Subject: Re: Oauth blog post

From: Yaron Sheffer <[email-masked]>
Date: Mon, 30 Jul 2012 00:39:45 +0300

Trying to step away from the "big vendors vs. users" discussion...

I admit I have not followed events in the oauth WG, but I did read 
Eran's post and his own follow-on comments, plus some others' who were 
burnt by our processes. Some may want to construe it as "IETF bashing", 
but what I'm reading is three concrete statements that IETF members can 
respond to, and (if we accept them as true) consider how to address in 
the future:

- A Web-focused protocol was forced to adopt enterprise use cases.
- The Security Area did not do a good job of providing the protocol with 
useful review/feedback/support. (The original wording is much harsher).
- The third statement is a cliché as far as SDOs, but we still need to 
face it: simple protocols coming into the IETF are made complex, 
sometime too complex, in the process.

Thanks,
     Yaron

PS: some background: OAuth is an important Web security protocol, very 
widely used (Wikipedia link here). The blog post was written by the 
person who has led (or co-led) the protocol for years, and actually 
brought it into the IETF.

---

From: "Worley, Dale R (Dale)" <[email-masked]>
Date: Mon, 30 Jul 2012 00:10:57 -0400

> From: Yaron Sheffer [[email-masked]]
> 
> [...] but what I'm reading is three concrete statements that IETF
> members can respond to, and (if we accept them as true) consider how
> to address in the future:
> 
> [...]

My first impulse is to say, yes, protocols that solve "enterprise"
problems are a lot more difficult than ones that solve individual-user
problems.  One that showed up in my field (SIP) was the concept of
"securely" identifying the party you have called.  If I normally call
John Smith at my bank to do business, and if John Smith is replaced at
his job by another person, and I call "John Smith at the bank", should
I authenticate that I am talking to John Smith, or should I
authenticate that I am talking to the person who holds the job at the
bank that John Smith used to have?

> Tim bray writes in an essay:
> 
> Enterpriseyness · One of Eran’s central gripes is the immense
> difficulty of knitting "Enterprise" requirements into OAuth — or any
> other standards work, for that matter. He’s right. The Web use cases
> may not be easy to solve, but they’re easy to understand. [...]
> 
> On the other hand, whenever I get into a conversation with someone on
> the Enterprise side, even when I think I understand the problem
> domain, I lose the plot, and fast. The requirements these people claim
> to have around both authentication and authorization are so arcane and
> subtle and legacy-laden that you have to be a full-time professional
> to even understand them.

Which reminds me that large organizations have the problem that every
new activity is necessarily a small change on a monstrous base of
current systems, and has to work harmoniously with them.  As someone
once observed:

> The reason God could create the Universe in six days is that He didn't
> have to make it upward compatible.

Dale