Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Spam Patents Your Rights Online

OSI And Microsoft Negotiating Over Sender ID 226

Posted by timothy from the accord-is-nice-but-so-is-lexus dept.
ValourX writes "Microsoft's Sender ID has already been rejected by both the Debian Project and the Apache Software Foundation, but Joe Barr of NewsForge today interviewed Larry Rosen of the Open Source Initiative and discovered that there are negotiations between the two entities with regard to Sender ID's licensing. Could Microsoft be considering an Open Source license for Sender ID? Slashdot has covered other aspects of this story in the past. NewsForge is part of OSTG, like Slashdot."
This discussion has been archived. No new comments can be posted.

OSI And Microsoft Negotiating Over Sender ID More

OSI And Microsoft Negotiating Over Sender ID

Comments Filter:

  • hm.. (Score:4, Insightful)

    by mcovey ( 794220 ) on Tuesday September 07, 2004 @09:41PM (#10185442) Journal
    sender ID still sounds a lot like PGP to me. why not just use that?

    • Re:hm.. (Score:4, Insightful)

      by Nermal6693 ( 622898 ) on Tuesday September 07, 2004 @09:43PM (#10185464)
      Because MS can't possibly acknowledge that someone else has already come up with the idea.

    • Re:hm.. (Score:2, Interesting)

      by JThundley ( 631154 )
      Because PGP is not simple to use. And there's no huge company behind it.

    • Not PGP, but something open (Score:5, Informative)

      by Izaak ( 31329 ) on Tuesday September 07, 2004 @10:05PM (#10185632) Homepage Journal
      I'm not certain PGP is up to the task, but certainly some sort of public/private key signing tech needs to be used. The most important thing is that it be based on open non-patent encumered algorithms... otherwise it will never be accepted broadly enough.

      What really needs to happen is for an open counter proposal to come out, and that needs to be folded into the public code base for sendmail as managed by sendmail.org. Unfortunately sendmail.org is sponsered by Sendmail, Inc. (sendmail.com), a commercial company that has announced support for Microsofts version of Sender ID. This could be a source of conflict perhaps?

      Cheers
      Thad

    • Nothing like PGP (Score:5, Informative)

      by ergo98 ( 9391 ) on Tuesday September 07, 2004 @10:17PM (#10185726) Homepage Journal
      I don't think SenderID is anything whatsoever like PGP. Coincidentally I went to Microsoft.com and read about SenderID [microsoft.com] today to see what the fuss is about. Turns out, and I'm sure someone will correct me if I'm wrong, it's simply an extension record in your DNS MX record that basically lists the possible outgoing IP addresses for email from a certain domain. For instance Citibank would add their outgoing mail servers in their MX record (because presumably only authorized agents will be screwing with the MX record), and any recipient can simply check the MX record and get the possible source IP addresses, rejecting the phish attempt from some server in central Russia. There's a tool [anti-spamtools.org] to configure the extension block.

      As an aside, because invariably someone will mention this, TCP (on which SMTP is based) is connection based, so spoofing isn't an issue.

      • Re:Nothing like PGP (Score:5, Informative)

        by mattjb0010 ( 724744 ) on Tuesday September 07, 2004 @11:33PM (#10186167) Homepage
        Slight correction in that it's a separate TXT record, not part of the MX record.

      • Nit-picking (Score:3, Interesting)

        by Anonymous Coward
        Technically, the process you describe is included in SPF, which is an open/free standard and existed before (but has become integrated in) Sender-ID. Sender-ID provides for a few other things too, but none of them are terribly important imho. Raw SPF would suffice.

        • Re:Nit-picking (Score:3, Insightful)

          by ergo98 ( 9391 )
          Sender-ID provides for a few other things too...

          Out of honest curiousity, what are those additional features? I'm most certainly not a SenderID expert (or even informed layman), but I've browsed through the SenderID documents and the feature seems to be nothing more than listing outbound IPs in your DNS entries. What else does it offer?
      • MX says where a domain wants to receive mail and SPF and SenderID say were they send it from. Its a start. I'd prefer calling the record XM since its the reverse of MX.

    • Re:hm.. (Score:5, Informative)

      by MavEtJu ( 241979 ) <<gro.ujtevam> <ta> <todhsals>> on Tuesday September 07, 2004 @11:00PM (#10185990) Homepage
      PGP is to ensure that the contents of the email are un-altered and that the contents of the email can be authenticated.

      Sender ID is to ensure that the envelope of the email (this is not the message body, but the envelope) is coming from a server of which where the owners of the domain say "this is our outbound mail gateway".

      Envelope - Message header - Message body.
      Three different things.
      • Which would you rather know? Who sent the mail, or where the mail came from? Sender ID only tells you where. With S/Mime you get both. And this sender ID/SPF thing requires that EVERYBODY use it or else. On the other hand, S/Mime can be phased in gradually, one user at a time, and could easily be filtered client side. It looks to me like a major piece of the spam solution is right under your noses.

