Subject: [http-auth] BOF Status

From: Sean Turner <[email-masked]>
Date: Wed, 26 Sep 2012 13:31:56 -0400

BOF Status: Approved

Three tidbits of information I'd like to share:

1) More than one person on the BOF coordination call (IESG/IAB) asked to 
keep the bar low to publish.  So we should keep this in mind.

2) The big concern was what chance there is for deployment.

3) "-" in BOF/WG names causes problems.  We just struck the hyphen so 
it'll be called httpauth.  We'll keep the same mailing list though.

Questions for the chairs/group: Do we need MeetEcho or WebEx?  Does ~100 
folks showing up seem about right?

Okay, it's time to develop and agenda and line up presenters.  As a 
start, might I suggest:

Agenda Bashing
Problem Statement
Candidates (and keep this short)
Charter hack

spt

---

From: Nico Williams <[email-masked]>
Date: Wed, 26 Sep 2012 13:45:44 -0500

> keep the bar low to publish.  So we should keep this in mind.

How does this relate to some of the comments I had on the proposed charter?

> 2) The big concern was what chance there is for deployment.

The chances of deployment in the enterprise are substantially higher
than on the Internet, IMO.  I say this based on what my peers in the
enterprise IT world tell me (they suffer HTTP/Negotiate's pain points,
and they badly want to do something about these).

On the Internet it all depends on... too many things:

 - browser support
 - IdP support
 - federations

> 3) "-" in BOF/WG names causes problems.  We just struck the hyphen so it'll
> be called httpauth.  We'll keep the same mailing list though.

Sure.

> folks showing up seem about right?

If the date of the BoF is solid I may well fly in.

> Okay, it's time to develop and agenda and line up presenters.  As a start,
> might I suggest:
>
> Agenda Bashing
> Problem Statement

Sounds good for a start.  I'm not sure that we want to spend too much
time on candidates.  I'd rather spend time on higher-level aspects of
candidates than on details.

Nico
--

---

From: Sean Turner <[email-masked]>
Date: Wed, 26 Sep 2012 16:06:47 -0400

> How does this relate to some of the comments I had on the proposed charter?

Comments from you and Harry are at the head of the line to get resolved. 
  But, I submitted what I sent to the list.  No slight intended it's 
just that I didn't want to be the one judging whether they ought to be 
accepted or not.  It's time for the chairs to take the reins at this point.

> On the Internet it all depends on... too many things:

Agreed.

> If the date of the BoF is solid I may well fly in.

We ought to know by Oct 12 (he says crossing his fingers).

> candidates than on details.

Exactly my thinking.  We've seen many of them before.

spt

---

From: Nico Williams <[email-masked]>
Date: Wed, 26 Sep 2012 16:07:32 -0500

> We ought to know by Oct 12 (he says crossing his fingers).

What I meant was: once the date is set, please don't change it.  I
can't spare a whole week to IETF meetings nowadays, so if the BoF
might remotely get rescheduled then I'd rather participate remotely.

Nico
--

---

From: Yoav Nir <[email-masked]>
Date: Wed, 26 Sep 2012 23:41:18 +0200

Hi Sean

> keep the bar low to publish.  So we should keep this in mind.

Makes sense. The proposed charter talks about informational and experimental. If the (proposed) WG rejects them, they can get a similar result through an individual submission or the independent stream. Still, even with a low bar, we should insist on document quality - readable, understandable, proper security considerations, etc.

> 2) The big concern was what chance there is for deployment.

Yes, and I'm wondering if we're going to have in the room somebody who could talk knowledgeably about this. Ideally she'd say "I work for this bank, and we would deploy a secure HTTP auth method if these requirements were met". Failing that, we can make do with "I work for Google, and the UI people tell me we might use this on GMail if …". We don't have a lot of bank employees around, but we do have some Google employees, and some consultants. If one of them is willing to talk (and maybe even write a requirements draft) about this, I think we should spare a slot for them.

> folks showing up seem about right?

I have a feeling that this would be a repeat of the REPUTE BoF. Fixing HTTP authentication got about 150 people in the room when Yukata Oiwa held a bar BoF. I think we should aim higher.

> Candidates (and keep this short)

Assuming we can't get someone who can talk about UI considerations, this sounds good to me. Please add websec to the list of conflicts to avoid.

Yoav

---

From: Sean Turner <[email-masked]>
Date: Wed, 26 Sep 2012 20:23:46 -0400

> Makes sense. The proposed charter talks about informational and experimental. If the (proposed) WG rejects them, they can get a similar result through an individual submission or the independent st…

I mean we're not going to let just anybody through ;) So I agree.  I 
also want to avoid an instance where the document authors just bash each 
other about whether their drafts get over the bar.

> Yes, and I'm wondering if we're going to have in the room somebody who could talk knowledgeably about this. Ideally she'd say "I work for this bank, and we would deploy a secure HTTP auth method if…

We've ensured there will be no conflicts with any SEC WG or BOF, all of 
Barry's App WGs (core, httpbis, bybi, imapmove, scim, sieve, urnbis, and 
websec), and rtcweb.  Hopefully, we'll get somebody who make a browser 
to show up ;)

Please feel free to fire around messages to WGs where you think folks 
might be interested (i.e., do shameless PR).

> I have a feeling that this would be a repeat of the REPUTE BoF. Fixing HTTP authentication got about 150 people in the room when Yukata Oiwa held a bar BoF. I think we should aim higher.

Ack I'll up the #.

> Assuming we can't get someone who can talk about UI considerations, this sounds good to me. Please add websec to the list of conflicts to avoid.

Done.  Like I said feel free to start beating the drum and finding those 
who are interested.

spt

---

From: Yutaka OIWA <[email-masked]>
Date: Thu, 27 Sep 2012 10:10:10 +0900

Thank you, Sean!

Regarding the schedule, anytime is Ok for me because
I plan to be in IETF for the whole week.
However, knowing the schedule any earlier will contribube
for inviting as many people as possible.

2012/9/27 Sean Turner <[email-masked]>:
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

-- 
Yutaka OIWA, Ph.D.              Leader, Software Reliability Research Group
                             Research Institute for Secure Systems (RISEC)
   National Institute of Advanced Industrial Science and Technology (AIST)
                     Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]

---

From: Sean Turner <[email-masked]>
Date: Wed, 26 Sep 2012 21:25:11 -0400

I'll see what I can do about keeping it in place one the schedule is 
announced.  This is usually means everybody puts in their clashes 
correctly and the ADs don't miss any ;)

spt