Subject: Re: [HASMAT] moving forward - WG name

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 01 Sep 2010 16:30:39 -0600

On 8/23/10 10:28 AM, Marsh Ray wrote:

> Personally, I think the current name is pretty awesome.

Thanks -- generation of catchy acronyms is one of my core competencies.
Some would say it's the only one. ;-)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 01 Sep 2010 16:38:49 -0600

On 8/31/10 2:42 PM, Brandon Sterne wrote:
> On 08/20/2010 11:08 AM, Peter Saint-Andre wrote:
>> Following up on the successful BoF we held in Maastricht, I'd like to
>> keep us moving toward formation of a working group. Here are some open
>> tasks:
> 
> Thanks, Peter, for keeping the ball rolling here.
> 
>> 2. Charter. We had some feedback at the BoF about charter revisions,
>> especially focusing on the three drafts under immediate consideration
>> and removing the text about developing a long-term framework for web
>> security.
> 
> Not being present at the BoF, I missed the discussion about removing the
> creation of a long-term security framework. 

A recording can be found here:

http://www.ietf.org/proceedings/78/

> If the group focuses on
> standardizing a small set of security mechanisms won't it be
> contributing to the "sprinkling" problem in the first part of the
> Objectives and Scope section?

Sort of. :)

As I recall, the objection was that we were making big promises and not
delivering, so either don't make big promises or else deliver mainly on
the big promises (but that's a large task and one that's not yet well
defined, thus perhaps leading the IESG to worry about scope creep).

>> 3. Name. Some people have said that "HASMAT" isn't very descriptive of
>> the subject matter, and that we might want something like "WEBSEC". As
>> long as folks don't think "WEBSEC" means that we'd be working on
>> everything under the sun related to the security of the web, I'd be fine
>> with a name like that. Other suggestions are welcome.
> 
> Personally, I do think WEBAPPSEC is the right name.  Someone pointed out
> that webappsec.org is registered already, but that space is occupied by
> the Web Application Security Consortium who generally go by the acronym
> WASC.  Other than the domain issue, is this still a problem?

The Secretariat strongly prefers (close to mandates) acronyms that are
at most 8 characters. Database and other tooling issues ensure if we try
to use longer acronyms.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Tobias Gondrom <[email-masked]>
Date: Thu, 02 Sep 2010 18:26:18 +0100

> at most 8 characters. Database and other tooling issues ensure if we try
@Brandon: I agree with Peter on the length of the WG name. (after all
its a technical short name, the WG scope is defined in the charter). So
far a couple of people suggested websec, which would be very close to
your proposal.
May I ask, how do you think about that name? Do you see strong reasons
against it compared to webappsec?

Greetings, Tobias

---

From: Brandon Sterne <[email-masked]>
Date: Thu, 02 Sep 2010 12:09:27 -0700

> against it compared to webappsec?
I, personally, can live with "WEBSEC" and was unaware of the name length
constraints.  Mnot's "HTTPSEC" isn't bad either.

-Brandon

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 02 Sep 2010 13:11:19 -0600

> constraints.  Mnot's "HTTPSEC" isn't bad either.

Naming matters because folks might expect that the work could expand to
fill the space allotted. Might this group someday (after other work is
completed and after rechartering etc.) be interested in all things HTTP
security, e.g., proposals for new authentication methods? The "HTTPSEC"
and "WEBSEC" names are fairly broad.

In any case, more pressing is the issue Barry brought about getting the
charter right, especially with respect to the framework objectives.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 02 Sep 2010 13:16:49 -0600

On 8/23/10 4:50 AM, Kai Engert wrote:
>  On 20.08.2010 20:08, Peter Saint-Andre wrote:
> "websec" sounds indeed very general, while the meaning of "hasmat"
> focuses on a smaller subset.
> 
> I wanted to propose "WebAppSec", but there's already
> http://www.webappsec.org/

That's a good group to reach out to. :) Is anyone here involved with
those folks? Are there other such groups to be aware of?

> What about HTSEC ? (hypertext security)

It's easier to pronounce than "HTTPSEC", that's for sure.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "Steingruebl, Andy" <[email-masked]>
Date: Thu, 2 Sep 2010 13:37:28 -0600

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Peter Saint-Andre
> Sent: Thursday, September 02, 2010 12:17 PM
> To: Kai Engert
> Cc: [email-masked]
> Subject: Re: [HASMAT] moving forward
> >
> That's a good group to reach out to. :) Is anyone here involved with those
> folks? Are there other such groups to be aware of?

One of the Officers/Founders sits practically next to me.  I can definitely check with the WASC folks if they are concerned about the name.

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 02 Sep 2010 16:20:51 -0600

On 9/2/10 1:37 PM, Steingruebl, Andy wrote:
>> -----Original Message----- From: [email-masked]
>> [mailto:[email-masked]] On Behalf Of Peter Saint-Andre 
>> Sent: Thursday, September 02, 2010 12:17 PM To: Kai Engert Cc:
>> [email-masked] Subject: Re: [HASMAT] moving forward
>>> 
>> That's a good group to reach out to. :) Is anyone here involved
>> with those folks? Are there other such groups to be aware of?
> 
> One of the Officers/Founders sits practically next to me.  I can
> definitely check with the WASC folks if they are concerned about the
> name.

I was less interested in the name and more interested in technical
input. :) The same would be true of the Open Web Application Security
Project (OWASP) and other similar groups.

However, we certainly don't want to stomp on names of existing groups...

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Tobias Gondrom <[email-masked]>
Date: Thu, 02 Sep 2010 23:46:41 +0100

> However, we certainly don't want to stomp on names of existing groups...
I got good connections to OWASP (been one their chapter leads back in
the day) and some other orgs.
I've been holding back a bit at the moment as our WG hadn't agreed on a
name yet and the charter.
And it can look quite odd if you invite people to a WG and say, but hey
we're not sure on the name/URL, it may change soon, and we don't really
know what will be in focus at the start either, yet....
(I know the state is better, but having at least the name ironed out
would feel much better when I run around and tell people about it to
bring them in...)

So far I have the impression the name issue is going towards a stable
tendency (for "websec"), which is good. And probably in a few days we
can settle that. And I urgently hope to see the revision of the initial
charter (Jeff?) soon, so that we can roll, i.e. have a discussion about
it and the drafts to work on.

Tobias