  • Bah (Score:4, Interesting)

    by FuzzzyLogik ( 592766 ) * on Tuesday September 07, 2004 @09:42PM (#10185452) Homepage
    I hope they still reject it. There's bound to be a better solution that won't give Microsoft yet another stranglehold on this as well. For once I'd like to see a standard (free and open) that MS has to follow instead of the other way around.

    • Re:Bah (Score:5, Informative)

      by echeslack ( 618016 ) on Tuesday September 07, 2004 @09:47PM (#10185497) Homepage Journal
      I don't think MS has a chance of getting a stranglehold on this. I mean, in terms of email, they really need the cooperation of pretty much everyone for it to work anyway. There are far too many non-Microsoft free software mail servers run by large and small companies. Granted, Microsoft has a huge presence on the desktop, but they aren't dominant enough yet on servers to make it really work in their favor.

      Maybe they are honestly trying to solve the spam problem and are willing to compromise for the good of users.

      • Re:Bah (Score:2, Insightful)

        by FuzzzyLogik ( 592766 ) *
        Heh, that's kinda funny in that you think they're really trying to solve the spam problem and will compromise for the good of the end user.

        They COULD be but it's doubtful, they are such a large corporation you just KNOW that they're sticking their head into yet another thing to gain marketshare. They might start out by saying we'll negociate but once the next version or update rolls around they won't be so forgiving.

        This is simply my take on it, I'm not sure if any of it really will happen or if I'm j

    • Re:Bah (Score:4, Insightful)

      by BitterOak ( 537666 ) on Tuesday September 07, 2004 @09:50PM (#10185528)
      For once I'd like to see a standard (free and open) that MS has to follow instead of the other way around.

      Like TCP/IP?

      • Re:Bah (Score:5, Informative)

        by mvdwege ( 243851 ) <mvdwege@mail.com> on Tuesday September 07, 2004 @10:29PM (#10185807) Homepage Journal

        Nope, sorry. They even manage to break that standard.

        Not in really harmful ways, that must be admitted, but still, MS does not implement TCP/IP correctly. The example that comes to mind is the way they make sure all packets coming from an MS OS are high priority (I haven't got the technical docs right here, they're 50km away, but it has to do with marking them as coming from interactive sources), thus breaking one of TCP/IP built-in Quality-of-Service mechanisms.

        So even something as basic as TCP/IP they manage to mess up. This is not very conducive to their trustworthiness.

        Mart

        • Re:Bah (Score:3, Informative)

          by Anonymous Coward
          "So even something as basic as TCP/IP they manage to mess up."

          Different example to prove the same point. IIS does not handshake properly.

          http://grotto11.com/blog/slash.html?+1039831658

          http://slashdot.org/article.pl?sid=03/01/05/2025 25 4
      • I really do not understand why people use the term "TCP/IP".

        TCP is just one of the protocols running under IP on a normal computer. The others are UDP and ICMP. So if you want to include that protocal layer in the name, "TCP+UDP+ICMP/IP" would be better. Or you could just say "IP".

        To me, this is like calling all four wheels on a car "front wheels".
        • Well, HTTP works over TCP/IP, not UDP/IP or ICMP/IP. For the majority of Internet traffic, TCP/IP is an accurate description of the underlying protocol. DNS is the only thing used regularly these days that runs over UDP/IP, something like >75% of traffic on transatlantic links is TCP, only 14% UDP.

  • divide and conquer (Score:4, Interesting)

    by flacco ( 324089 ) on Tuesday September 07, 2004 @09:44PM (#10185467)
    look forward to MS accommodating an open source implementation, while freezing out a GPL-compatible implementation.
    • look forward to MS accommodating an open source implementation, while freezing out a GPL-compatible implementation.

      Be happy that an open source implementation came out of them. You don't use Apache software because it's not GPL'd? That's a bit rough don't you think?

  • In other news... (Score:5, Funny)

    by overbyj ( 696078 ) on Tuesday September 07, 2004 @09:44PM (#10185471)
    Could Microsoft be considering an Open Source license for Sender ID?

    There are rumors of a massive cold front moving towards Hell. Forecasters are predicting temperatures may drop to below 32 degrees F. Stay tuned for more up to date info.
    • "There are rumors of a massive cold front moving towards Hell"

      Actually, as I type this, the weather in Hell [storm.no] is a mild 10 degrees Celsius (50F), projected to rise to 16 degrees Celsius (61F) by Friday. About normal for this time of year.

      Oh, and Hell (altitude: 58 metres above sea level) is a small village/town in Norway, not far from Trondheim.

