Document revision: 0.1 - 4/14/2004
pardon my expedient html
http://www.andrew.cmu.edu/~poepping
From Joe St Sauver 4/14/2004
I would also suggest the following starting questions for discussion (you can tell I used to love writing exams for undergraduates in the old days): "1. SPF vs. Caller-ID vs. Domain Keys. "SPF, Caller-ID and Yahoo's Domain Keys all represent current efforts to control the use of email domains in mail headers, but all take a slightly different approach and have a slightly different emphasis. Which of the approaches do you prefer, and why? Do you see any way to synthesize/reconcile/combine these disjoint efforts into a common protocol that can be universally deployed? (For example, SPF can now query Caller-ID records as well as SPF records)" "2. Licensing "Some of the current proposals are proceeding via the normal IETF standards while others have potentially more restrictive licensing terms. Discuss the advantages and disadvantages to these two approaches. Is there risk that a licensed technology might be withdrawn by the owner of that technology, or be made subject to large charges? Is there risk that an open source licensing model might result in fragmentation and loss of critical mass?" "3. The Normal Abnormaility of Higher Education "In higher education, it is routine for faculty and others to run their own mail servers, use 3rd party commercial providers while travelling, forward their mail from one provider to another, and generally do lots of 'unusual' things by the standards of routine residential customers. Do any of these practices preclude deployment of Caller-ID, SPF or Domain Keys in your opinion?" "4. Asymetric Deployment. "A site could publish a Caller-ID record or an SPF record (or both), but not check the records that others may have published; similarly, the reverse case is also true: a site could check Caller-ID records or SPF records, but not publish their own. Do you see any issues or advantages to this sort of asymetric deployment strategy? If higher ed was forced to hypothetically choose between ONLY publishing their own SPF record (or caller-ID record), *OR* ONLY querying other folks records, which which be preferrable, and why?"