Subject: Oauth blog post

From: Yaron Sheffer <[email-masked]>
Date: Sun, 29 Jul 2012 15:52:07 +0300

Hi,

this blog post ( 
http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell/) by the 
editor of OAuth 2.0 made the rounds of the geek news outlets: Slashdot, 
CNet etc. I am sure many people on this list have seen it. But I have 
seen no reactions on this list, nor on the SAAG list. Is this too 
unimportant to discuss? Is there nothing we, as an organization, can 
learn from it?

Thanks,
     Yaron

---

From: Randy Bush <[email-masked]>
Date: Sun, 29 Jul 2012 08:12:49 -0700

http://www.scifac.ru.ac.za/cspt/hoare.htm

---

From: SM <[email-masked]>
Date: Sun, 29 Jul 2012 08:20:03 -0700

Hi Yaron,
At 05:52 AM 7/29/2012, Yaron Sheffer wrote:
>this blog post ( 
>http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell/) 
>by the editor of OAuth 2.0 made the rounds of 
>the geek news outlets: Slashdot, CNet etc. I am 
>sure many people on this list have seen it. But 
>I have seen no reactions on this list, nor on 
>the SAAG list. Is this too unimportant to 
>discuss? Is there nothing we, as an organization, can learn from it?

OAuth2 is more within Apps than SAAG.  People 
discuss about topics they are interested instead 
of what you or I would consider as important.  I 
don't know whether the IETF learns anything from 
its failures.  It can always redefine failure so 
that it becomes known as success. :-)

It is to Eran's credit that he did not seek all 
the credit when he could have done so.  What I 
could learn from that is that "doing the right 
thing" will be forgotten when it is convenient to 
do so.  The WG Chairs did something unusual to 
try and resolve the situation.  That's in the 
mailing list archive for anyone to read if the 
person thinks that it is important.

I'll highlight the following:

   "[the] working group at the IETF started with 
strong web presence. But as the
    work dragged on (and on) past its first year, 
those web folks left along with
    every member of the original 1.0 community. 
The group that was left was largely
    all enterprise… and me."

It's not the first time that this occurs.  It is 
up to the IETF to assess whether it is detrimental to have such an outcome.

Regards,
-sm

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 29 Jul 2012 12:19:13 -0700

Just a minor comment on this one: 

On Jul 29, 2012, at 8:20 AM, SM wrote:

>  "[the] working group at the IETF started with strong web presence. But as the
>   work dragged on (and on) past its first year, those web folks left along with
>   every member of the original 1.0 community. The group that was left was largely
>   all enterprise… and me."

The IETF allows open participation and, as such, everyone, including companies that develop enterprise software, are free to participate in the discussions. 

Do you think open participation is wrong?

---

From: Glen Zorn <[email-masked]>
Date: Mon, 30 Jul 2012 03:17:48 +0700

> Do you think open participation is wrong?

Do you think that corporate domination of "open" standards development
is OK?

---

From: "Worley, Dale R (Dale)" <[email-masked]>
Date: Sun, 29 Jul 2012 16:18:40 -0400

Watching a play starting with the third act is always interesting but not informative.

If there's a dispute worthy of attention by the *whole IETF membership*, could someone please summarize it (in a reasonably unbiased way) to bring the rest of us up to speed?

Dale

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 29 Jul 2012 13:28:12 -0700

> 
> Do you think that corporate domination of "open" standards development is OK?
> 

The barrier for participation is low since there are no membership fees, etc. Nevertheless, those who participate in standardization efforts have to spend their time. So, typically those who participate for a longer period of time need to have some incentives. These incentives often come from working for a specific company.

We cannot force anyone to participate in any of our working groups. In the OAuth case we have lots of other people participating but they typically ask questions and provide implementation feedback rather than trying to steer the standardization work. 

Ciao
Hannes

PS: Eran was also working for a big corporation, namely Yahoo. I could imagine that Yahoo also had some incentives to pay Eran for his participation in this work.

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 29 Jul 2012 13:35:44 -0700

Eran, the editor of a specification in the OAuth working group, had decided to step down from his editor-role because the group did not agree with certain design decisions (particularly with a security design decision). That happens also in other groups. Nothing uncommon so far. 

He then wrote a blog post about his decision and made various claims about lack of interoperability, etc.  
This blog post got picked up by the media and various people (who have in many cases not been involved in the IETF OAuth group) turned it into bashing the IETF overall.

---

From: Yoav Nir <[email-masked]>
Date: Sun, 29 Jul 2012 23:37:27 +0300

> Do you think that corporate domination of "open" standards development is OK?

Hi

Like Dale, I haven't followed the play throughout the life of OAuth (the working group)

Who are these corporations that dominate the working group?  Are they content providers like Facebook, Twitter, or Disney?  Are they ISPs? Is it General Motors?

If they are the people who are supposed to use these standards, their participation is a good thing. I wish we had more users (corporate or others) in the Security Area. So who are they?

