Subject: Re: Re: how to declare consensus when someone ignores consensus

From: John Loughney <[email-masked]>
Date: Mon, 23 Jan 2006 6:26:07 +0200

> On 01/22/2006 22:27 PM, John Loughney allegedly wrote:
> > Look at various peer-to-peer protocols as a good
> > examples of things that people use everyday, but wouldn't stand a
> > chance of getting an RFC.
> 
> Why not?

Now we're close to side veering off into process issues, but rather than going into that rat-hole, I'll just pose a question: do you think p2p protocol authors would have any motiviation to create a Security Considerations section that would pass IESG review?

John

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Dave Crocker <[email-masked]>
Date: Mon, 23 Jan 2006 00:22:08 -0800

> Now we're close to side veering off into process issues, but rather than 
> going into that rat-hole, I'll just pose a question: do you think p2p 
> protocol authors would have any motiviation to create a Security
> Considerations section that would pass IESG review?

a security considerations section would be a breeze, compared to the 
pre-chartering hoops we regularly impose on new areas of work, especially any 
with a real security component, independent of prior work.

d/

-- 

Dave Crocker
Brandenburg InternetWorking
<http://bbiw.net>

---

From: "Anthony G. Atkielski" <[email-masked]>
Date: Mon, 23 Jan 2006 15:04:56 +0100

John Loughney writes:

> Now we're close to side veering off into process issues, but
> rather than going into that rat-hole, I'll just pose a question: do
> you think p2p protocol authors would have any motiviation to create
> a Security Considerations section that would pass IESG review?

Do you think that protocol authors would have any good reason to
submit anything for anyone's review, when the same time could be spent
writing software products?

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Mon, 23 Jan 2006 06:37:54 -0800

> Considerations section that would pass IESG review?

let's veer off... this is much more fun than other current discussions :-)

Since a major problem for "illegal" P2P networks at the moment is dealing 
with content that is inserted maliciously (the file named "Britney Spears' 
latest hit" that says "THOU SHALT NOT STEAL" in a thunderous voice), I 
think they have a large motivation for workable security models...... and I 
suspect that the Security ADs would LOVE to see documented a security model 
that has been proved to work in that environment.

so I think this particular point is a red herring. Cost of participation 
and patience with process may be bigger obstacles.

                  Harald

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 23 Jan 2006 11:38:52 -0500

In message <8F069763B60ED81B76567EBF@[10.21.114.126]>, Harald Tveit Alvestrand 

>that has been proved to work in that environment.

As a former Security AD, I can tell you that I have a research project 
going on some aspects of this.  Believe it or not, I think the issue is 
linked to BGP security.

The real problem in the Security Considerations, though, is the defense 
against subpoena attacks.

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb