Subject: [therightkey] Review of draft-laurie-pki-sunlight-03: point 2

From: Ben Laurie <[email-masked]>
Date: Mon, 17 Dec 2012 16:51:48 +0000

> (2) abstract: "domain owners or their agents" makes it sound
> like I might have to pay to monitor; be good to re-assure that
> no such constraint is planned. (Such re-assurance doesn't need
> to be in the abstract, arguably not even in the draft, but
> also arguably ought be somewhere.) While its none of the
> IETF's business who charges for what in general, in this case,
> where there has been ongoing negative comment on the impact of
> PKI business models on Internet security, I do think it'd be
> good for the authors of proposals to be clear how they think
> they're affecting such charging issues.  Personally, I guess
> that since EFF and some academics have been able to afford to
> populate large databases of TLS server certs, this shouldn't
> become a huge barrier, but it could in principle impose new
> subscription costs or constraints on TLS servers or even
> clients and that might not be a good plan.

Well, a log isn't much use unless it is public - but I don't really
know how to say much about who charges for what. We can state our
intent to run free services, but presumably not in an RFC. So ... I
don't really know how to address this.

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 17 Dec 2012 17:03:01 +0000

> don't really know how to address this.

Yeah that's fair I guess. Maybe if it said that the intent
of the RFC is that logs be public & open and SHOULD NOT require
subscriptions or authentication for basic operation?

S.

> _______________________________________________
> therightkey mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/therightkey
> 
>

---

From: Ben Laurie <[email-masked]>
Date: Mon, 17 Dec 2012 17:08:10 +0000

> subscriptions or authentication for basic operation?

Surely we can't make that kind of thing normative?

Perhaps an indirect route would be to make a requirement on
replication of data, e.g "logs MUST NOT impose any conditions on
copying of their data", which would have a GPL-like effect of driving
the price to zero for public logs? In any case this seems like a
sensible thing to require!

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 17 Dec 2012 17:11:19 +0000

> Surely we can't make that kind of thing normative?

I guess it you can try say anything:-)

I wonder what DNS RFCs say or maybe we all just take it
for granted.

> sensible thing to require!

Something down that road should be good. Might need some inventive
language though.

S.

---

From: Ben Laurie <[email-masked]>
Date: Mon, 17 Dec 2012 17:52:41 +0000

> I wonder what DNS RFCs say or maybe we all just take it

DNS isn't free, so not sure what we take for granted?