to run (beacause we're talking about a clueless M$ W1nd0w$ running n3wb13, here, right? No clue about Wine or somesuch...).

The response would be: "Fuck That! I'll tolerate the spam. I need Photoshop or whatever - I'm pulling in $300/day using that package and you're taking it away from me!"

Re:Define 'free'

[iamacat]

People put their work under the GPL not out of alturism, but in the expectation that they will get source code in return.

Personally, I release stuff under GPL because I already wrote it, don't plan to sell it and want it to be of maximum use to other people. So far, nobody sent me any code.

The TCP/IP protocol is completely open, and anyone can write any sort of implementation they want to.

Let's say, there is Novell's implementation of IPX and GPL implementation of TCP/IP. I am in charge of Windows development and want to have a working network stack ASAP. If I want to use IPX, I can pay Novell $N for source license and use the code without any restrictions that I worry about. If I go with GPL, I have to release my source code and find a new business model, since I will no longer be able to sell binary copies of my stuff without a serious support contract.

Only takes a second to decide, and if it happened like that, today Linux would only talk to most of Internet through Samba-like hacks of closed source protocols, RMS wouldn't use Internet, and slashdot would be exhaulting the virtues of TCP/IP.

Standards should be free and have public domain reference implementations, period. Keep both Microsoft and RMS out of it!

Burying his head in the sand

[NigelJohnstone]

"1) This discussion has been unprofessional in the extreme. "

Get a thicker skin.

"2) The IETF is an engineering body, and it makes engineering decisions. It cares about licensing only as it affects the ability to implement and deploy a standard. "

The wording requires you get a license from Microsoft and that any future products require a license too. So clearly this problem comes under the "ability to implement" part of the sentence.

3) There is no such thing as a 'defensive' patent. Ted cannot see into the mind of Microsoft and determine their intent is to only use it for defence. Therefore he cannot make this statement with any substance behind it.

4) Non substantial argument. The license is very clear, show me a lawyer that says otherwise.

5) Agreed.

"New drafts are now out, waiting for careful review. I urge the working group to review them carefully and to focus on how they can be interpreted, coded, and deployed. We have a lot of work to do. "

Oh boy, we have a spec that has issues XYZ,
he's telling them to look at X and only X. i.e. to ignore Y & Z and make a decision based on only part of the information.

Re:Burying his head in the sand

[Anonymous Coward]

"1) This discussion has been unprofessional in the extreme. "

Get a thicker skin.

Ted made his point. Looks like you made his point too.

IP rights apply unless waived

[NigelJohnstone]

IP rights are retained by default unless waived licensed or assigned.

So show me where Microsoft waives their rights to allow anyone to use Microsoft's part of the merged spec!

Re:RMS craziness

[The Bod]

If you don't like being infected with the GPL, you're perfectly free to reinvent the wheel and rewrite whatever GPLed code you were thinking of using. Or contact the author and cut a deal.

If GPLed code were truely "free", this wouldn't be necessary.

Re:Define 'free'

[Anonymous Coward]

It is if you are a hot chick.

Why bother asking RMS?

[Guspaz]

He's such a zealot that he's going to trash anything that's not completely open and free, even if it has the potential to improve a serious situation.

Re:Why bother asking RMS?

[dmaxwell]

You're being a zealot yourself. If this standard goes through unchanged, we'll all be paying royalties to MS if we want to use email. The mere mention of the initials RMS is all it takes to shut down all cognitive functions of most readers here. RMS' point is damned valid and wouldn't be very controversial if it came from anybody other than him.

There is no problem serious enough that the solution merits MS or any other company being allowed to hijack open infrastructures.

Re:Why bother asking RMS?

[Guspaz]

Well, perhaps I am an anti-RMS zealot.

Anyhow, you've missed the point of my post. The issue he was being asked about is irrelevant. My point is that no matter what you ask him, his reply is one hundred percent predictable. If you ask him "What do you think of Skype releasing a Linux binary?" his reply would invariably be along the lines of "It should be avoided at all costs because it's a closed-source product."

Free software is great, I use it whenever I can. But there are certain situations where closed source is neccessary for a variety of reasons. RMS doesn't seem to understand that. He simply preaches that everything should be a hundred percent free no matter what.

Re:Why bother asking RMS?

