Subject: Re: Internet Society joins Liberty Alliance Management Board: Why?

From: Lucy Lynch <[email-masked]>
Date: Sun, 1 Mar 2009 09:29:35 -0800 (PST)

On Sat, 28 Feb 2009, Hannes Tschofenig wrote:

> I would like to hear a bit more background about these activities, see
> https://www.projectliberty.org/news_events/press_releases/internet_society_j
> oins_liberty_alliance_management_board

Hannes -

<ISOC hat on>

As stated in the press release, ISOC has joined the the Liberty Alliance 
Board. Our participation here is directly related to the ISOC initiative 
on Trust and Identity (T/Id). Our primary interest is not just the Liberty 
Alliance itself but a proposed transition to a broader organization. This 
effort is currently called either IDTBD or NewOrg in the community 
discussions. The intent is to open participation to new entrants and 
technologies and NewOrg will also help represent emerging identity 
management work to end-users, policymakers, enterprise adopters, and 
others.

ISOC has been actively reaching out to many of the current identity 
technology communities as part of our effort to understand what "managed 
identity" will mean for end users. We also have some interest in how the 
frameworks and use cases developing in user managed identity communities 
may overlap and inform more traditional networked identity/identifier 
problems. I believe that ISOC support for this move to an open community 
lead forum will help bring this important work to a broader audience and 
will encourage greater participation and interoperability (high priorities 
for T/Id work: http://www.isoc.org/isoc/mission/initiative/trust.shtml).

The transition to a "NewOrg" is still in process, and the founding 
documents: by-laws, operating procedures, IPR considerations, etc., were 
reviewed at the recent Liberty Alliance Plenary and continue to progress. 
(see: http://groups.google.com/group/idtbd)

- Lucy

> Thanks!
>
> Ciao
> Hannes
>
>
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Sun, 1 Mar 2009 19:59:00 +0200

As you might have noticed, the WebSSO Identity Management space is not
running out of organizations and groups. Someone could, for example, come up
with the question why ISOC did not join the MIT Kerberos Consortium (see
http://www.kerberos.org/), as Kerberos is a technology developed within the
IETF, or to support technologies like OpenID, OAuth, etc. that are closer to
the Internet deployment. 

I am sure your team had a lot of conversations with the IAB on what
direction would be better for the Internet (with respect to the creation of
an identity layer) but I fear that many in the IETF community are at best
not informed about what you are doing and why you believe that this is
heading into the right direction.

If ISOC wants to understand what "managed identity" will mean for end users
then maybe a discussion within the IETF would help to get a better
understanding as some of us have been working on this subject for a while.

One could even claim that the IETF is also a pretty open forum to discuss
these types of things, particularly when they have a high relevance for the
Internet. Did nobody come up with the idea about how the IETF could be more
actively involved in this space? 

Ciao
Hannes

>-----Original Message-----
>From: Lucy Lynch [mailto:[email-masked]] 
>Sent: 01 March, 2009 19:30
>To: Hannes Tschofenig
>Cc: [email-masked]
>Subject: Re: Internet Society joins Liberty Alliance 
>Management Board: Why?
>
>https://www.projectliberty.org/news_events/press_releases/internet_soc
>> iety_j oins_liberty_alliance_management_board
>
>Hannes -
>
><ISOC hat on>
>
>As stated in the press release, ISOC has joined the the 
>Liberty Alliance Board. Our participation here is directly 
>related to the ISOC initiative on Trust and Identity (T/Id). 
>Our primary interest is not just the Liberty Alliance itself 
>but a proposed transition to a broader organization. This 
>effort is currently called either IDTBD or NewOrg in the 
>community discussions. The intent is to open participation to 
>new entrants and technologies and NewOrg will also help 
>represent emerging identity management work to end-users, 
>policymakers, enterprise adopters, and others.
>
>ISOC has been actively reaching out to many of the current 
>identity technology communities as part of our effort to 
>understand what "managed identity" will mean for end users. We 
>also have some interest in how the frameworks and use cases 
>developing in user managed identity communities may overlap 
>and inform more traditional networked identity/identifier 
>problems. I believe that ISOC support for this move to an open 
>community lead forum will help bring this important work to a 
>broader audience and will encourage greater participation and 
>interoperability (high priorities for T/Id work: 
>http://www.isoc.org/isoc/mission/initiative/trust.shtml).
>
>documents: by-laws, operating procedures, IPR considerations, 
>etc., were reviewed at the recent Liberty Alliance Plenary and 
>continue to progress.