  • Does it matter? (Score:5, Funny)

    by Dancin_Santa ( 265275 ) <DancinSanta@gmail.com> on Tuesday September 07, 2004 @09:45PM (#10185477) Journal
    If Apache refuses to accept this technology, then it is dead in the water. There aren't enough IIS servers to make a signficant dent in spam even with this technology.

    Personally, I'd love it if technology were judged on the content of its character rather than the character of its creator, but this is not a perfect world and fanatics on both sides of the aisle pass up good ideas that come from the "wrong" side all the time.

  • THIS IS JUST THE THING (Score:2, Interesting)

    by drsmack1 ( 698392 ) *
    I'm tired of filtering through the mountains of spam my users get everyday. There can be no legal recourse - the solution must be technological. I see this as a good thing.

  • Not to bash Microsoft but... (Score:3, Interesting)

    by chrispyman ( 710460 ) on Tuesday September 07, 2004 @09:47PM (#10185493)
    SenderID really doesn't seem like that much of an improvement over SPF. Then you factor in the problem of licensing and you see how much of an big problem this really is. Even if you do get it accepted as some open source license (even the *gasp* GPL), I think we have way too many zealots/MS bashers working for the open source projects who wouldn't want to implement this.

  • MS - OS (Score:5, Insightful)

    by StevenHenderson ( 806391 ) <stevehenderson@NOspam.gmail.com> on Tuesday September 07, 2004 @09:48PM (#10185512)
    Microsoft might as well let SenderID go open source. It would make their jobs easier. Less spam = less viruses = less need for frequent updates and less load on Hotmail servers. Am I wrong?

    • Re:MS - OS (Score:3, Insightful)

      by LoudMusic ( 199347 )
      Microsoft might as well let SenderID go open source. It would make their jobs easier. Less spam = less viruses = less need for frequent updates and less load on Hotmail servers. Am I wrong?

      But if it's open source then people will associate it with 'free', and Microsoft can't charge for 'free', and that doesn't go over well with the accountant.

    • Commerce Solutions with Technology! (Score:5, Insightful)

      by toupsie ( 88295 ) on Tuesday September 07, 2004 @11:57PM (#10186276) Homepage
      And less money selling software and services. Microsoft makes money off the issues that face their users with their products. SMS [microsoft.com], MOM [microsoft.com] and ISA [microsoft.com] are few examples of products that help manage, update, monitor and protect Microsoft's other products. And they make good coin for selling and consulting those "added value" products. You can dupe most of these in linux with nagios, apt-get/emerge/up2date, snort, squid and ip tables but you don't get a nice guy from Microsoft that will hold your hand and tell you its alright you don't understand why it doesn't work exactly like the manual says. You get flamed on a message board and told to RTFM. Plus the Microsoft guy will buy you lunch!

      I wonder if SenderID might require some old Exchange installs to be upgraded. When I tried searching Microsoft's web site for "SenderID Exchange 5.5", I got one link. Items I should consider when building "Commerce Solutions with Technology". So I am taking that as a yes. Cha-ching, Microsoft...Commerce Solutions with Technology at work!

      • That's a totally misguided troll attempt.

        First, you yourself say that Sender ID will make Microsoft less money from support and services. Then why would they promote it?
        (Actually it won't influence services spending at all - customers will reassign that money to other critical matters. There's never enough money to fix all IT problems, so it's not that they'll use that money to buy new carpet for the meeting room).

        Second, customers who're still with Exchange 5.5 are more likely to change to Linux, so it's
    • Microsoft might as well let SenderID go open source.

      I really like development of this whole MS initiative so far, being shot down by Apache, Debian, and now reconsidered for open sourcing?

      It is pressure being applied to MS. And it's not pressure from Linux zealots, or from FSF supporters, but because it's necessary, and useful for this SenderID to work. In other words: free market pressure.

      End users get what they need (nothing at all, or something open, that might even work), and this possible solutio

  • Lucy, Charlie Brown, and the Football (Score:5, Funny)

    by Anonymous Coward on Tuesday September 07, 2004 @09:49PM (#10185516)
    Someone is always ready and eager to play the part of Charlie Brown.

    "But maybe they are serious this time!"

    "MS isn't ALWAYS evil" ...

  • Battle Tactics (Score:5, Insightful)

    by N5 ( 804512 ) on Tuesday September 07, 2004 @09:56PM (#10185575)
    This could just be a tactic by Microsoft to push their software. Think about it, a somber looking Balmer (if that's even possible) saying "We tried to negotiate with the OSS community, but because of their ignorance we wern't able to come to an agreement"

    Of course, at the same time they will start more FUD sites touting the benifits of Sender ID and why it will ONLY run on their software.