[dmaxwell]

Free software is great, I use it whenever I can. But there are certain situations where closed source is neccessary for a variety of reasons. RMS doesn't seem to understand that. He simply preaches that everything should be a hundred percent free no matter what.

Perhaps so. A commodity standard is not one of those situations. Even SPAM is preferable to the world MS wants for us.

I've said more than once that the FSF would do well to use someone else as their public face. RMS could accomplish a lot more if he took to heart something like "How to Win Friends and Influence People."

Re:Why bother asking RMS?

[Anonymous Coward]

Skype in addition to being closed-source uses a proprietary protocol. You can't make compatible software without reverse-engineering it, and even then there's nothing preventing Skype from mutating the protocol to throw off competition. That has been happening in the IM arena for years.

Just because he's a zealot doesn't make him any less right.

Re:RMS craziness

[Aim Here]

Well yes, the GPL does deprive us of that most vital and precious of our freedoms - the freedom to use other people's hard work in order to make unfree software that deprives those foolish enough to use it of their freedom.

It was a dark day for freedom indeed when RMS invented the GPL.

Re:RMS craziness

[Anonymous Coward]

If society were truely free then nobody would object if I were to kidnap you and torture you to death with cocktail sticks and peanut butter. I think once you realize that freedom of speech does not excuse threats or liable and that free software means that everybody should lose the right to withhold modifications, much like I lose the right to murder you just as others lose the right to murder me, that then we will talk about freedom.

I'd give them one day.

[khasim]

I'm sure the Microsoft lawyers have ALREADY evaluated the various Open Source licenses so it shouldn't take them long to just pick one.

The coders that are working on this at Microsoft are NOT the ones that will be choosing the license.

The LAWYERS working for Microsoft will be working on an approach that is BEST FOR MICROSOFT. (read that as "control").

It all comes down to a matter of priorities.

Microsoft's FIRST priority is to establish control.

Microsoft's SECOND priority is to stop spam.

If Microsoft was more worried about stopping spam then establishing control, you would not see the lawyers taking this much time to meet with everyone. They know what licenses would be the easiest to have accepted.

Here's a url with a list of them.

http://www.gnu.org/philosophy/license-list.html

Microsoft's lawyers can quickly pick one and that discussion would be over.

Re:I'd give them one day.

[Anonymous Coward]

According to Ballmer and Gates, security and spam are high priority, developers seems to be no 3 ;-) If I were a shareholder, I'd be pissed at them stalling on this, they are already losing sales because of poor security. SPF would stop worm propegation and increase returns on my hypothetical stock by reducing security fears, seemingly the legal department is not acting in the best interests of the company.

Which is it? 24 hours or 1 week.

[Anonymous Coward]

"We asked Harry and Jim to take up the licensing issue with their lawyers about a WEEK AGO. "

Your RFC is dated 20th July 2004. 5 days ago.

Later on you say this:

"Now less than 24 hours after Microsoft go off to talk with their lawyers "

Which is it a week or 24 hours? It looks like you put out the RFC, people complained about the licensing issue, and now you're in ass covering mode.

Yet this problem was known about for a long time:

Here's "Eben Moglen -- professor of law at Columbia Law School and General Counsel for the Free Software Foundation " complaining about the patent and license problems with Caller ID from late FEBRUARY.

http://www.newsforge.com/software/04/02/26/14482 53 .shtml

Incompatible with Open Source in general

[smiff]

2. Annoying advertising clause that says if you want to rebrand the code you must get permission from Microsoft. In other words, you can't fork the code under a different name. (section 2.2)

So it's more BSD-like then, big deal.

The BSD abandoned that clause for a reason. But Microsoft's license actually goes much further. If you distribute source code under a BSD license, the recipient still has no rights to use the software unless they contact Microsoft and get permission specifically. The license requires you to put this notice on any source code that implements SPF:

"This source code may incorporate intellectual property owned by Microsoft Corporation. Our provision of this source code does not include any licenses or any other right to you under any Microsoft intellectual property. If you would like a license from Microsoft (e.g. rebrand, redistribute), you need to contact Microsoft directly."

Which directly contradicts the very definition of Open Source. In other words, Microsoft's license is incompatible with all open source licenses!

Why is that different to the GPL? They're both licences that apply to the use of software. Without a license, you can't legally use any non-public domain software. The GPL is one such license, this is another.