---

From: Dave CROCKER <[email-masked]>
Date: Sun, 01 Mar 2009 10:17:19 -0800

Hannes Tschofenig wrote:
>      Someone could, for example, come up
> direction would be better for the Internet 

Folks,

What is particularly interesting to me, about this line of comment, is not 
whether the relevant IETF-based technologies are superior or whether an ISOC 
alliance with an industry Alliance was the right thing to do.  There can -- and 
probably should -- be focussed debate about such questions.  But only within a 
larger context that I'd like to raise:

      Should there be more or different ISOC/IETF dialogue, when ISOC is 
pursuing a strategic topic that is relevant to the IETF?

The IETF/ISOC relationship has changed dramatically, in recent years, primarily 
in terms of ISOC involvement in IETF management and funding.  What I do not 
recall seeing is whether there should be changes in the involvement of the IETF 
in ISOC activities.[1]

An easy example is exactly the sort of involvement being implied by the current 
thread:  When ISOC is choosing to take a strategic action, should it seek public 
discussion within the IETF?

Public discussion is messy and IETF-wide consensus is virtually impossible to 
obtain for any interesting topic.  So I'm not at all suggesting that ISOC depend 
upon gaining that from the IETF.  Still, public discussion can surface useful 
information and opinion.

Let me stress:  I don't intend this as criticism.  As things change, we gain 
insight.  The exchange surfaced an issue that struck me as interesting and 
potentially useful, and worth pursuing among the ISOC and IETF communities.

d/

[1]  Side note:  The list of ISOC Board of Trustees at:

      <http://www.isoc.org/isoc/general/trustees/board.php>

      does not indicate the constituency or selection mechanism that chose
      particular Trustees; it would be helpful to see that included in the list,
      to understand whether they are ex officio, elected by from a region, or the
      like.
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Patrik Fältström <[email-masked]>
Date: Sun, 1 Mar 2009 19:55:03 +0100

Hannes,

Let me as a member of ISOC BoT that is appointed by the IETF explain a  
bit more on what Lucy just explained below. I hope first of all that  
you specifically noted that ISOC is looking for coordination with many  
groups. This implies that when you or anyone else see some formal  
connection between ISOC and other organisations does not imply ISOC  
can get arrangements with other organisations as well. And, different  
organisations require different kinds of "connections".

Regarding the work between IETF and ISOC in for example the work on  
trust, that *is* done together with the IETF. We do not have any  
formal explicit relationship with the various wg's (but the IETF as  
you know does not work that way...), but we do of course have  
connection with various very active IETF participants in the various  
areas. You can for example have a look at the report that was  
published in 2008 regarding specifically this work:

http://www.isoc.org/isoc/mission/initiative/docs/trust-report-2008.pdf

> Attendees
>
> ISOC Board of Trustees/Officers:
>
> Fred Baker, Scott Bradner (remote), Hiroshi Esaki, Patrik Fältström,  
> Ted Hardie, Daniel Karrenberg, Franck Martin, Desirée Miloshevic,  
> Alejandro Pisanty (remote), Glenn Ricart, Stephen Squires (past BoT  
> member and instigator), Lynn St. Amour, Bill St. Arnaud, Patrick  
> Vande Walle ISOC Staff: Leslie Daigle (remote), Frederic Donck, Lucy  
> Lynch, Karen Rose
>
> Internet Technical Community Representatives:
>
> Russ Housley (Internet Engineering Task Force chair), Olaf Kolkmann  
> (Internet Architecture Board chair), Danny McPherson (Internet  
> Architecture Board)
>
> Subject Experts:
>
> Levi Gundert (Team Cymru), Dick Hardt (Sxip Identity), RL “Bob”  
> Morgan (Internet 2, University of Washington), Mikko Särelä (Nomadic- 
> Lab)

Work has continued after this workshop as Lucy explain, and many  
individuals are involved in identity work in the IETF (including  
Kerberos work) have been and are involved. They for example include  
Leif Johansson that is a long time IETF participant. The whole goal  
with this project is to coordinate, and explain "what's up".

But, I also see that you seem to be interested in helping, and I thank  
you for that. ;-)

    Patrik

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 02 Mar 2009 10:04:18 +1300

Dave,

On 2009-03-02 07:17, Dave CROCKER wrote:
...
> What is particularly interesting to me, about this line of comment, is
> not whether the relevant IETF-based technologies are superior or whether

Can you point me to the IETF WG(s) that are considering identity
management as a whole? I know there was the DIX BOF at IETF 65,
but since then??

I think this is relevant to your very valid question below.
I'd be mighty offended if ISOC signed up to an area of standards
activity that overlapped with the IETF without a full and open
discussion. But when it's an area that *is* relevant to the Internet,
but that the IETF appears to have passed on, it's less clear
what the discussion would achieve.

