Subject: RE: [secdir] Please review draft-ietf-capwap-protocol-specification's use of certificates

From: "Erik Andersen" <[email-masked]>
Date: Mon, 7 Jan 2008 11:38:24 +0100

Hi,

I do not believe this is a question about a global directory or not.

I have the feeling that the term "X.500 theologists" is meant as a
disparaging term.

What about changing the terminology and replace the terms "X.500
theologists" and "pragmatists" with those wanting a clean design and those
that do not care.

During a long life working with IBM customers, I have too often seen hopeful
youngsters developing so-called pragmatic solutions that resulted in bad and
non-extensible designs. The result has been that more and more ice pilled up
in front of the project until it came to a grinding stop. So, I get a bad
feeling in my stomach whenever the word pragmatic is mentioned.

Erik Andersen
Andersen's L-Service
Mobile: +45 20 97 14 90
e-mail: [email-masked]
http://www.x500standard.com/
http://home20.inet.tele.dk/era/me

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> On Behalf Of Peter Gutmann
> Sent: 7. januar 2008 06:56
> To: [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]; ietf-
> [email-masked]; [email-masked]; [email-masked]; [email-masked];
> [email-masked]
> Subject: Re: [secdir] Please review draft-ietf-capwap-protocol-
> specification's use of certificates
> 
> 
> Steven Legg <[email-masked]> writes:
> 
> >One of the modes for accessing a directory is browsing up and down the
> >directory tree.
> 
> And when do people ever do this?  Google, one of the worlds biggest IT
> companies (?), made most of its fortune from the very fact that people
> don't
> do this.  When did Joe Sixpack last use an Internet directory, and when
> did
> they last use a non-directory Internet search engine?
> 
> (I'm guessing the answer is pretty close to "never" for the former, and
> "the
> last time they went online" for the latter).
> 
> >A common name like "Peter Gutmann's Visa Card" is much more informative
> than
> >the common name "1234 5678 9012 3456".
> 
> To whom is it informative?  In what possible context does anyone
> processing a
> credit card payment care in the remotest manner whether card "1234 5678
> 9012
> 3456" belongs to "Peter Gutmann" or "The Jolly Green Giant"?  All they
> care
> about is the card number and "authorised/declined".
> 
> (The very existence of anonymous prepaid credit cards prove that card
> processors don't care in the slightest about "Peter Gutmann's Visa Card":
> there's no name associated with the card at all since it has zero value to
> them).
> 
> How about the following compromise between X.500 theologists and
> pragmatists:
> The pragmatists agree to make all their DNs fully X.500 (well, X.520)
> compliant the moment the global X.500 directory emerges, and in exchange
> the
> X.500 theologists agree not to bother the pragmatists any more until the
> global X.500 directory emerges.
> 
> Peter.

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 7 Jan 2008 09:37:23 -0800

>I do not believe this is a question about a global directory or not.

The part of the design of X.509 that affects this question is 
definitely about a global directory.

>I have the feeling that the term "X.500 theologists" is meant as a

Correct. But...

>theologists" and "pragmatists" with those wanting a clean design and those

I have the feeling that the term "those that do not care" is meant as 
a disparaging term when compared to "those wanting a clean design". I 
believe that I want a clean design, and 15 years of IETF experience 
with X.509 certificates has shown that it is silly to try to limit 
the contents or use of the naming fields in those certificates. 
Everyone, often including standards bodies, stretch the naming until 
it becomes meaningless. A clean and honest view is to say 
"constraints on what kinds of names can go where have not worked".

>feeling in my stomach whenever the word pragmatic is mentioned.

Maybe the same is true for "clean design".

--Paul Hoffman, Director
--VPN Consortium