    • Re:Battle Tactics (Score:5, Informative)

      by zurab ( 188064 ) on Tuesday September 07, 2004 @11:46PM (#10186229)
      This could just be a tactic by Microsoft to push their software. Think about it, a somber looking Balmer (if that's even possible) saying "We tried to negotiate with the OSS community, but because of their ignorance we wern't able to come to an agreement"

      I don't know what the exact market numbers are, but fortunately, Microsoft is not in a position to do that. More importantly, they have to prove how SenderID will actually stop spam - it won't - spammers will use SenderID, and spammer-happy ISPs will gladly provide the service.

      Also, keep in mind that SenderID is just a specification. We are talking about implementations of a specification. We are talking about licensing a specification on how to get a list of servers allowed to send mail!

      The problem is that there are several software patents associated with SenderID (thank you USPTO!), and therefore it is nothing but a legally crippled piece of paper. Imagine if HTTP, SMTP, POP3, etc. were patented and held hostage by several companies who did not allow any open source implementations - where would they be today? Nowhere, probably replaced by different protocols that had non-crippled specifications.

      Of course, at the same time they will start more FUD sites touting the benifits of Sender ID and why it will ONLY run on their software.

      You won't have to look far for that. Just look at the SenderID FAQ:

      Q5: What do I need to do for binary and/or source code distribution?
      A5: Many open source licenses require you to include copyright notices distributed in the code itself identifying the authors of the code being distributed. Some open source licenses also require you to include the license under which you received the code with the code that you distribute so that downstream users of the code are made aware of the terms and conditions under which they can use the code. Microsoft does not require any notice or other attribution when you disclose or distribute your implementation in binary form.

      Look at them touting themselves for not requiring copyright notices for an implementation of a specification while open source licenses require those for actual programs. Just a piece of MS' usual FUD propaganda.

  • Prior art by Eric Raymond (Score:5, Informative)

    by bstadil ( 7110 ) on Tuesday September 07, 2004 @09:57PM (#10185584) Homepage
    The Linux show just finished and this was discussed in length. Eric was on the show and it turn out that the Patent that MS is claiming has prior art by Eric himself.

    Head on over and listen in [thelinuxshow.com].

    • Re:Prior art by Eric Raymond (Score:5, Funny)

      by Soko ( 17987 ) on Wednesday September 08, 2004 @12:20AM (#10186385) Homepage
      Eric was on the show and it turn[sic] out that the Patent that MS is claiming has prior art by Eric himself.

      *sigh*

      Just when we thought ESR's ego couldn't get any bigger...

      Soko
      • Well, they are patenting something trivial again, and fetchmail has a trivial replacement for MS patented algorithm, it seems. This Perl one-liner is said to implement MS patent:
        my $pra = $headers->get('Resent-Sender') || $headers->get('Resent-From')
        || $headers->get('Sender') || $headers->get('From');
        It is just wrong that something like that should hold up a programmer one second...

    • extracts of email sent to ESR (Score:4, Informative)

      by wayne ( 1579 ) <wayne@schlitt.net> on Wednesday September 08, 2004 @12:26AM (#10186415) Homepage Journal
      Here are parts of the email I sent Eric last week about the fetchmail vs SenderID patent.
      Yakov Shafranovich (the former chair of the IRTF's ASRG) did some digging for prior art and turned up quite a bit. One of the examples that he gave was fetchmail.

      I just realized that another way to look at this is not that fetchmail is prior art, but that if the MS patent goes through, fetchmail will be infringing on MS's patent and you will need to get a license from MS to continue to distribute fetchmail.

      Mind you, lawyers from places like the OSI, FSF and the Apache Software Foundation have found MS's SenderID license to be incompatbile with various F/OSS licenses, including the GPL. So, if you don't want to run the risk of MS sueing you, you will not only have to get a license from them, but you will need to change your license.

      Yeah, there *is* a chance that the USPT might reject MS's license because of the prior art, but, gee, we both know what the chances of that happen are.

      Messages of interest to you include:

      http://www.imc.org/ietf-mxcomp/mail-archive/msg039 39.html [imc.org] http://www.imc.org/ietf-mxcomp/mail-archive/msg039 30.html [imc.org]

      In a followup, I wrote:
      In <20040903064727.GE4436@thyrsus.com> "Eric S. Raymond" [snip] writes:

      > wayne <wayne@midwestcs.com>:
      >> Yakov Shafranovich (the former chair of the IRTF's ASRG) did some
      >> digging for prior art [on PRA] and turned up quite a bit. One of the examples
      >> that he gave was fetchmail.
      >
      > Oh, that *is* interesting. So why back down? Let's fight Microsoft on this.

      Oh, I just realized. If MS's patent goes through, you (and all distributors of fetchmail) will not be able to get a SenderID license from Microsoft to keep you from risking being sued by MS.

      Not only does fetchmail not implement all required aspects of SenderID (a requirement of the license), but fetchmail's use of header checking appears to be used for different purposes than implementing SenderID. MS's license only covers SenderID usage. You will have to negotiate directly with MS to see if they will permit you, and all users of fetchmail, to continue using the functionality that you have had for years.