More below...

> an ISOC alliance with an industry Alliance was the right thing to do. 
> There can -- and probably should -- be focussed debate about such
> questions.  But only within a larger context that I'd like to raise:
> 
> The IETF/ISOC relationship has changed dramatically, in recent years,
> primarily in terms of ISOC involvement in IETF management and funding. 
> What I do not recall seeing is whether there should be changes in the
> involvement of the IETF in ISOC activities.[1]
> 
> An easy example is exactly the sort of involvement being implied by the
> current thread:  When ISOC is choosing to take a strategic action,
> should it seek public discussion within the IETF?

Actually, it's written in the IAB charter that:

   The IAB acts as a source of advice and guidance to the Board of
   Trustees and Officers of the Internet Society concerning technical,
   architectural, procedural, and (where appropriate) policy matters
   pertaining to the Internet and its enabling technologies. If
   necessary the IAB may convene panels of knowledgeable people, hold
   hearings, and otherwise pursue the investigation of specific
   questions or topics presented to it by the Internet Society.

So I'd say it's clear what should happen: ISOC should ask the IAB, and
the IAB, in the spirit of openness, should raise discussion within the
IETF.

Personal opinion: I was never too happy, while I was in the IAB or IESG,
that this channel was working as well as it should. But as you say:

> 
> Public discussion is messy and IETF-wide consensus is virtually
> impossible to obtain for any interesting topic.  So I'm not at all
> suggesting that ISOC depend upon gaining that from the IETF.  Still,
> public discussion can surface useful information and opinion.
> 
> Let me stress:  I don't intend this as criticism.  As things change, we
> gain insight.  The exchange surfaced an issue that struck me as
> interesting and potentially useful, and worth pursuing among the ISOC
> and IETF communities.

Agreed.

    Brian

---

From: Dave CROCKER <[email-masked]>
Date: Sun, 01 Mar 2009 13:21:33 -0800

> management as a whole? I know there was the DIX BOF at IETF 65,

Brian,

A fair question, but Identity "management" seems to have varied meanings, 
depending on who is discussing it.  There is, for example, a good argument that 
any authentication activity is part of, or involves, ID mgmt.  So OpenPGP, 
S/MIME, DKIM, TLS and the emerging OAuth acitivities come to mind.

So does DNS...

> But when it's an area that *is* relevant to the Internet,

passed on?  huh?  when did we do that?

In any event, if it something ISOC considers worth making a strategic 
relationship about, and it is likely to entail Internet technical standards, 
then it would be strange to have the IETF skip dealing with it.

...
> the IAB, in the spirit of openness, should raise discussion within the

sounds like a plan.

Let me stress again that I wasn't offering criticism.  I think that the IETF has 
historically been the source of initiatives that it participates in, and that 
this appears to be something different.  That makes it worth exploring a bit.

d/
-- 

   Dave Crocker

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 02 Mar 2009 10:35:52 +1300

On 2009-03-02 10:21, Dave CROCKER wrote:
> A fair question, but Identity "management" seems to have varied
> meanings, depending on who is discussing it.  There is, for example, a
> good argument that any authentication activity is part of, or involves,
> ID mgmt.  So OpenPGP, S/MIME, DKIM, TLS and the emerging OAuth
> acitivities come to mind.
> 
> So does DNS...
> 
> 

Well, what I mean is that the IETF did what it normally does
(and this is not a criticism): chose to work on various bits
and pieces (as you list above) but *not* to work on a general
framework. Whatever people think about the Liberty Alliance, or
efforts like Shibboleth, they are trying to look at the big picture.

This assertion is a couple of years out of date, but people I knew
who are experts in the identity management area never thought that
the IETF was relevant except as a source of atomic components.

   Brian

> relationship about, and it is likely to entail Internet technical
> standards, then it would be strange to have the IETF skip dealing with it.
> 
> 
> Let me stress again that I wasn't offering criticism.  I think that the
> IETF has historically been the source of initiatives that it
> participates in, and that this appears to be something different.  That
> makes it worth exploring a bit.
> 
> d/

---

From: Patrik Fältström <[email-masked]>
Date: Sun, 1 Mar 2009 22:39:51 +0100

On 1 mar 2009, at 22.21, Dave CROCKER wrote:

> In any event, if it something ISOC considers worth making a  
> strategic relationship about, and it is likely to entail Internet  
> technical standards, then it would be strange to have the IETF skip  
> dealing with it.