You need a license to use patented technology. You do not need a license to use copyrighted software. Copyright only gives the author a monopoly on:

1. the right of reproduction (i.e., copying),
2. the right to create derivative works,
3. the right to distribution,
4. the right to performance,
5. the right to display, and
6. the digital transmission performance right.

Note that the right to use is not in there. The GPL specifically allows you to decline the license. You may still go ahead and use the software even after declining the license. The GPL simply grants you the six rights listed above (with certain conditions).

Microsoft's license, however, grants a revocable right to use their patents. You could distribute SPF software under a BSD license, and Microsoft could revoke anyone's right to use the patent at any time (even if you already have the software, use it, and depend on it).

Big deal. Why does everything have to be GPL compatible? What would be wrong with, say, a BSD-style license for this particular application?

Even though you could distribute SPF software under a BSD license, you could not redistribute the software without explicit permission from Microsoft. That pretty much excludes the open source, bazaar style of development.

Make no mistake about it. Microsoft wants to shut down open source software. What better way than to prohibit open source software from doing that which people most use computers for, to send and receive email?

Re:Define 'free'

[WindBourne]

The two go hand in hand, as you can't make money with "freedom" software, so invariably you have to give it away for "costs nothing".

Patently false. Redhat, Suse, etc. are making Money. Likewise, so have the BSD distros in the past. In fact, they would still be making loads of money except for ATT's legal attack on them (while it had more legal footing than does SCO/MS/Sun's against Linux).

OSS is fine, but you have to come to the realization that 99/100 companies will not be able to make money off of the software, and the other company barely makes enough to get by on.

I always find it funny that so many would make statements like this, while ignoring the history of Operating systems, and the internet. Loads of money to be made here, once the US government quits trying to push MS.

I cannot agree with that.

[khasim]

Re-read #2, #3 and #4.

IETF does not concern itself with patents/licenses and has published standards that include patents and you don't know what patents are, anyway.

Bugger off. The patents and the licensing are VERY IMPORTANT to the implementation of the standard. Otherwise, you're writing a standard that won't be implemented. Why do that?

"Comments based solely on the licensing terms without regard to the engineering choices they affect *do not speak to the question working groups need to decide*."

Yes they do. Again, what good is a standard that no one will implement?

Re:Define 'free'

[SillyNickName4me]

Following your logic, noone would be interested in buyign the works of old writers or something like the bible..

Of course you cannot make money by trying to sell the exact same thign that peopel can get for free next door, so you'll have to do something to make peopel willing to buy, being it a nice leather binding and quality of print for a book and things like included hardcopy documentation and support for software.

So.. if your business model is to sell junk to people and never look at them again then Free software won't work for you..

Re:Define 'free'

[SillyNickName4me]

> Personally, I release stuff under GPL because I already wrote it, don't plan to sell it and want it to be of maximum use to other people.

THen use a BSD/X11 style license. the GPL specifically adds a bit of protection to those, takign away one specific (and by many people undesired) use, that of including your code in a program that is not licensed under the GPL.

This might be a desirable effect for many, and it is definitely one of the arguments for using the GPL instead of another license in many cases (not all, TCP/IP is a good example of why BSD/X11 style licenses work very well)

> So far, nobody sent me any code.

Why should they? the GPL does not require that unless people happen to be sending you modified versions of the binaries also.

If you want peopel to send their patches to you, go for something similar to the Apple Public License.

It is a bit of a problem that many people use the GPL ebcause they are told it is 'good' while not havign a clue as to why it is good and what the consequences are.

OT: Re:Define 'free'

[SillyNickName4me]

> The kind of freedom RMS is referring to can't be taken away or used to discriminate between users

What I find interestign about this is that as soon as we talk about 'non discrimination' related laws in EUrope, that is called 'lack of freedom' by many from the USA.. as soon as it comes to GPL freedom, enforcing anti discriminative rules is 'protecting freedom'.

I know, off topic, but I just found it an interesting observation.

I assume we'll do the usual then

[Rogerborg]

Let someone else innovate, steal the idea, clone it and compete against them without rewarding them for their work.

Name me five open source products that aren't simply a clone of a commercial products.

Re:I assume we'll do the usual then

[e_AltF4]

> Name me five open source products that aren't simply
> a clone of a commercial products.

Pick any five you like

In software business it's all about implementing the 10 or 20 things users want to do with their computers, so i don't expect very much "really new" software, be it OS or CS, since VisiCalc and Mosaic :-)

Re:Define 'free'

[Anonymous Coward]

KarmaMB84 since you probably live in Communist China I can understand how the word FREE would confuse you!