Yoav

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 29 Jul 2012 13:50:45 -0700

Hi Yoav, 

> Like Dale, I haven't followed the play throughout the life of OAuth (the working group)
Barely anyone has done that. 

> Who are these corporations that dominate the working group?  Are they content providers like Facebook, Twitter, or Disney?  Are they ISPs? Is it General Motors?

Eran claims that enterprise identity management equipment manufacturer dominate the discussion. 

> 
> If they are the people who are supposed to use these standards, their participation is a good thing.

Getting everyone who writes Web applications involved in the standards process is "a bit difficult". 
If you look at the mailing list you see a mixture of small and big companies involved. 

> I wish we had more users (corporate or others) in the Security Area. So who are they?
The OAuth group is more a consumer of security expertise rather than the source. 

Ciao
Hannes

---

From: Glen Zorn <[email-masked]>
Date: Sun, 29 Jul 2012 13:52:00 -0700

On Sun, 2012-07-29 at 23:37 +0300, Yoav Nir wrote:

...

> Who are these corporations that dominate the working group?  

The particulars are immaterial.  The question was as general (& I
suppose, philosophical) as Hannes'.

> Are they content providers like Facebook, Twitter, or Disney?  Are they ISPs? Is it General Motors?
>

---

From: "Worley, Dale R (Dale)" <[email-masked]>
Date: Sun, 29 Jul 2012 17:13:07 -0400

> From: Hannes Tschofenig [[email-masked]]
> 

There's a common problem in the IETF that the development of a standard is dominated by companies that incorporate the standard into their products, whereas the people who "really should" be involved in the development are those who will *use* the standard in operation.

Dale

---

From: Glen Zorn <[email-masked]>
Date: Sun, 29 Jul 2012 14:02:20 -0700

On Sun, 2012-07-29 at 13:28 -0700, Hannes Tschofenig wrote:

> The barrier for participation is low since there are no membership fees, etc. 

For participation, yes, all that is needed is an email account; if one
wishes to attend meetings (just the main ones - let's ignore interims),
the bar rises considerably.  The chances of dominating a WG or attaining
a leadership position in the IETF are very close to zero without meeting
attendance.  I spend about 10% of my gross income on travel, meeting
fees, etc. for IETF meetings; I don't consider that to be trivial.  

> Nevertheless, those who participate in standardization efforts have to spend their time. 

And somebody's money: I spend about 10% of my gross income on travel,
meeting fees, etc. for IETF meetings; I don't consider that to be
trivial. 

> So, typically those who participate for a longer period of time need to have some incentives. These incentives often come from working for a specific company.
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 29 Jul 2012 14:52:33 -0700

I certainly agree that the participation in the face-to-face meetings is indeed more costly. For leadership positions (as you call them) such participation is indeed important. 

On Jul 29, 2012, at 2:02 PM, Glen Zorn wrote:

> For participation, yes, all that is needed is an email account; if one wishes to attend meetings (just the main ones - let's ignore interims), the bar rises considerably.  The chances of dominating a WG or attaining a leadership position in the IETF are very close to zero without meeting attendance.  I spend about 10% of my gross income on travel, meeting fees, etc. for IETF meetings; I don't consider that to be trivial. 
>> 
> And somebody's money: I spend about 10% of my gross income on travel, meeting fees, etc. for IETF meetings; I don't consider that to be trivial. 
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 29 Jul 2012 14:57:14 -0700

It sounds indeed great to involve those communities that use the technology. However, I don't see an easy way to accomplish that when we talk about a really large community. 

For example, many people use TLS and they are not all in the TLS WG working group. I am not even talking about providing useful input to the work (since you would have to be a security expert and some people just want to get their application development done as quickly as possible). They just use the library. 

OAuth is a bit similar in that direction. Ideally, we want Web application developers to just use a library and then add their application specific technology on top of it rather than having to read the IETF specification and to write the OAuth code themselves.

---

From: Tim Bray <[email-masked]>
Date: Sun, 29 Jul 2012 20:00:48 -0700

I have not been involved in the OAuth design processes, but for the
last few months, I’ve been a heavy user of production OAuth2 software.
Which I felt gave me a platform to comment  on the issue:
http://www.tbray.org/ongoing/When/201x/2012/07/28/Oauth2-dead

 -Tim

---

From: SM <[email-masked]>
Date: Mon, 30 Jul 2012 10:21:48 -0700

Hi Hannes,
At 12:19 PM 7/29/2012, Hannes Tschofenig wrote:
>The IETF allows open participation and, as such, everyone, including 
>companies that develop enterprise software, are free to participate 
>in the discussions.
>

It depends on what open participation means in the above.  If it is 
open participation by companies, I don't have any problem with it as 
long as the relevant BCPs are updated to reflect that.

At 11:14 AM 7/29/2012, Tschofenig, Hannes (NSN - FI/Espoo) wrote:
>I would find it useful if anyone of you who likes to agree or 
>disagree to have at least read the OAuth specification. I had 
>noticed that many of those who share their valuable thoughts have 
>not even spent the time to look at the document.

I wonder whether I read the OAuth2 specifications. :-)

Regards,
-sm