Subject: Re: Last Call: <draft-farrell-perpass-attack-02.txt> (Pervasive Monitoring is an Attack) to Best Current Practice

From: Abdussalam Baryun <[email-masked]>
Date: Wed, 1 Jan 2014 15:37:00 +0100

On 1/1/14, Russ White <[email-masked]> wrote:
.....
> The fact is that the IETF has designed a suite of protocols that are mostly
> unsecure, and widely used in a world where we're just starting to see the
> importance of security around not only your credit card number, but also
> your address book. That the IETF should make a statement saying, "we seem
> to
> have something backwards here, and it's about time we reverse our
> assumptions," isn't a political statement at all -- it's a facing of
> reality.

I agree, but we should not rush the document to IESG until we get
strong agreements from community. I commented before that the document
should be informational not BCP, becasue it should be saying as you
say, Hay we now thought about it and we think this is what we will do.
Refering why I feel some politics, is if some people still want it as
BCP with quick process even with some disagreements, then I think the
draft became political now.

> That the facing of reality has come about through any particular
> political situation shouldn't imply that the statement is generally
> political -- reacting to a political situation with a statement of a change
> in policy isn't a political reaction, nor even (necessarily) a reaction
> against the politics. Rather, it's just saying, "hey, we didn't think about
> this problem before now, but now that we've thought about it, we need to
> set
> some new goals."

I agree with you only if the draft is a statement but IMHO it is not
only statement (its unclear practical statement), therefore, this
document should be informational and not BCP, do you agree?

>
> Don't confuse the on list argument about politics with the actual point of
> the draft; they're two different things entirely.

I know they are different but the authors of the document still have
it as BCP and they are not clear of how this document will be *used*.

>
> Anyway, that's my 2c. I've read the opposing arguments, and I'm still in
> support of this draft.

So if you support, could you just state directly how this document
will be used? I understand from your message and support that you mean
I support that it is giving statement-information that we the IETF
will plan for future goals and practices, and the information will be
used to start works to find solutions, but not used into the current
IESG document review process because we still have no clear
directions.

AB

---

From: "Russ White" <[email-masked]>
Date: Wed, 1 Jan 2014 10:20:16 -0500

> I agree with you only if the draft is a statement but IMHO it is not only
> statement (its unclear practical statement), therefore, this document
should
> be informational and not BCP, do you agree?

The difference, to me, is between saying:

- We'd really like to tell people about this.
- We're laying a foundation to do something in this space.

So, how do I think this document will be *used?*

As a starting point. I've recommended some specific thoughts on questions to
draft authors to include in another email. I don't think these are the
"final" questions, nor do I think they need to be included for this initial
version to go to BCP -- so long as we understand this is a goal statement
which will have more information added in the bis and update processes.
Since our knowledge of this space will naturally grow over time, I suspect
this document will change over time, just as id-nits, security requirements,
and other such documents have.

There might be a lot of other "better ways," to go about this -- start a WG,
etc. -- but this is the immediately apparent vehicle for the moment. So
given the choice of doing nothing, "because we don't have a detailed
accounting of everything we'd like to do," or, "because this is political,
rather than technical," and passing this document into BCP status so a
conversation is started, and we think about the right direction from here --
I'd rather pass this document into BCP status so we can think about the
right direction to go from here.

Russ