OSI And Microsoft Negotiating Over Sender ID

ValourX writes "Microsoft's Sender ID has already been rejected by both the Debian Project and the Apache Software Foundation, but Joe Barr of NewsForge today interviewed Larry Rosen of the Open Source Initiative and discovered that there are negotiations between the two entities with regard to Sender ID's licensing. Could Microsoft be considering an Open Source license for Sender ID? Slashdot has covered other aspects of this story in the past. NewsForge is part of OSTG, like Slashdot."

Comments

Re:Bah

[echeslack]

I don't think MS has a chance of getting a stranglehold on this. I mean, in terms of email, they really need the cooperation of pretty much everyone for it to work anyway. There are far too many non-Microsoft free software mail servers run by large and small companies. Granted, Microsoft has a huge presence on the desktop, but they aren't dominant enough yet on servers to make it really work in their favor.

Maybe they are honestly trying to solve the spam problem and are willing to compromise for the good of users.

Re:MS Open Source Paradox

[FuzzzyLogik]

Apple actually uses a ton of open standards.

• They use an open standard for their iCal calendar files.
• They will use Jabber as a backend on the server version of Tiger for iChat within the local network.
• On the subject of ical it allows syncing through webdav, which is open.
• Darwin - the OS X kernel is open source

And I'm sure others can chime in on more as i'm not totally familiar with all the stuff they use. but they seem to have embraced open source fairly heavily.

Prior art by Eric Raymond

[bstadil]

The Linux show just finished and this was discussed in length. Eric was on the show and it turn out that the Patent that MS is claiming has prior art by Eric himself.

Head on over and listen in.

Re:Does it matter?

[Rahga]

Sorry to clue in an AC, but SpamAssassin is used in far more government and business e-mail servers than your typical IT brass would like to admit, and it is now part of the Apache Software Foundation.

Not PGP, but something open

[Izaak]

I'm not certain PGP is up to the task, but certainly some sort of public/private key signing tech needs to be used. The most important thing is that it be based on open non-patent encumered algorithms... otherwise it will never be accepted broadly enough.

What really needs to happen is for an open counter proposal to come out, and that needs to be folded into the public code base for sendmail as managed by sendmail.org. Unfortunately sendmail.org is sponsered by Sendmail, Inc. (sendmail.com), a commercial company that has announced support for Microsofts version of Sender ID. This could be a source of conflict perhaps?

Cheers
Thad

Nothing like PGP

[ergo98]

I don't think SenderID is anything whatsoever like PGP. Coincidentally I went to Microsoft.com and read about SenderID today to see what the fuss is about. Turns out, and I'm sure someone will correct me if I'm wrong, it's simply an extension record in your DNS MX record that basically lists the possible outgoing IP addresses for email from a certain domain. For instance Citibank would add their outgoing mail servers in their MX record (because presumably only authorized agents will be screwing with the MX record), and any recipient can simply check the MX record and get the possible source IP addresses, rejecting the phish attempt from some server in central Russia. There's a tool to configure the extension block.

As an aside, because invariably someone will mention this, TCP (on which SMTP is based) is connection based, so spoofing isn't an issue.

Re:Nothing like PGP

[mattjb0010]

Slight correction in that it's a separate TXT record, not part of the MX record.

Re:Ummm.....

[typhoonius]

What do Apache and IIS have to do with email?

IIS does HTTP, FTP, and SMTP.

Relevant history

[Anonymous Coward]

Two articles on the history of Sender-ID:
http://www.circleid.com/article/730_0_1_0_C/
http://www.circleid.com/article/732_0_1_0_C/

Re:Bah

[mvdwege]

Nope, sorry. They even manage to break that standard.

Not in really harmful ways, that must be admitted, but still, MS does not implement TCP/IP correctly. The example that comes to mind is the way they make sure all packets coming from an MS OS are high priority (I haven't got the technical docs right here, they're 50km away, but it has to do with marking them as coming from interactive sources), thus breaking one of TCP/IP built-in Quality-of-Service mechanisms.

