Subject: [Ace] Charter Discussions

From: "Hannes Tschofenig" <[email-masked]>
Date: Tue, 28 Jan 2014 12:30:55 +0100 (CET)

Hi all, 

when I read through various comments then two observations come to my mind:

* Nitpicking, and 
* "I want my draft covered in the charter" mentality. 

Try to keep the bigger goal in mind but your most favorite optimization on the side for the moment. I understand that everyone wants to have their draft covered since this is the typical IETF style of working but also think about the wider IoT ecosystem, who should benefit from this standardization. 

Here is what I believe we try to accomplish collectively (not only with this work but with the IoT standardization in the IETF in general). 

For a long time we have been saying that Internet Protocols can be used in constrained devices. This was the community reaction based on what we had seen happening in the industry when everyone started to standardize and develop their own new IoT architecture. I think we still believe in that overall message. 

Having said that there is of course room for profiling of existing protocols to deal with the nature of IoT devices and different environments suffer from different limitations. Sometimes we talk about a device that runs on a battery, and sometimes we are facing devices with simplistic user interfaces. We have discussed these different constraints already in other groups before and the constraints vary from deployment to deployment.  

If we re-invent security protocols I believe we make a big mistake. It will take a lot of work, and it will even take much, much longer to get the rest of the industry convinced that they should be using it when the use of CoAP already requires a fair amount of marketing and outreach. Also, I have been observing that many of you do not know the state of the art as well as I would have hoped. Do your home work first before you write your draft. 

I would suggest to avoid tailoring every sentence in the charter and instead to focus on the bigger topics.
There are a few technologies to look at that can be re-used (with a bit of profiling, I have to admit):
 (1) Kerberos
 (2) OAuth 
 (3) Certificates

For the BOF I would like to see the group having a better understanding of how these technologies cover the use cases. I would also like to see more discussions on the use cases since they drive the technology in the end. If the use cases are wrong then the technology developed for them will very likely be unsuccessful. 

I will definitely challenge you guys whenever you come up with your own invention.

Ciao
Hannes