Subject: Re: [RPSEC] Discontiguous Deployment...

From: [email-masked]
Date: Mon, 24 Jul 2006 14:24:38 -0400 (EDT)

Russ White said:

>>> Should there be a requirement that any proposed security
>>> system must be
>>> useful even if deployed in a noncontiguous way? Or should
>>> this not be a
>>> requirement?
>
>After waiting a couple of days for this to settle down, we have:
>
>o In favor: Tony Li, Bora, Blaine, Cat
>o Against: Sandy

I seem to have confused my message in too many words.

I am DEFINITELY IN FAVOR of incremental, non-contiguous deployment.

I am hoping to convince people that communicating security info 
through non-security-aware ASs should be allowed, i.e., no
requirement against it.  

I am AGAINST stating a requirement for "useful"-ness of a 
solution, because I do not believe that we have any way to 
characterize "useful".  Stating a requirement for something
we can not measure is a bad idea.

Furthermore, I read Tony's, Bora's, Blaine's and Cat's comments as
supporting a requirement for incremental, non-continguous 
deployment, NOT as supporting a requirement for "useful"-ness 
in non-continguous deployment.  (Perhaps they also saw no way 
to describe "useful" for a security solution.)

Bora's one message in particular was short and sweet.

>>From the beginning of the draft, incremental, non-contiguous
>deployment was a requirement.
>
>And IMHO, it should remain so.
>
>Bora

No mention of usefulness there.

If Tony, Blaine, Bora and Cat intended to indicate support for
requiring solutions be "useful" in non-contiguous deployment, they 
can/should say so now.

I had noticed that some responses were not answering the question
as stated.  I guess I should have spoken up before.

>Perhaps we should agree to make it a "SHOULD?," and figure how to word
>such a beast? 

If the wording still says "useful", making it a SHOULD doesn't help.

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: "Tony Li" <[email-masked]>
Date: Mon, 24 Jul 2006 11:55:29 -0700

> to describe "useful" for a security solution.)

I'm very happy to have a requirement that a non-contiguous deployment be
"useful" while simultaneously recognizing that "useful" is a matter of
judgement and perspective.

Any such requirement should definitely be a case of restating the
obvious, since any 'solution' failing to meet the requirement would, by
definition, be useless.  ;-)

Tony