So even something as basic as TCP/IP they manage to mess up. This is not very conducive to their trustworthiness.

Mart

Patents != Copyright

[pavon]

Could Microsoft be considering an Open Source license for Sender ID?

Well, looks like a good time to clarify the difference between patents and copyright for the benefit of the new blood here on slashdot. They are very different things, and you must understand what the law says before you can develop educated opinions on the law. Copyright is a government issued monopoly on the distribution, and public performance of a specific work and derivatives of that work. Patents on the other hand are a government issued monopoly on the commercial application of an idea. A book is a specific creative act, and thus falls under copyright. A method of building a tractor is an idea, and is thus patentable. You can't have copyright on an idea, and you can't patent a specific work.

Now onto this specific situation.

When you talk about open source licenses, you are dealing with copyright. A copyright license grants you specific (often limited) rights to distribute, perform, or modify the authors work. Without a copyright license you do not have the right to do any of these things. Open source software gives people the right to redistribute the work, created derivative works, and redistribute those works (possibly with the restriction that the derivative work must also be open source). However, it requires that if a work is distributed it must be available in a useful form - the original source code.

Now Caller-ID is not a piece of software - it is a protocol, a standard, an idea, and thus falls into the realm of patent law. A patent license gives you permission to use an idea in your own works. Without a patent license you do not have a right to use the idea in your own work, even if you thought of it by yourself. Microsoft has patented some of the ideas in Caller-ID, so anyone who wants to create an implementation of Caller-ID must get a patent license from Microsoft. The patent license which Microsoft is currently offering for Caller-ID has several issues that make it impossible to use the patented ideas in Open Source software without violating one of the licenses.

By now you can see what was wrong with the text I quoted - Sender ID is not a piece of software - it is a patented idea, and so it is nonsensical to talk about releasing it under an Open Source (copyright) license. What the submitter should have asked is "Could Microsoft be considering an Open Source friendly patent license for Sender ID".

That said you can read this post if you want to know more about why the current patent license for Caller ID is incompatible with Open Source software.

Re:hm..

[MavEtJu]

PGP is to ensure that the contents of the email are un-altered and that the contents of the email can be authenticated.

Sender ID is to ensure that the envelope of the email (this is not the message body, but the envelope) is coming from a server of which where the owners of the domain say "this is our outbound mail gateway".

Envelope - Message header - Message body.
Three different things.

Re:MOD PARENT DOWN

[typhoonius]

ACs are stupid.

But yes, Exchange also does SMTP (in addition to MAPI, POP3, and IMAP).

Re:MOD PARENT DOWN

[Anonymous Coward]

fscking newbies

IIS installs SMTPD

Exchange does NOT install SMTPD.

Hence, IIS does smtp email, not exchange. Exchange runs happily without that useless public standard, smtp.

Buncha useless whining fscking idiots.

Bleh. Quick, where's that URL for that study about how useless people always think they know more than other people?

Re:Battle Tactics

[zurab]

This could just be a tactic by Microsoft to push their software. Think about it, a somber looking Balmer (if that's even possible) saying "We tried to negotiate with the OSS community, but because of their ignorance we wern't able to come to an agreement"

I don't know what the exact market numbers are, but fortunately, Microsoft is not in a position to do that. More importantly, they have to prove how SenderID will actually stop spam - it won't - spammers will use SenderID, and spammer-happy ISPs will gladly provide the service.

Also, keep in mind that SenderID is just a specification. We are talking about implementations of a specification. We are talking about licensing a specification on how to get a list of servers allowed to send mail!

The problem is that there are several software patents associated with SenderID (thank you USPTO!), and therefore it is nothing but a legally crippled piece of paper. Imagine if HTTP, SMTP, POP3, etc. were patented and held hostage by several companies who did not allow any open source implementations - where would they be today? Nowhere, probably replaced by different protocols that had non-crippled specifications.

