Subject: RE: Comments Re: [seamoby] ct problem statement

From: Phillip Neumiller <[email-masked]>
Date: Fri, 8 Jun 2001 10:03:09 -0400

Hi Allison,

I have a few questions

> -----Original Message-----
> From: Allison Mankin [mailto:[email-masked]]
> Sent: Friday, June 08, 2001 9:26 AM
> To: Gary Kenward
> Cc: 'seamoby'; [email-masked]; [email-masked]
> Subject: Re: Comments Re: [seamoby] ct problem statement 
> 
> 
> Security considerations in a draft express risks that a user or
> operator may encounter, to help guide the decision about whether to
> deploy the available technology (and also whether to deploy a 
> compliant 
> product rather than one that lacks security protections).

Wouldn't this same statement apply to everything on the Internet?
Why can't WGs that are not security specialists leave the security
issues to the security WG?  I don't understand this.  Why can't
all proposed standards get funnelled through the security WG before
they go to RFC?  I think there is lots of empire building and
wheel reinventing with respect to security in the IETF at this time.

Let me give a bizarre counter-example to illustrate my point. 
Suppose we reach the true age of wireless and almost everything is
connected with wireless routers and terminals.  Would we want every
IETF WG draft to have sub-sections on how to deal with wirelesss?
No we would hope that groups like MIP, SeaMoby, and MANET would
have solved those issues for us and that those issues would be
transparent to us.

If the IETF were a business, it would make more economic sense to
focus the experts in the security WG on the over arching security 
issues of the entire Internet rather than have fragmentation of
implementations popping up in every WG.  I guess I have a really
hard time understanding the motivation behind bogging every work
group down with security issues.

Thanks,

Phil

---

From: "Melinda Shore" <[email-masked]>
Date: Fri, 8 Jun 2001 10:22:32 -0400

> I guess I have a really

Down on the farm the policy is "when you open a gate,
close it behind you."  It seems to me that if you're
introducing security exposures in your protocols it's
your responsibility to deal with those exposures.

Also, there are domain security experts who can help
with specific security mechanisms or securing particular
types of application security environments.  "Security"
by itself is probably too broad a word to be meaningful
in discussing where responsibility for this stuff lies.

Melinda