As Lycy said, we in ISOC BoT do believe "identity management" (without  
specifying what it is, because we see that being part of the  
initiative, to be open ended) is very important. As many people have  
mentioned, IETF and other technical organisations as well as  
governments and regulators have tried to "define" what it really is.  
We start to get regulation here and there that we believe is not  
matching technical reality, so at least more communication is needed.  
If possible, organisations should coordinate their efforts,  
individuals should meet and influence each other. Etc.

But, back to the initiative itself....as an example of how ISOC works.  
We do have open board meetings (including remote participation), and  
two of the meetings each year is adjacent to the IETF just so IETF  
people can come. (The third face to face board meeting is adjacent  
with the ICANN meeting.) At the board meeting, of course various  
projects that are run is described and discussed. Next board meeting  
is weekend after the IETF in San Francisco. And you can see minutes as  
well as agenda for past board meetings on the ISOC BoT corner of the  
ISOC website:

http://www.isoc.org/isoc/general/trustees/meetings.shtml

As part of that, you can find the plan presented in november:

http://www.isoc.org/isoc/general/trustees/docs/nov2008/businessplan-budget.pdf

See pages 13, 23-25 etc. Specifically on page 23, you will see  
regarding this area:

> Key 2009 objectives for the success of the program to Manage Trust  
> Relationships include:
> - Publication of Identity baseline studies, such as:
> -- a public report based on broad consultation with representations  
> from the Identity technology communities, ISOC members, the IETF,  
> and the IAB (Q2 2009); 
> -- a technical report (Internet Draft) submitted to the IETF  
> describing the current state of identity technologies and any  
> existing dependencies on Internet Protocols (Q2-2009); 
[etc]

So I do not think IETF should be the slightest worried ISOC is doing  
something here without coordination. And without visibility to the IETF.

And the more people in IETF is interested on this more "meta-level- 
work" than bits on the wire, the higher the quality will be of the  
work ISOC does. Just contact Lucy!

    Regards, Patrik

---

From: Lucy Lynch <[email-masked]>
Date: Sun, 1 Mar 2009 13:47:17 -0800 (PST)

<snip>

> And the more people in IETF is interested on this more "meta-level-work"
> than bits on the wire, the higher the quality will be of the work ISOC 
> does.
> Just contact Lucy!

>  Regards, Patrik

Yes please! lynch @ isoc.org or find me in SF and I'd be happy
to chat.

- Lucy

---

From: "James M. Polk" <[email-masked]>
Date: Sun, 01 Mar 2009 15:48:41 -0600

Brian

Taking a loose view of the OSI 7 layer stack for a moment - is there 
any group that's looking at more than 3 layers?

Identity, as you know,  can be at layer2 for link access sign on (the 
IEEE is addressing this area).

There's identity associated to an IP address.

There's identity associated with security principles within a VPN or 
TLS connection.

Then there's all the identity related stuff happening at the 
applications layer.

SIP has a few RFCs about this already, and more WG IDs in progress now.

I'm not being a SIP bigot - but RAI is heavily influenced by what 
occurs in SIP, and they have RFC 4474 (SIP Identity) already.

Where would a euphoric single sign-on (covering each of the above) be 
worked on in the IETF?

Is that a WG or an Area?

Hannes and I are but two working on IDs in this space - and have been 
for years, and because this topic is (either) so diluted or so spread 
out - it's hard to gain traction with many of its aspects - because 
of the lack of focus within any one WG or Area.

With this, I don't necessarily believe that because we don't have a 
WG now, identity should be worked somewhere else.

I believe identity should be view in both lower layer terms, as well 
as higher layer terms.

This is certainly true within a lot of vendor's product focuses (it's 
at the link/network layer, or the application signaling layer).

A distinct discussion is needed within the IETF on this topic IMO 
(which I guess is either a +1 to Hannees or a +1 to Dave's point(s)).

James

---

From: Dave CROCKER <[email-masked]>
Date: Sun, 01 Mar 2009 13:59:38 -0800

> something here without coordination. And without visibility to the IETF.

I don't know about anyone else, but I wasn't expressing worry.  I was noting 
that the activity wasn't discussed with the broader IETF beforehand and that 
such a discussion before making strategic decisions can be useful.  I'll stress 
again that I'm not crazy enough to think that the IETF "plenary" should have a 
veto on ISOC choices, but merely that pro-active (pre-hoc, rather than post-hoc) 
discussion could be productive.

