> On Nov 21, 2017, at 10:39 AM, Andrew Sullivan <ajs@crankycanuck.ca> wrote:
>
> On Mon, Nov 20, 2017 at 02:46:08PM -0800, Steve Atkins wrote:
>> That's poor practice, for several reasons - replay attacks with added content
>> and it being an extremely rare practice that's likely to trigger bugs in DKIM
>> validation are two. The latter is the much bigger deal.
>>
>> It also doesn't help much for most MIME encoded mail (including base64
>> encoded plain text, like the mail I'm replying to).
>>
>> Pretending those paragraphs aren't there is the right thing to do.
>
> Yes. Also the DMARC and forthcoming ARC mechanisms -- super important
> for people behind gmail and yahoo and so on -- make that feature not
> really work, AFAICT.
It doesn't break DMARC or ARC as they only care if the mail is
authenticated via SPF or DKIM (with an aligned, blah, blah, blah) so
if the DKIM passes, even with an l= flag, it's OK. But ...
> I think that part of DKIM is busted, and the
> authors of it I've talked to seem to agree.
Pretty much, yes. Certainly for mail where you don't have tight control
over how it's generated.
Removing Subject tagging and footers of the messages isn't an accidental
side effect of the migration, it's (I assume) a primary goal of it.
If that weren't done, more and more people at large consumer mailbox
providers would increasingly have problems sending mail successfully
to the lists.
Peoples mail filters will just have to adjust.
Blame Yahoo, not PGDG.
Cheers, Steve