Sender ID loses supporters

The move by the group responsible for the popular Apache Web server comes as other open-source developers also voiced reservations about Microsoft's attempts to apply stringent licence requirements to its contribution to the spam-fighting technology.

"We believe that the current licence is generally incompatible with open source, contrary to the practice of open Internet standards, and specifically incompatible with Apache License 2.0," the group wrote on Thursday in its letter to the technical committee working on the technology.

The criticism of the licensing requirements for the Sender ID standard were published in response to a request for opinions of the possible standards.

The request came from the chairpersons of the Internet Engineering Task Force (IETF) working group responsible for Sender ID, which is meant to block spam by confirming the source of an email. Dozens of others also contributed their comments, the overwhelming majority of which were critical of the new standard and Microsoft's attempt to place licence requirements on the specification.

"Microsoft's licence for patent claims made on Sender ID prevent (the specification) from being a standard in the open-source community," one member of the working group wrote in a posting titled "Motion to abandon Sender ID."

A Microsoft representative was not immediately available to comment on the issue.

Many of the licence provisions worry open-source developers. According to an analysis done by Larry Rosen, general counsel of the Open Source Initiative, Microsoft's Licence would require mail service providers incorporating Sender ID into their products to tell Microsoft about customers using it.

The software giant also has not informed the IETF of potential patents pending on the technologies, and the licence is not compatible with open-source development groups and requires users to be subject to US export control laws, the analysis stated.

Sender ID is a combination of two proposed standards that would create a system to positively identify whether the source address of an email message is the actual source of the message. One specification, Caller ID for Email, was proposed by Microsoft; the other, Sender Policy Framework (SPF), was proposed by Meng Wong, the founder of email service provider Pobox.com.

The use of Microsoft's technology in the standard means that the company can specify a licence that potential users have to agree to before using the code.

On Monday, Sendmail, developer of an open-source mail server, released a version of a module that could be added to any Sendmail server for Sender ID functionality in software.

While the module, called milter, is open-source, users may still have to agree to Microsoft's licensing restrictions. However, Sendmail's chief executive, David Anderson, said his company was not going to sign the licence agreement. Moreover, the company's lawyers do not think that anyone needs to.

"Microsoft has said that this is free, and it doesn't say that you need a licence for this technology," he said. "I can't figure out why I would want to sign this licence."

Microsoft has actively lobbied other companies to accept the Sender ID framework and its licence that would accompany the code. In August, the company collected more than 80 members of the Email Service Provider Coalition to tout the benefits of the anti-spam technology.

"This is a good tool," J. Trevor Hughes, executive director of the ESPC, stated in an email to the IETF working group. "The actions of the various parties involved are understandable and reasonable. The licence terms are workable and within the scope of IETF standards and history. And it will have a positive effect on our ability to reduce phishing and protect legitimate email."

Internet services firm VeriSign also signalled its support for the Sender ID specification in an email to the IETF.

"We see Sender ID as a good, easy-to-implement solution to stop email domain spoofing and an important first step towards truly authenticating the sending party," Bruce Ong, senior product manager for the company, wrote in the email.

VeriSign can sympathise with Microsoft's situation: the firm has also been accused of and sued for trying to co-opt parts of the Internet infrastructure with its Site Finder service, which redirected Web surfers to a VeriSign-branded search page if they mistyped a .com or .net Web address.

Despite these votes of support, open-source groups may be a harder nut to crack.

"As developers of open-source email technologies, we are concerned that no company should be permitted IP (intellectual property) rights over core Internet infrastructure," the Apache Foundation wrote, adding that "we will not be implementing support for Sender ID until such time, as the issues with the licence are fixed and acceptable".