Slashdot Mirror
OSI And Microsoft Negotiating Over Sender ID
ValourX writes "Microsoft's Sender ID has already been rejected by both the Debian Project and the Apache Software Foundation, but Joe Barr of NewsForge today interviewed Larry Rosen of the Open Source Initiative and discovered that there are negotiations between the two entities with regard to Sender ID's licensing. Could Microsoft be considering an Open Source license for Sender ID? Slashdot has covered other aspects of this story in the past. NewsForge is part of OSTG, like Slashdot."
I don't think MS has a chance of getting a stranglehold on this. I mean, in terms of email, they really need the cooperation of pretty much everyone for it to work anyway. There are far too many non-Microsoft free software mail servers run by large and small companies. Granted, Microsoft has a huge presence on the desktop, but they aren't dominant enough yet on servers to make it really work in their favor.
Maybe they are honestly trying to solve the spam problem and are willing to compromise for the good of users.
GMail invites for completed freeipods.com of
And I'm sure others can chime in on more as i'm not totally familiar with all the stuff they use. but they seem to have embraced open source fairly heavily.
Kyle
http://www.unlogikal.net/
I don't think SenderID is anything whatsoever like PGP. Coincidentally I went to Microsoft.com and read about SenderID today to see what the fuss is about. Turns out, and I'm sure someone will correct me if I'm wrong, it's simply an extension record in your DNS MX record that basically lists the possible outgoing IP addresses for email from a certain domain. For instance Citibank would add their outgoing mail servers in their MX record (because presumably only authorized agents will be screwing with the MX record), and any recipient can simply check the MX record and get the possible source IP addresses, rejecting the phish attempt from some server in central Russia. There's a tool to configure the extension block.
As an aside, because invariably someone will mention this, TCP (on which SMTP is based) is connection based, so spoofing isn't an issue.
Nope, sorry. They even manage to break that standard.
Not in really harmful ways, that must be admitted, but still, MS does not implement TCP/IP correctly. The example that comes to mind is the way they make sure all packets coming from an MS OS are high priority (I haven't got the technical docs right here, they're 50km away, but it has to do with marking them as coming from interactive sources), thus breaking one of TCP/IP built-in Quality-of-Service mechanisms.
So even something as basic as TCP/IP they manage to mess up. This is not very conducive to their trustworthiness.
Mart"I know I will be modded down for this": where's the option '-1, Asking for it'?
Could Microsoft be considering an Open Source license for Sender ID?
Well, looks like a good time to clarify the difference between patents and copyright for the benefit of the new blood here on slashdot. They are very different things, and you must understand what the law says before you can develop educated opinions on the law. Copyright is a government issued monopoly on the distribution, and public performance of a specific work and derivatives of that work. Patents on the other hand are a government issued monopoly on the commercial application of an idea. A book is a specific creative act, and thus falls under copyright. A method of building a tractor is an idea, and is thus patentable. You can't have copyright on an idea, and you can't patent a specific work.
Now onto this specific situation.
When you talk about open source licenses, you are dealing with copyright. A copyright license grants you specific (often limited) rights to distribute, perform, or modify the authors work. Without a copyright license you do not have the right to do any of these things. Open source software gives people the right to redistribute the work, created derivative works, and redistribute those works (possibly with the restriction that the derivative work must also be open source). However, it requires that if a work is distributed it must be available in a useful form - the original source code.
Now Caller-ID is not a piece of software - it is a protocol, a standard, an idea, and thus falls into the realm of patent law. A patent license gives you permission to use an idea in your own works. Without a patent license you do not have a right to use the idea in your own work, even if you thought of it by yourself. Microsoft has patented some of the ideas in Caller-ID, so anyone who wants to create an implementation of Caller-ID must get a patent license from Microsoft. The patent license which Microsoft is currently offering for Caller-ID has several issues that make it impossible to use the patented ideas in Open Source software without violating one of the licenses.
By now you can see what was wrong with the text I quoted - Sender ID is not a piece of software - it is a patented idea, and so it is nonsensical to talk about releasing it under an Open Source (copyright) license. What the submitter should have asked is "Could Microsoft be considering an Open Source friendly patent license for Sender ID".
That said you can read this post if you want to know more about why the current patent license for Caller ID is incompatible with Open Source software.
Insight into the current situation can be found in a post by Matt Sergeant (Spamassassin/messagelabs):
http://www.imc.org/ietf-mxcomp/mail-archive/msg040 45.html
SPF support for most open source mail servers can be found at libspf2.
According to Unix Administration Handbook, 3rd ed.:
"Linux pays attention to the type-of-service (TOS) bits in IP packets and gives faster service to packets that are labeled as interactive (low latency). Jammin'! Unfortunately, brain damage on the part of Microsoft necessitates that you turn off this perfectly reasonable behavior."
"All packets originating on Windows 95, 98, NT, and 2000 are labeled as being interactive, no matter what their purpose.... If your Linux gateway serves a mixed network of UNIX and Windows systems, the Windows packets will consistently get preferential treatment. The performance hit for UNIX can be quite noticeable."
In other words, MS's TCP/IP just hogs the network unconditionally with highest priority, forcing others to do the same if they want any throughput. It makes sensible prioritizing of network traffic flow based on the TOS bits impossible, and essentially renders them useless. One could speculate they did this because they wanted to claim "improved performance" in a mixed Windows/Unix environment, or possibly it was just incompetence or laziness on the part of their programmers. On the other hand, it's not like they set them to a random priority, but instead chose "highest", which makes you think they were just being the bullies on the block to get what they wanted with complete disregard to others and certainly with no spirit of cooperation.