Of course, at the same time they will start more FUD sites touting the benifits of Sender ID and why it will ONLY run on their software.

You won't have to look far for that. Just look at the SenderID FAQ:

Q5: What do I need to do for binary and/or source code distribution?
A5: Many open source licenses require you to include copyright notices distributed in the code itself identifying the authors of the code being distributed. Some open source licenses also require you to include the license under which you received the code with the code that you distribute so that downstream users of the code are made aware of the terms and conditions under which they can use the code. Microsoft does not require any notice or other attribution when you disclose or distribute your implementation in binary form.

Look at them touting themselves for not requiring copyright notices for an implementation of a specification while open source licenses require those for actual programs. Just a piece of MS' usual FUD propaganda.

extracts of email sent to ESR

[wayne]

Here are parts of the email I sent Eric last week about the fetchmail vs SenderID patent.

Yakov Shafranovich (the former chair of the IRTF's ASRG) did some digging for prior art and turned up quite a bit. One of the examples that he gave was fetchmail.

I just realized that another way to look at this is not that fetchmail is prior art, but that if the MS patent goes through, fetchmail will be infringing on MS's patent and you will need to get a license from MS to continue to distribute fetchmail.

Mind you, lawyers from places like the OSI, FSF and the Apache Software Foundation have found MS's SenderID license to be incompatbile with various F/OSS licenses, including the GPL. So, if you don't want to run the risk of MS sueing you, you will not only have to get a license from them, but you will need to change your license.

Yeah, there *is* a chance that the USPT might reject MS's license because of the prior art, but, gee, we both know what the chances of that happen are.

Messages of interest to you include:

http://www.imc.org/ietf-mxcomp/mail-archive/msg039 39.html http://www.imc.org/ietf-mxcomp/mail-archive/msg039 30.html

In a followup, I wrote:

In <20040903064727.GE4436@thyrsus.com> "Eric S. Raymond" [snip] writes:

> wayne <wayne@midwestcs.com>:
>> Yakov Shafranovich (the former chair of the IRTF's ASRG) did some
>> digging for prior art [on PRA] and turned up quite a bit. One of the examples
>> that he gave was fetchmail.
>
> Oh, that *is* interesting. So why back down? Let's fight Microsoft on this.

Oh, I just realized. If MS's patent goes through, you (and all distributors of fetchmail) will not be able to get a SenderID license from Microsoft to keep you from risking being sued by MS.

Not only does fetchmail not implement all required aspects of SenderID (a requirement of the license), but fetchmail's use of header checking appears to be used for different purposes than implementing SenderID. MS's license only covers SenderID usage. You will have to negotiate directly with MS to see if they will permit you, and all users of fetchmail, to continue using the functionality that you have had for years.

And, in one more followup, I mentioned:

I had missed interesting detail when I first read the following post by Matt Sergeant:

http://www.imc.org/ietf-mxcomp/mail-archive/msg040 45.html

I pressed [Craig Spietzle of Microsoft]: "Will you fix the license?". I never really got a confirmed yes or no, but my feeling was "no" when we ended the conversation. I suggested that they give their IP to the IETF (such as I believe there is precedence of - I know that IBM has committed patents to the public domain before in a similar act of openness), to which I was told that Craig believed this was a reasonable idea, but that Bill Gates himself had vetoed that idea because of the current focus on patent gathering and IPR issues at Microsoft.

I'll believe it when I see it.

[wayne]

Dan Quinlan (of Spamassassin/ironport) has been working with Larry Rosen (a lawyer for OSI) and Eben Moglen (a lawyer for FSF) for months now. *VERY* little progress has been made, even when it was clear that SenderID would be at risk of not being advanced by the IETF to RFC status. I have *VERY* little hope that Microsoft will make the required changes to their license to be compatible with Free/open source software.