      And, in one more followup, I mentioned:
      I had missed interesting detail when I first read the following post by Matt Sergeant:

      http://www.imc.org/ietf-mxcomp/mail-archive/msg040 45.html [imc.org]

      I pressed [Craig Spietzle of Microsoft]: "Will you fix the license?". I never really got a confirmed yes or no, but my feeling was "no" when we ended the conversation. I suggested that they give their IP to the IETF (such as I believe there is precedence of - I know that IBM has committed patents to the public domain before in a similar act of openness), to which I was told that Craig believed this was a reasonable idea, but that Bill Gates himself had vetoed that idea because of the current focus on patent gathering and IPR issues at Microsoft.

  • Not Open Systems Interconnection Reference Model (Score:4, Funny)

    by aardwolf204 ( 630780 ) on Tuesday September 07, 2004 @10:02PM (#10185616)
    Open Source Initiative [wikipedia.org] - not to be confused with the 7 layer Open Systems Interconnection Reference Model [wikipedia.org].

    At least thats the first thing that came to mind here.

    No matter how hard I try, I cant get to Kevin Bacon within 6 links from any random Wikipedia article.

  • There is no Negotiating (Score:5, Interesting)

    by thogard ( 43403 ) on Tuesday September 07, 2004 @10:02PM (#10185618) Homepage
    Years ago when X.400 was the in thing, Microsoft wanted to own email. The servers, the clients, the messages and collect a per message fee just like the post office.

    Can you explain why they don't think they can do this now?

    Now they have a huge patent base thats building up and they are going to use it to kill off the other options.

    This stuff scares me because its their way of taking control. They were a major player in the Gossip email systems and they lost out to SMTP. Now they have a sneakly way to undo that.

    I'll take spam and forged email over paying MSFT $.25 a message.
    • "I'll take spam and forged email over paying MSFT $.25 a message."

      You might. Many of us in the business world certainly wouldn't. This stuff wastes us far more than $.25 a message. I don't care who gets the money -- if the problem was solved let the problem be solved.

  • what is ISC doing? (Score:4, Insightful)

    by timmarhy ( 659436 ) on Tuesday September 07, 2004 @10:06PM (#10185643)
    the people who need to pull their finger out is ISC, they are the organisation in the best position to be initating the spam solution. think about it, and anti spam solution is going to involve DNS - what the leading DNS server? BIND. IF ISC and sendmail org got together they would have more clout on this issue then MS and be a hell of a lot more trust worthy.

  • SenderID is overhyped (Score:5, Funny)

    by pdamoc ( 771461 ) on Tuesday September 07, 2004 @10:07PM (#10185647) Homepage

    Could Microsoft be considering an Open Source license for Sender ID?

    I don't know about that but maybe they will release Clippy under an Open Source licence, just to show they care about the movement. :)
    • I am sure that Miguel de Icaza will be the first to release a beta gclippy...
    • Put it into the BIOS!

      User inserts Windows install disk and starts his computer.
      The BIOS-integrated Tux-Clippy variant starts, detects that you inserted a Windows install disk:
      It seems you want to install an operating system. Please click next if you want help.
      The user clicks "next".
      Looks like a Windows boot disk. Have you considered using Linux instead?
      The user clicks "no".
      I see you have a working network. It is possible to start a network install of Debian directly from the BIOS. If you don't like it

  • From what I can tell (Score:5, Insightful)

    by Effugas ( 2378 ) * on Tuesday September 07, 2004 @10:14PM (#10185701) Homepage
    It's basically like this:

    Alot of MS mail environments don't send mail like SPF envisions. Sender-ID basically makes life easier for MS customers. MS is coming to SPF people, saying, heh, can you modify your protocol to be a bit more friendly to our implementations?

    And, since there are actually users behind those mail servers, SPF folks say, sure. Lets talk. Lets see how we can better adapt to your architecture.

    Then MS turns around and says, oh, you want to adapt to us? You'll have to sign these forms.

    At which point, SPF people walk away. They've already got a great way to tell eachother what they need to say, and while they're willing to work with MS, really, Sender-ID really helps MS more than it helps anyone else. A fate where exchange deployments need to either alter their topology or risk getting their mail dropped isn't one that's beneficial to the company.

    Indeed, there are these people called customers that'll handle any intransigence on the part of their vendor. Which, uh, is about what's happening right now.

    I'm not saying this is exactly what's going on. Neither side is monolithic. But this is, at least from the outside, what appears to be happening. Someone on the inside should feel free to correct me.

    --Dan

  • It's all about $$$ (Score:5, Insightful)

    by Dalroth ( 85450 ) * on Tuesday September 07, 2004 @10:21PM (#10185757) Homepage Journal
    With millions of dollars in bandwidth costs on the line, and potentially billions of dollars in customer satisfaction, Microsoft may very well want to play nice on this issue. SPAM is a serious problem, and bickering and fighting isn't going to make it go away. Cooperation and hard work will.

