Konstantin Ryabitsev [off-list ref] writes:
This would require pretending that we're authorized to send mail from the
domain name of the commit author, so this unfortunately won't work (and hence
the reason why GGG does it this way). E.g. say you have:
From: foo@redhat.com
Subject: [PATCH] Fix foo
Would it help to use "Sender:"? When GGG or any other automation
are trying to send e-mail on behalf of the person shown on "From:",
I thought that it is the mechanism for them to use to identify
themselves.
On Wed, Dec 22, 2021 at 11:42:02AM -0800, Junio C Hamano wrote:
quoted
This would require pretending that we're authorized to send mail from the
domain name of the commit author, so this unfortunately won't work (and hence
the reason why GGG does it this way). E.g. say you have:
From: foo@redhat.com
Subject: [PATCH] Fix foo
Would it help to use "Sender:"? When GGG or any other automation
are trying to send e-mail on behalf of the person shown on "From:",
I thought that it is the mechanism for them to use to identify
themselves.
Indeed, that's how the DKIM standard wanted to deal with this problem, however
when the DMARC RFC was being drafted, this approach was deemed insufficient.
They have a good explanation for it -- there is no standard among UI clients
to handle the Sender/From discrepancy. Most MUAs will happily ignore the
Sender: field and will only show what is in From:, so this approach was
considered ineffective against phishing attacks. An attacker could easily
register a domain, set DKIM records, and then use any From: they wanted as
long as they used a valid Sender: header, knowing that it would be ignored by
most mail clients.
So, DMARC deliberately ignores the Sender: header and *only* pays attention to
the From: field for its purpose.
-K
Hi Junio,
On Wed, 22 Dec 2021, Junio C Hamano wrote:
Konstantin Ryabitsev [off-list ref] writes:
quoted
This would require pretending that we're authorized to send mail from the
domain name of the commit author, so this unfortunately won't work (and hence
the reason why GGG does it this way). E.g. say you have:
From: foo@redhat.com
Subject: [PATCH] Fix foo
Would it help to use "Sender:"?
You had suggested that before, and I explained why it does not work in
https://lore.kernel.org/git/nycvar.QRO.7.76.6.2008241445200.56@tvgsbejvaqbjf.bet/.
The gist is: GMail interferes with your cunning plan.
When GGG or any other automation are trying to send e-mail on behalf of
the person shown on "From:", I thought that it is the mechanism for them
to use to identify themselves.
Ciao,
Dscho