Rebellious

[starling]

Marid is an Arabic name meaning "rebellious". I'm just wondering if this was intentional or a coincidence.

The key was the XML

[statusbar]

When I learned that the Microsoft additions were being added, and that they were going to use XML, I immediately thought 'hah! bloat! typical microsoft! This data does not require or need or benefit from using XML.'

But, I was wrong. Adding XML allows them to patent it. That is the ONLY reason why they are using XML.

--jeff++

No need for MTA authentication,

[anti-NAT]

if the emails themselves were authenticated.

If the emails themselves are authenticated, the MTAs just become a delivery mechanism (which is actually what they really are today anyway). Which MTA delivers the authenticated email doesn't matter, and therefore MTA authentication doesn't matter.

Authenticating emails would ensure you absolutely known the sender. A spammer wouldn't be anonymous anymore. Once they aren't anonymous anymore, anti-SPAM laws would be very effective at reducing or preventing spam.

Deploying an authentication system with 100% coverage of the Internet population is the problem with this anti-spam solution.

it's your problem, not his

[dekeji]

This type of scheming is both unprofessional and damaging.

I don't see any "scheming". RMS is warning about what seems to be the legal situation right now. Instead of pointing us to facts that contradict his view, you are just giving us a lot of verbiage, flaming, and accusations, and you are telling us that we should trust you and that everything is going to be right in the end.

This is the machinations of a faction who want to use MARID for conducting a vendetta against Microsoft and don't care what the effect on MARID is.

Your use of the term "vendetta" implies that you are saying that RMS's behavior is motivated by a personal grudge and a desire for revenge against Microsoft. But there is no indication that RMS has any such personal motivations--his position is consistent with the criteria he has previously applied to evaluating other standards. If anything is "unprofessional" here, it's your accusations against him.

Your standard has run into negative publicity because of the way the standards body communicated the legal situation, and that's your problem, not his. As soon as you provide convincing evidence that the legal situation surrounding MARID is bulletproof, then RMS will stop complaining about it.

very unlike

[midgley]

The arguments over whether security can only come from obscurity are old, and need not be rehashed.

And this is very unlike the GPL.

RMS does seem to understand the GPL...

Temporal inversion

[midgley]

"What really irks me is that rather than invent new solutions to existing problems, the free software community waits for a commercial vendor to implement a solution, and then copies it. "

Relax. It didn't happen.

SPF came from the OSS community and is in use.

Its proposed merged form came later.

You won't.

[JThundley]

You won't read your emails, or you won't be a *nix or Mac user, period.

has he weighed in

[Anonymous Coward]

on showering

Something RMS never weighed in on...

[Anonymous Coward]

RMS never weighed in on SOAP.

really?

[twitter]

Microsoft's SECOND priority is to stop spam.

Their priority is to pave the way for "legitimate" unsolicited commercial email and control of the that definition. They have argued at length that their spam is legitimate but others are not. That would be part of the exclusion that RMS is talking about and it's ultimate goal, control and the fees you can collect with that control.

I would not attribute good faith to a company that has so often demonstrated such bad faith.

Re:RMS craziness

[nagora]

It was a dark day for freedom indeed when RMS invented the GPL

This is /. - you're not allowed to use sarcasm.

TWW

Spam Filter vs. Sender-ID/SPF

[Anonymous Coward]

I honestly think a well tuned spam filter e.g. spamassasin does the job very well without all the inherent problems sender ID/SPF brings along. I just can't see the need for that. Anyone else who thinks the same way?

RISKS

[Anonymous Coward]

Read what the RISKS Digest has to say about SPF:

http://catless.ncl.ac.uk/Risks/23.21.html#subj7.1

http://catless.ncl.ac.uk/Risks/23.21.html#subj8.1

http://catless.ncl.ac.uk/Risks/23.21.html#subj9.1

http://catless.ncl.ac.uk/Risks/23.23.html#subj8.1

http://catless.ncl.ac.uk/Risks/23.23.html#subj9.1

Re:Define 'free'

[flacco]

They *should* have called it "Freedom Software" rather than hijacking the word free and beating everyone over the head with insane "free as in..." rants when people are rightly confused.

why? i wouldn't have the slightest idea what the awkwardly-named "freedom software" would be. is it a microsoft application for managing my freedom? is it "french software" before the french became official douchebags?

seems more sensible to me to pick the exact word you need to describe it, even if it has another meaning in different contexts.