    Bryan

    • Re:It's all about $$$ (Score:4, Interesting)

      by mrchaotica ( 681592 ) on Wednesday September 08, 2004 @02:18AM (#10186871)
      If MS wanted to play nice, they'd just accept SPF.

      No, it really is all about the $$$ -- MS already lost, but they still want a piece of the pie. They might make SenderID open source, but will it be Free? And what happens when they get additional patents for SenderID 2.0?

  • Relevant history (Score:4, Informative)

    by Anonymous Coward on Tuesday September 07, 2004 @10:23PM (#10185768)
    Two articles on the history of Sender-ID:
    http://www.circleid.com/article/730_0_1_0_C/ [circleid.com]
    http://www.circleid.com/article/732_0_1_0_C/ [circleid.com]

  • This could of course mean.... (Score:4, Funny)

    by baximus ( 552800 ) on Tuesday September 07, 2004 @10:35PM (#10185840)
    Note that they're "negotiating". This is MS we're talking about here...

    "We'll give you a financial boost if you'll fast-track our application to be an OSI-Approved License. Just ignore the incompatibilities, and here's $100k for your trouble."

  • What's to negotiate? (Score:5, Insightful)

    by rhysweatherley ( 193588 ) on Tuesday September 07, 2004 @10:46PM (#10185901)
    I'm just curious as to what is there to negotiate? Either they license it royalty-free for all fields of use, or it does not belong in an officially-recognised IETF standard. There is no "middle ground" license that will satisfy the community. Patents are, by definition, incompatible with open standards.

  • Patents != Copyright (Score:5, Informative)

    by pavon ( 30274 ) on Tuesday September 07, 2004 @10:53PM (#10185942)
    Could Microsoft be considering an Open Source license for Sender ID?

    Well, looks like a good time to clarify the difference between patents and copyright for the benefit of the new blood here on slashdot. They are very different things, and you must understand what the law says before you can develop educated opinions on the law. Copyright is a government issued monopoly on the distribution, and public performance of a specific work and derivatives of that work. Patents on the other hand are a government issued monopoly on the commercial application of an idea. A book is a specific creative act, and thus falls under copyright. A method of building a tractor is an idea, and is thus patentable. You can't have copyright on an idea, and you can't patent a specific work.

    Now onto this specific situation.

    When you talk about open source licenses, you are dealing with copyright. A copyright license grants you specific (often limited) rights to distribute, perform, or modify the authors work. Without a copyright license you do not have the right to do any of these things. Open source software gives people the right to redistribute the work, created derivative works, and redistribute those works (possibly with the restriction that the derivative work must also be open source). However, it requires that if a work is distributed it must be available in a useful form - the original source code.

    Now Caller-ID is not a piece of software - it is a protocol, a standard, an idea, and thus falls into the realm of patent law. A patent license gives you permission to use an idea in your own works. Without a patent license you do not have a right to use the idea in your own work, even if you thought of it by yourself. Microsoft has patented some of the ideas in Caller-ID, so anyone who wants to create an implementation of Caller-ID must get a patent license from Microsoft. The patent license which Microsoft is currently offering for Caller-ID has several issues that make it impossible to use the patented ideas in Open Source software without violating one of the licenses.

    By now you can see what was wrong with the text I quoted - Sender ID is not a piece of software - it is a patented idea, and so it is nonsensical to talk about releasing it under an Open Source (copyright) license. What the submitter should have asked is "Could Microsoft be considering an Open Source friendly patent license for Sender ID".

    That said you can read this post [slashdot.org] if you want to know more about why the current patent license for Caller ID is incompatible with Open Source software.

  • Halloween Documents Anyone (Score:5, Interesting)

    by Anonymous Coward on Tuesday September 07, 2004 @11:20PM (#10186104)
    I may have missed any comments regarding this, but has anyone else drawn a connection between Sender ID and Microsoft's plan of "decommoditizing protocols" as referenced in the infamous "Halloween Documents"? 6 years later it seems their plans have remained the same. It'll be very interesting to see if they do come to some kind of agreement with the open source community.

  • Obligatory Simpsons "Buy 'Em out Boys " (Score:5, Funny)

    by ganhawk ( 703420 ) on Tuesday September 07, 2004 @11:36PM (#10186176)
    HOMER
    Oh, they have the Internet on computers now!

    MARGE
    Homer, Bill Gates is here.

    HOMER
    Bill Gates?! Millionaire computer nerd Bill Gates! Oh my god. Oh my god. Get out of sight, Marge. I don't want this to look like a two-bit operation.

    Marge groans and rolls her eyes. Bill Gates and two "associates" enter.

