Apache Rejects Sender ID Proposal

The Apache Project has rejected the Sender ID proposal for e-mail user authentication, saying the terms of Microsoft's license for the underlying technology makes it incompatible with open source software. The decision illustrates how anti-spam efforts have become the latest battleground between the open source community and Microsoft.

Apache's decision, outlined in a letter to the Internet Engineering Task Force (IETF), culminates weeks of discussion among the IETF, Microsoft and open source advocates over whether Sender ID could work as a standard framework for anti-spam measures.

"The current Microsoft Royalty-Free Sender ID Patent License Agreement terms are a barrier to any (Apache) project which wants to implement Sender ID," Apache chairman Greg Stein said in the letter. "We believe the current license is generally incompatible with open source, contrary to the practice of open Internet standards, and specifically incompatible with the Apache License 2.0. Therefore, we will not implement or deploy Sender ID under the current license terms."

The decision also affects Apache's widely-used SpamAssassin filtering software. Apache is the most widely-used server software, running on 67 percent of all web-facing hostnames.

Sender ID was formed June 24 when Microsoft and POBox co-founder Meng Weng Wong announced they had merged competing spam-fighting proposals into one specification. Microsoft's Caller ID for Email and the Sender Policy Framework (SPF) developed by Wong had been two of the leading proposals for fighting spam by verifying the address of an e-mail sender.

Microsoft's patents were an immediate problem for open source community. Free Software Foundation founder Richard Stallman called the Sender ID proposal "an example of Microsoft's strategy for killing off free software as an alternative to Windows."

"Microsoft's Sender-ID license is directly incompatible with free software regardless of which free software license is used," Stallman wrote. "I've been expecting to see something like this ever since Gates started talking about spam. ... In the absence of resistance, Microsoft has a good chance of imposing whatever standards it likes. Let us, therefore, resist it here and now."

In addition to Microsoft and the SPF developers, Sender ID has gained the backing of many large service providers, including Go Daddy, Symantec, VeriSign and America Online. "AOL is pleased to see the merger between these two proposals, which will help provide enhanced identity in e-mail. We are glad the new standard is fully backwards-compatible with the existing SPF, which is in use by tens of thousands of domains on the Internet already," said Carl Hutzler, director of Antispam Operations at AOL.

Patented technologies have been included in numerous IETF standards. The group's position on intellectual property is that companies submitting proposals to IETF should disclose any patents and make the technology available to others on "reasonable and non-discriminatory terms." A 2003 effort to keep standards free of patented technologies was defeated.