Re:Define 'free'

[Nick_dm]

>Let's say, there is Novell's implementation of IPX and GPL implementation of TCP/IP ... If I go with GPL, I have to release my source code and find a new business model, since I will no longer be able to sell binary copies of my stuff without a serious support contract.

While I agree with your point that having a public domain reference implementation is a good idea, this case would not force people to GPL their code. They could look at the GPL version and work out the workings of TCP/IP from that and then get someone else to code a different version independantly of the GPLed implementation. It forces you do do some work yourself but you can still keep your code closed and use the standard for free (subject to it not being patented!).

stallman worth more than corepirate nazIE rag?

[Anonymous Coward]

as a matter of fact, just what he's forgotten, is likely more relevant to communications/commerce, than everybodIE in the kingdumb of payper liesense/stock markup FraUD softwar gangster felon execrable, .combined?

so, whois ready for the gnu millennium?

never mind robbIE's fauxking PostBlock censorship devise, it's still under development?

Re:Define 'free'

[maunleon]

Whenever someone like RMS tries to redefine a word which is so ingrained in popular culture to mean "free as in you don't have to pay for it", he's asking for trouble.

It's arrogance for him to think that his definition of "free" is known enough to convey the message without an explanation.

To 99% of the people out there, free means "I don't have to pay for it". Those 99% of people could care less about the source code. They want the software free.

If a company is willing to offer software free but is not willing to release source code, most people would be happy. The only ones objecting would be those who want to tell those 99% what is good for them.

What's next, Open Source Pride Parade down main? "We're here, we're freer than beer, get used to it"?

SPF is Harmful to the Internet

[konmaskisin]

As many thoughtful people seem to know.

The "war on spam" doesn't mean that destroying the current structure of internet mail is justified.

http://homepages.tesco.net/~J.deBoynePollard/FGA /s mtp-spf-is-harmful.html#ISPLockIn

IM2000 is the way.

Clarification, the gpl is NOT a license to use!

[shaitand]

Copyright law granted the holder control over distribution and some forms of copying. It does NOT grant any control over how the material is used beyond copying and distributing!

The gpl works entirely within copyright law, you don't have to agree to it to use the software because you don't need someone to GIVE you RIGHTS YOU ALREADY HAVE. The only reason you EVER don't have the right to use a copyrighted work is if you obtained it illegally.

This is why most copyrighted works aren't licensed at all, books, cd's, etc.

Re:Define 'free'

[marsu_k]

And outside the US it'd be "French Software", right?

Re:Define 'free'

[Anonymous Coward]

They *should* have called it "Freedom Software"

Only if they wanted people to think that they had no inkling of correct grammar. "Freedom software" is a lousy phrase. The fact that you can't handle the existence of homographs in the English language is not a problem for the FSF.

Re:Define 'free'

[Calroth]

The fact that you can't handle the existence of homographs in the English language is not a problem for the FSF.

Many people can't handle homographs in the English language. OK, not the FSF's problem. It's not their problem either that few people subscribe to their philosophies.

Look on the bright side...

[Rob Menke]

If Microsoft were the only company to implement this protocol, it would be more effective than they ever dreamed:

• If an e-mail uses the copyrighted protocol, then it must be coming through a Microsoft mail server because nobody else may implement it.
• If it is coming through a Microsoft server, than it is more than likely to be coming from a Microsoft client.
• If it is coming from a Microsoft client, than that client is more likely than not to have been compromised and is acting as a spam zombie.

Microsoft should be congratulated, not censured, for coming up with such a scheme to help edge detection of spam.

Re:Define 'free'

[Anonymous Coward]

Well, since free-as-in-beer has never existed in the real world, there should be no confusion.

So, when RMS uses free software as an excuse to preach responsible behavior, I'm not going go complain.

Free-as-in-beer is a lie, or, at best, sleight of hand. People need to be reminded.

Re:Define 'free'

[ThaReetLad]

Most hot chicks I know don't drink beer, so what is the point of free beer to a hot chick?

Re:Define 'free'

[Anonymous Coward]

You might want to tell the dictionary people to stop redefining free also.

http://dictionary.reference.com/search?q=free

1. Not imprisoned or enslaved; being at liberty.