Brian E Carpenter wrote:
 >    people I knew

A significant -- and probably insightful -- assessment of the IETF...

d/
-- 

   Dave Crocker

---

From: "Lynn St.Amour" <[email-masked]>
Date: Sun, 1 Mar 2009 17:49:48 -0500

Hi Dave and Hannes,

Thank you for triggering this useful discussion.  And thank you to  
Brian, Patrik and Lucy for their comments as well.  A number of good  
points have been raised both on the topic and others on the ISOC-IETF  
intersection.    These are items to be taken up with the ISOC Board,  
IAB and the IETF community.

As has been pointed out, ISOC has brought in additional technical  
expertise and this, amongst other things, has allowed us to broaden  
our activities as it relates to the Internet's development.   Lucy  
Lynch is championing our Trust & Identity initiative and is the  
appropriate contact for that discussion - [email-masked].

With respect to the ISOC-IETF intersection, Leslie Daigle (ISOC's  
Chief Internet Technical Officer), Lucy, and I have been having  
similar discussions - not particularly formally, but the interaction  
with the IETF and our responsibility to the IETF are always top of our  
minds - and of course critically important.   Others have been  
involved as well, some from the IAB and others such as Russ in his  
IETF Chair role (although again not particularly formally) and we will  
certainly evaluate appropriate next steps.   We are interested in your  
thoughts so please reach out to Leslie or me - [email-masked] or [email-masked] 
.

Thanks again,

Lynn

PS. Re: your side note below on the makeup of the ISOC Board, we'll  
update the list to show the community or mechanism that appoints/ 
elects Trustees.   In the meantime, the IETF appoints 3 Trustees (out  
of 13, 12 voting and me non-voting).  The current IETF appointees to  
the ISOC Board are: Patrik Fältström, Ted Hardie and Bert Wijnen.

On Mar 1, 2009, at 1:17 PM, Dave CROCKER wrote:

>> the Internet deployment. I am sure your team had a lot of  
>> conversations with the IAB on what
> What is particularly interesting to me, about this line of comment,  
> is not whether the relevant IETF-based technologies are superior or  
> whether an ISOC alliance with an industry Alliance was the right  
> thing to do.  There can -- and probably should -- be focussed debate  
> about such questions.  But only within a larger context that I'd  
> like to raise:
>
>     Should there be more or different ISOC/IETF dialogue, when ISOC  
> is pursuing a strategic topic that is relevant to the IETF?
>
> The IETF/ISOC relationship has changed dramatically, in recent  
> years, primarily in terms of ISOC involvement in IETF management and  
> funding.  What I do not recall seeing is whether there should be  
> changes in the involvement of the IETF in ISOC activities.[1]
>
> An easy example is exactly the sort of involvement being implied by  
> the current thread:  When ISOC is choosing to take a strategic  
> action, should it seek public discussion within the IETF?
>
> Let me stress:  I don't intend this as criticism.  As things change,  
> we gain insight.  The exchange surfaced an issue that struck me as  
> interesting and potentially useful, and worth pursuing among the  
> ISOC and IETF communities.
>
> d/
>
>

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 01 Mar 2009 18:04:22 -0800

At Sun, 1 Mar 2009 19:59:00 +0200,
> heading into the right direction.

Did ISOC in fact have these discussions with the IAB? I'd be very interested
to hear the IAB weigh in here.

-Ekr

---

From: John C Klensin <[email-masked]>
Date: Sun, 01 Mar 2009 22:12:55 -0500

Patrik,

I fear that I need to side with Dave on this (!).  For issues at
the technology-policy boundary, ISOC is seen in the outside
community as the representative and "voice" of the IETF.  That
is generally a good thing and it is an impression many of us
have worked for years to create.  However, its side-effect is
that, if ISOC ventures into a management/policy role with one
particular consortium, the same folks we have been trying to
persuade that ISOC should be seen as the lead policy body in the
Internet technical community --in large measure because it does
represent the IETF-- are likely to infer (and reasonably so)
IETF endorsement of that consortium and its efforts.

That ultimately has little or nothing to do with whether the
IETF has active work in the area or how that work is organized.
It is the presumption that the IETF is taking/endorsing a set of
positions via ISOC.

Like Dave, I don't see looking for IETF community consensus on
the details is either necessary or desirable.  At the same time,
I think the IETF should be aware of the decisions being made and
the actions being taken early enough that interested community
members can make comments that are considered in the ISOC mix
and decision process.  If this has been discussed in depth with
the IAB and the IAB chose to not engage the community in advance
of the press releases, then, IMO, the IAB has fallen down on its
job.  Independent of the IAB, while IETF-appointed ISOC BoT
members represent themselves and not the IETF, I believe that
you (collectively) have at least a moral obligation to notice
issues on which the IETF community should be informed and to
make sure that happens... an obligation that goes well beyond
"well, you could have come to the meetings or read the minutes".