    GATES
    Mr. Simpson?

    HOMER
    You don't look so rich.

    GATES
    Don't let the haircut fool you, I am exceedingly wealthy.

    HOMER
    (quietly to Marge) Get a load of the bowl-job, Marge!

    GATES
    Your Internet ad was brought to my attention, but I can't figure out what, if anything, CompuGlobalHyperMegaNet does, so rather than risk competing with you, I've decided simply to buy you out.

    Homer and Marge step aside to talk privately.

    HOMER
    This is it Marge. I've poured my heart and soul into this business and now it's finally paying off. (covering his mouth) We're rich! Richer than astronauts.

    MARGE
    Homer quiet. Acquire the deal.

    HOMER
    (to Gates) I reluctantly accept your proposal!

    GATES
    Well everyone always does. Buy 'em out, boys!

    Bill Gates companions begin to trash the "office".

    HOMER
    Hey, what the hell's going on!

    GATES
    Oh, I didn't get rich by writing a lot of checks!

    Bill Gates lets out a maniacal laugh. Homer and Marge cower in the corner as the room continues to be trashed.

    -from www.simpsoncrazy.com

  • They should resolve it the way ISO does it... (Score:3, Funny)

    by truth_revealed ( 593493 ) on Tuesday September 07, 2004 @11:44PM (#10186218)
    in a wrestling ring with no referee and metal folding chairs conveniantly nearby.

  • pgp and domainkeys (Score:3, Interesting)

    by iradik ( 247593 ) <ossixNO@SPAMossix.net> on Wednesday September 08, 2004 @12:01AM (#10186302) Homepage
    A solution to stopping spam is outlined here:

    http://antispam.yahoo.com/domainkeys [yahoo.com]

    I picked up this link from here:

    http://www.pgp.com/resources/ctocorner/cryptoandsp am.html [pgp.com]

    This was a discussion about how pgp alone will not stop spam but how yahoo domain keys might. Due to domainkeys ability to actually verify the domain the e-mail is being sent from.

    • Re:pgp and domainkeys (Score:4, Insightful)

      by Anonymous Coward on Wednesday September 08, 2004 @12:25AM (#10186414)
      Yeah, everyone will be crying in their beer when Yahoo's (lesser of several evils) DomainKeys starts being used to control access to Yahoo's large spookable herd of eyeballs.

      I have said this before - anyone (Yahoo, HotMail, gmail, MS*) who has large numbers of mail boxes that people want to reach can be billed. How? By Signing outgoing mail you are certifying that _you_ have sent that mail - all yahoo has to do is count the number of mails signed by domain example.com and then autoforward a weekly/monthly bill to the email address in the whois system for domain example.com

      You say, never gonna happen, people won't pay, they won't get the billing email - it won't matter to Yahoo - they send bills, if they don't get paid they just blacklist that cert/domain.

      The big email box herders would have no reason to do this if Yahoo!DomainKey (tm) is widely deployed. If you disargee please explain why they wouldn't do it.

  • I'll believe it when I see it. (Score:5, Informative)

    by wayne ( 1579 ) <wayne@schlitt.net> on Wednesday September 08, 2004 @12:35AM (#10186462) Homepage Journal
    Dan Quinlan (of Spamassassin/ironport) has been working with Larry Rosen (a lawyer for OSI) and Eben Moglen (a lawyer for FSF) for months now. *VERY* little progress has been made, even when it was clear that SenderID would be at risk of not being advanced by the IETF to RFC status. I have *VERY* little hope that Microsoft will make the required changes to their license to be compatible with Free/open source software.

    Insight into the current situation can be found in a post by Matt Sergeant (Spamassassin/messagelabs):

    http://www.imc.org/ietf-mxcomp/mail-archive/msg040 45.html [imc.org]

    I pressed [Craig Spietzle of Microsoft]: "Will you fix the license?". I never really got a confirmed yes or no, but my feeling was "no" when we ended the conversation. I suggested that they give their IP to the IETF (such as I believe there is precedence of - I know that IBM has committed patents to the public domain before in a similar act of openness), to which I was told that Craig believed this was a reasonable idea, but that Bill Gates himself had vetoed that idea because of the current focus on patent gathering and IPR issues at Microsoft.

  • How about introducing a new MS record (not Microsoft ;-)) to point to Mail Senders? MX server(s) can continue to be the mail recepient(s). This gives the control to more distributed DNS system rather than a single company.

    Mail servers need to accept mails from a domain only if they are coming from the MS servers for that domain.

    This is not a novel idea. Most mail sersvers have a configurable feature to accept mails only from MX servers for that domain anyway.

  • I still haven't heard what's wrong with SPF. The only thing seems to be that a decision has to be made that `we' all support it. So if we just take that decision, at some point MS has no choice but to follow, putting them back where they belong, in the back seat.