Insight into the current situation can be found in a post by Matt Sergeant (Spamassassin/messagelabs):

http://www.imc.org/ietf-mxcomp/mail-archive/msg040 45.html

I pressed [Craig Spietzle of Microsoft]: "Will you fix the license?". I never really got a confirmed yes or no, but my feeling was "no" when we ended the conversation. I suggested that they give their IP to the IETF (such as I believe there is precedence of - I know that IBM has committed patents to the public domain before in a similar act of openness), to which I was told that Craig believed this was a reasonable idea, but that Bill Gates himself had vetoed that idea because of the current focus on patent gathering and IPR issues at Microsoft.

Re:Bah

[Anonymous Coward]

"So even something as basic as TCP/IP they manage to mess up."

Different example to prove the same point. IIS does not handshake properly.

http://grotto11.com/blog/slash.html?+1039831658

http://slashdot.org/article.pl?sid=03/01/05/2025 25 4

Re:Bah

[ortholattice]

Could you please cite your evidence this claim? I don't doubt it, but it'd help your argument, as well as help educate people such as myself who hadn't heard of this before.

According to Unix Administration Handbook, 3rd ed.:

"Linux pays attention to the type-of-service (TOS) bits in IP packets and gives faster service to packets that are labeled as interactive (low latency). Jammin'! Unfortunately, brain damage on the part of Microsoft necessitates that you turn off this perfectly reasonable behavior."

"All packets originating on Windows 95, 98, NT, and 2000 are labeled as being interactive, no matter what their purpose.... If your Linux gateway serves a mixed network of UNIX and Windows systems, the Windows packets will consistently get preferential treatment. The performance hit for UNIX can be quite noticeable."

In other words, MS's TCP/IP just hogs the network unconditionally with highest priority, forcing others to do the same if they want any throughput. It makes sensible prioritizing of network traffic flow based on the TOS bits impossible, and essentially renders them useless. One could speculate they did this because they wanted to claim "improved performance" in a mixed Windows/Unix environment, or possibly it was just incompetence or laziness on the part of their programmers. On the other hand, it's not like they set them to a random priority, but instead chose "highest", which makes you think they were just being the bullies on the block to get what they wanted with complete disregard to others and certainly with no spirit of cooperation.

Re:What's the difference between SenderID and SPF?

[Anonymous Coward]

SPF is DNS records. SenderID is XML over DNS.

Re:MS Open Source Paradox

[robmyers]

You missed Safari (KHTML), and Rendezvous. Also the Objective-C langauge that their GUI framework is built on is an extension of GCC.

The competitive advantage comes from having something thanks to Open Source where otherwise you would have nothing. It's hard to compete if you don't have anything to compete with. Apple have built their entire OS on top of Open Source, and they and NeXT before them have done so since the late 1980s!

iChat rocks for IM. Simple and powerful. If you want endless config dialogs, sure, go for another client. Enjoy. As for Darwin not being as 'sophisticated' as the broken lump of spaghetti code that is the NT kernel, how exactly is that a bad thing? Linux is less sophisticate than HURD...

Re:Do you mean TCP or do you mean IP

[Ianoo]

Well, HTTP works over TCP/IP, not UDP/IP or ICMP/IP. For the majority of Internet traffic, TCP/IP is an accurate description of the underlying protocol. DNS is the only thing used regularly these days that runs over UDP/IP, something like >75% of traffic on transatlantic links is TCP, only 14% UDP.

Patent Infringement Here

[KjetilK]

Well, they are patenting something trivial again, and fetchmail has a trivial replacement for MS patented algorithm, it seems. This Perl one-liner is said to implement MS patent:

my $pra = $headers->get('Resent-Sender') || $headers->get('Resent-From')
|| $headers->get('Sender') || $headers->get('From');

It is just wrong that something like that should hold up a programmer one second...

DomanKeys

[Russ Nelson]

Sounds like you want DomainKeys. Sendmail has support for DomainKeys as well, as does qmail.
-russ