Certainly I know that the IETF has, as a body, tended to pay
fairly little attention to ISOC actions and activities.  But
that may be a reason for more, rather than less, outreach.

I am not suggesting trying to undo this decision, but believe
that, as ISOC adds sufficient technically-qualified staff to
engage in activities like this on its own, we need to work,
collectively, on better ways to facilitate communication in a
timely basis in the future.  In particular, we need to work
fairly hard to avoid a situation in which the IETF and ISOC end
up with different positions on an issue with external visibility
and consequences.  To do so would damage the credibility of all
concerned.

best,
    john

---

From: Patrik Fältström <[email-masked]>
Date: Mon, 2 Mar 2009 07:23:10 +0100

> and consequences.  To do so would damage the credibility of all

This I completely agree with, we have to avoid such situations.

But we have to also to work hard on not to create a chicken out of a  
feather. Instead learn and do things even better next time.

Regarding Liberty Alliance, I think we should let Lucy coordinate some  
more information for the IETF that can be presented in due time. As  
she said, she will (as well as I) be in San Francisco and we are all  
happy to talk.

    Patrik

---

From: Olaf Kolkman <[email-masked]>
Date: Mon, 2 Mar 2009 12:43:25 +0100

On 1 mrt 2009, at 23:49, Lynn St.Amour wrote:

> elects Trustees.   In the meantime, the IETF appoints 3 Trustees  
> (out of 13, 12 voting and me non-voting).  The current IETF  
> appointees to the ISOC Board are: Patrik Fältström, Ted Hardie and  
> Bert Wijnen.

Also note that the IAB is to select a new IETF appointee. See http://www.ietf.org/mail-archive/web/ietf-announce/current/msg05771.html 
  for the list of nominees.

--Olaf

---

From: JFC Morfin <[email-masked]>
Date: Mon, 2 Mar 2009 12:42:47 +0100

I also completely agree with John and Patrick.
I only regret that prior to engage into a new tehnical area, ISOC does not
create a thematic Chapter on the matter. I experiment this attitude with the
project of a _users_ chapter about IPv6 (http://isoc-ipv6.org) I propose.
Hiring specialists should not replace the work and the search of consensus
among the Members and the affiliated-IETF Participants. To the countrary,
these specialists should be the motivators of such chapters and benefit in
turn from their backing and contributions (and also of their attendance and
support in order to organize localized workshops).

jfc

---

Je suis moi aussi totalement en accord avec John et Patrick.

Je regrette seulement qu'avant de s'aventure dans de nouvelles direction
techniques, l'ISOC ne crée par un Chapitre thématique à son sujet.
J'expérimente cette attitude au sujet du chapitre d'utilisateurs sur IPv6 (
http://isoc-ipv6.org). Embaucher des spécialises ne devrait pas remplacer le
travail et la recherche de consensus parmi les Membres de l'ISOC et les
participants à la filliale IETF. Au contraire ces spécialistes devraient
être les motivateurs de tels chapitres et bénéficier en retour de leur
support et de leur contributions (et aussi de leur participation et de leur
soutien pour organiser des ateliers locaux).

jfc

2009/3/2 Patrik Fältström <[email-masked]>

> Regarding Liberty Alliance, I think we should let Lucy coordinate some more
> information for the IETF that can be presented in due time. As she said, she
> will (as well as I) be in San Francisco and we are all happy to talk.
>
>   Patrik
>
>

---

From: Joel Jaeggli <[email-masked]>
Date: Mon, 02 Mar 2009 10:29:43 -0800

Hannes,

Two mostly rhetorical questions...

> heading into the right direction.

I find it somewhat interesting that we would perceive the ISOC as being
responsible to the IETF in this regard. The IETF is not the only place
to do standards. Is the IETF the right place to do this work? How go are
we historically at public policy?

> actively involved in this space? 

I give you the IETF 65 and 66 dix/wae bof/dicusssions... What were the
outcomes? Do the right people even come to the IETF?

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Mon, 2 Mar 2009 21:35:36 +0200

Hi Joel, 

>> running out of organizations and groups. Someone could, for example, 
>> come up with the question why ISOC did not join the MIT Kerberos 
>> Consortium (see http://www.kerberos.org/), as Kerberos is a 
>technology 
>> developed within the IETF, or to support technologies like OpenID, 
>> OAuth, etc. that are closer to the Internet deployment.
>> 
>> direction would be better for the Internet (with respect to the 
>> creation of an identity layer) but I fear that many in the IETF 
>> community are at best not informed about what you are doing and why 
>> you believe that this is heading into the right direction.
>
>I find it somewhat interesting that we would perceive the ISOC 
>as being responsible to the IETF in this regard.

