Subject: the way an I-D takes

From: Kai Kretschmann <[email-masked]>
Date: Tue, 23 Jul 2002 18:25:22 +0200

Hi,

what further way goes a submitted and published internet draft after a 
short period of discussion?

In mid may we published a draft named draft-kretschmann-kai-
sighttp-00.txt and got at least some responses. After waiting for 6 
month the draft vanishes from the ietf sites, am I right? So what can 
one do to get this or any draft some steps forward?
I heared there is/was a ietf meeting, are there indepenend drafts 
discussed, too?

Any further ideas welcome, either by email or via our small discussion 
board below to limit the traffic here.

Thanks,
--
http://www.sighttp.org/

---

From: John Stracke <[email-masked]>
Date: Tue, 23 Jul 2002 13:04:11 -0400

> short period of discussion? 

urn:ietf:rfc:2026

> sighttp-00.txt and got at least some responses.

...mostly negative, IIRC.

-- 
/========================================================\
|John Stracke                    |Principal Engineer     |
[email-masked]   |Incentive Systems, Inc.|
|http://www.incentivesystems.com |My opinions are my own.|
|========================================================|
|This is the .sig that says... Ni!                       |
\========================================================/

---

From: John Stracke <[email-masked]>
Date: Tue, 23 Jul 2002 13:47:18 -0400

> ...mostly negative, IIRC.

<checks archive> OK, this was an unworthy bit of snideness, since nearly 
all the previous comments came from me.  Sorry.

---

From: Fred Baker <[email-masked]>
Date: Tue, 23 Jul 2002 12:01:13 -0700

>short period of discussion?

That largely depends on you. If it goes into a working group, it becomes a 
working group document which you might be the editor of or a contributor 
to. If it remains a personal submission, you can ask the IESG to publish it 
as an informational RFC. But yes, if you do nothing, it will age out in time.

Question for you on the content of the draft. What you are proposing is, I 
think, signing web pages as a way to detect when they have been hacked.

You state that the public key needs to come through a third party. I'm not 
sure I buy that. If you have a business relationship, you could transfer 
the public key (in a certificate) during the process of setting it up.

You are concerned about transfer of the key at the time because the hacker 
might substitute a different public key. What I would worry about is the 
system signing dynamic pages on the fly and therefore using its private key 
to sign hacked files. How would you address that?