  • What Microsoft is considering (Score:3, Insightful)

    by hopethishelps ( 782331 ) on Wednesday September 08, 2004 @04:32AM (#10187293)
    Could Microsoft be considering an Open Source license for Sender ID?

    I can't tell you what the worker bees at Microsoft are considering, but I can tell you what the movers and shakers at the top are considering. They're considering what course of action will do the most harm to the Free Software community in general, and people's perception of the GPL in particular. When they think they've figured out what that course of action is, they'll tell the troops to do it.

  • "Pink" contracts are the source of spam. (Score:5, Interesting)

    by GuyFawkes ( 729054 ) on Wednesday September 08, 2004 @06:19AM (#10187552) Homepage Journal

    All this talk of various new(?) protocols and tags is pure FUD and bullshit.

    spam can be eradicated (99%) in 48 hours, this was true years ago when I used to hang out on nanae and it is still true today, because 99% of spam originates from companies with "pink" (no AUP) connectivity / IP block contracts that typically pay the provider several times the market rate per IP / Gb of bandwidth.

    I could go out today and buy a block of 255 IP addresses on an OC3 and stick 72U of servers behind it sending out spam 24/7, and NOT lose my connectivity....

    Sure, it might suck if you have a close IP to mine and SPEWS lists the company that is providing connectivity to both you and me, but at the end of the day money talks.

    And at the end of the day there is more money in marketing (globally) than even bill g can dream of.

    _NOTHING_ short of an equivalent to the usenet death penalty (which is different because fuck all providers make 1 cent out of usenet, for 95% of them it is a loss making service bundled with http / smtp etc) SPEWS style will ever stop spam.

    As far as OSS goes as far as I can see there is only one way to make this work, and that is to use an electronic analogy of what I do at home.

    I get junk (snail) mail every day, lots of it comes with pre-paid return envelopes, most of it doesn't.

    The stuff advertising local firms tends not to have pre-paid envelopes, that national stuff tends to have pre-paid envelopes. So I sort my junk mail into local and national, takes about 3 seconds.

    The local stuff I just throw out into the street to blow around and litter the place, the residents get pissed off, the council gets pissed off, clear plastic bags containing samples of the litter get placed on council meeting tables and the companies whose names are on said bits of paper get a hard time from the council and everything from business rates increases to bills to clean up litter.

    The national stuff I just stuff into the prepaid return envelopes, just not the right envelopes, so each company gets an envelope full of some other companies junk mail, and pays for the postage.

    Result, I now get about 4 pieces of junk mail per week, it DOES work IF you work at it for a year or two.

    I see a similar thing in the OSS community as being the only solution, it takes a little bit of care to eliminate the joe-jobbed return addresses, but all you need is a spam filter that directs spam back to other spammers addresses, and if they have no smtp ports open then try to send it to them on port 80 every second for 24 hours.

    Yes I ___AM___ advocating DDoSing the cunts off the net, because when spam starts costing spammers money and denial of THEIR services they will stop, not before.

  • do NOT dance with this devil! (Score:3, Insightful)

    by tweedlebait ( 560901 ) on Wednesday September 08, 2004 @06:48AM (#10187671)
    We know already that SID doesn't comply in spirit with the internet we know and love.

    We know spammers are already lined up and using SID, so the system is already polluted. "ya want validated spam with that?"

    MS doesn't want OSS/Linux/etc. They have made that quite clear. Right now they need us to support this or the whole thing fails- or they start an apache war or something. MS has enough control already. IMHO they should have no say-so about my email.

    Some persons at ms are getting *paid* to deploy this successfully & quickly and they will try very hard to do so. This includes convincing everyone else to support it. (for free?) Hold the ropes boys and girls.

    Why would the OSS community care about supporting something that is IP encumbered by ms and in litigation, broken, basterdized, and infested with spammers already? err .. and its by our trustworthy future thinking pal microsoft.

    So IIRC if they flick the switch on this thing hotmail and msn will be crippled and only work with SID friendly systems. Boo Hoo. maybe hotmail users will complain to ms since they won't be able to complain to me!

    Look-- Every time ms does something like this eg: tcp/ip, kerberos, iis,ie,outlook, etc. it's a train wreck of decaying squid parts. Learn from the mistakes. If they need support for SID stall them:
    Tell them you'll put it on an Action List or you'll do it as soon as 'counsel gives you the green light'. Tell them you use drugs and therefore cannot be trusted with such thigs until rehab! or Just lie! They'll never expect it! Better yet make them believe it will soon be supported!

    Anyway I hereby claim my disgust and lack of support for sender id and beg all the developers working so hard on interesting things being bothered to support this to not waste their time and keep on inventing.

    Thank you.

Slashdot Top Deals

In the long run, every program becomes rococco, and then rubble. -- Alan Perlis

Close