Responsible is not the right term. A bit better synchronized would be nice. 

> The IETF is 
>not the only place to do standards.

Everyone knows that. Even the ITU-T is working on identity management ...

> Is the IETF the right 
>place to do this work? 

[By 'this' I assume you mean 'work on IdM'] 

I wonder why you think that the work on identity management could not
something the IETF should we focusing on? 
Folks who participate in the IETF do their work on identity management in
other organizations. 

It would be useful todo an analysis on why the IETF isn't suitable for
dealing with some of the application layer / security work that happen
currently outside the IETF:
* Is it a problem with the persons (lack of knowledge, for example)? 
* Is it possible that some folks don't want to wait 5 years till a
specification gets finished? 
* Maybe they have problems with our IPR policy?

Would be really interesting to understand these types of things a bit
better. Don't you think so? 

> How go are we historically at public policy?

>
>> If ISOC wants to understand what "managed identity" will 
>mean for end 
>> users then maybe a discussion within the IETF would help to get a 
>> better understanding as some of us have been working on this 
>subject for a while.
>> 
>> One could even claim that the IETF is also a pretty open forum to 
>> discuss these types of things, particularly when they have a high 
>> relevance for the Internet. Did nobody come up with the idea 
>about how 
>> the IETF could be more actively involved in this space?
>
>I give you the IETF 65 and 66 dix/wae bof/dicusssions... What 
>were the outcomes? Do the right people even come to the IETF?

Don't ask me. I am still puzzled about the lack of actions. 
After the 2nd BOF I had the impression that everything was going fine. 

Obviously not quite ... 

Ciao
Hannes

>>> Subject: Re: Internet Society joins Liberty Alliance Management 
>>> Board: Why?
>>>
>>> As stated in the press release, ISOC has joined the the Liberty 
>>> Alliance Board. Our participation here is directly related to the 
>>> ISOC initiative on Trust and Identity (T/Id).
>>> Our primary interest is not just the Liberty Alliance itself but a 
>>> proposed transition to a broader organization. This effort is 
>>> currently called either IDTBD or NewOrg in the community 
>discussions. 
>>> The intent is to open participation to new entrants and 
>technologies 
>>> and NewOrg will also help represent emerging identity 
>management work 
>>> to end-users, policymakers, enterprise adopters, and others.
>>>
>>> technology communities as part of our effort to understand what 
>>> "managed identity" will mean for end users. We also have some 
>>> interest in how the frameworks and use cases developing in user 
>>> managed identity communities may overlap and inform more 
>traditional 
>>> networked identity/identifier problems. I believe that ISOC support 
>>> for this move to an open community lead forum will help bring this 
>>> important work to a broader audience and will encourage greater 
>>> participation and interoperability (high priorities for T/Id work:
>>> documents: by-laws, operating procedures, IPR considerations, etc., 
>>> were reviewed at the recent Liberty Alliance Plenary and 
>continue to 
>>> progress.

---

From: Joel Jaeggli <[email-masked]>
Date: Mon, 02 Mar 2009 13:24:24 -0800

> * Maybe they have problems with our IPR policy?

Maybe the IETF is altogether the wrong place to do public policy? I
don't think it's the case that there is no intersection, Or that there
are other more appropiate places to do some kinds of work. However when
I read something like Nist 800-63 obviously I see the input of people I
recognize there so I don't belive that it goes unrepresented in this
organziation...

> better. Don't you think so? 

Would I like us to be more mindful of our limitations? Absolutely.

We might consider for example how we managed to make such a hash of IDN.

> After the 2nd BOF I had the impression that everything was going fine. 

If I recall there was little support for the wide scope of work.
Particpants moved on and nothing came of it in the IETF.

http://www.ietf.org/mail-archive/web/dix/current/msg00863.html

http://www.ietf.org/mail-archive/web/dix/current/msg00834.html

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 2 Mar 2009 13:35:54 -0800

>Responsible is not the right term. A bit better synchronized would be nice.

ISOC has multiple staff members at every IETF, and those folks are very engaged with IETF participants.

>something the IETF should we focusing on?

It could be, but it isn't. We have had a decade of opportunity to take on that focus, and haven't. That should give us a great big clue about whether or not we should be the center of such work.

>* Maybe they have problems with our IPR policy?

For very good reason, we roll our eyes at various people who come to us to standardize things they are interested in, telling them that we are not the universal SDO hammer for all possible protocol nails. To some of us who have dealt with it over the decade, identity management seems like a tarbaby that the IETF's processes would not be well-usited to deal with.

>better. Don't you think so?

It can go onto the long list, yes.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 3 Mar 2009 08:31:40 -0800

I think that a rather more fundamental problem is the fact that the IETF constitution prevents any organization or party speaking on behalf of the IETF as a whole.

I agree that it would be rather better if the IAB could take on this particular role than ISOC. But even the IAB can only represent a subset of IETF views on this topic. The tendency of NOMCON is to pick an IAB that 'will work together', which tends to mean that conflicting technical views have already been excluded before the IAB discussion begins. 

At least the IAB could serve as a conduit for Liberty views into the IETF. I don't see ISOC playing that role.

>From a wider industry view, it is important to recognize here that the Liberty Alliance of 2009 is not the same organization that it was at the start, nor do the same conditions exist in the industry as then.

Liberty began at a time when the industry and mainstream press saw 'identity' as a gold rush. Many thought that the first company to establish a claim would gain control of cyberspace and so on. Liberty and AOL Magic Carpet were begun as an attempt to stop Microsoft Passport.

At this point we know that the original premise behind that particular industry battle was false. Deployment of an industry wide identity system is a much harder prospect than anyone thought then. There is really no risk that a proprietary system will grow like kudzu and engulf the net and this is now something that all the industry majors understand (but not some VC funded startups predicated on that strategy).

So at this point the rule in the identity space is safety in numbers. The major waring factions are now spending considerable time and effort to show that the war is over and there is going to be a concerted joint effort. Thus ISOC joining liberty does not represent the IETF taking sides in a Betamax/VHS battle. That would have been an issue three years ago, it is not really an issue at this point.

There are however some technical issues that need to be input to the debate that the IETF does need to take a stand on:

1) The DNS is the sole naming system for the Internet.

Identity is not an opportunity to roll out a new naming scheme whether the protocols are proprietary or not, whether the registry is open or not. Uniform naming schemes arise very infrequently. We have only had five uniform addressing schemes since the industrial revolution - latitude/longitude, the postal address system, telephone numbers, UPC barcodes and DNS names. If you can think of another, please let me know, I am thinking of writing a brief history of names.

Attempting to create a new naming basis inevitably attracts antibodies. My strong belief is that it is only possible to establish a naming system if people are not really paying attention. At this point everything connected to the Internet is scrutinized by people and organizations and governments that much prefer nothing to happen than for something to happen than might subsequently create a control point that is outside their control.

2) Make the base protocol simple

One of the big issues I take with many of the schemes out there is that they take an ISAKMP type approach to technology. Rather than commit to an actual decision we have mechanisms to negotiate mechanisms. It is not necessary to do that. Factor the authentication question out of the federation problem. Authentication technology is a bilateral choice between the end user and the authentication service. The relying party does not need to know anything about the technology or protocol employed. 

3) Make the protocol comprehensible

The most irritating phenomena in the 'identity' world is the proliferation of jargon. Rather than attempting to learn existing nomenclature, some have invented their own. As a result technical progress tends to be slow.

-----Original Message-----
From: [email-masked] on behalf of John C Klensin
Sent: Sun 3/1/2009 10:12 PM
To: Patrik Fältström; Dave CROCKER
Cc: Hannes Tschofenig; [email-masked]; Lynn St. Amour; [email-masked]
Subject: Re: Internet Society joins Liberty Alliance Management Board:  Why?
 
Patrik,

best,
    john

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Tue, 3 Mar 2009 21:02:35 +0200

> So at this point the rule in the identity space is safety in numbers. The
major waring factions are now spending considerable 
> time and effort to show that the war is over and there is going to be a
concerted joint effort. Thus ISOC joining liberty does > not represent the
IETF taking sides in a Betamax/VHS battle. That would have been an issue
three years ago, it is not really an > issue at this point.
 
So, who is the winner? (Or are there only loosers, more like in a real war?)

---

From: Lynn St.Amour <[email-masked]>
Date: Wed, 4 Mar 2009 01:13:32 -0500

On Mar 1, 2009, at 9:04 PM, Eric Rescorla wrote:

>> creation of

Hi Ekr and Hannes,

ISOC has been working within the IETF community as a whole on a  
variety of technical issues, and did not approach the IAB as a body  
when taking the decision to join Liberty Alliance/NewOrg.

ISOC's broad goals here seem largely to fall outside the IETF arena.   
We are working with these other communities to build a more  
transparent and open identity organization which serves the broader  
identity community, and reaches out to adopters and end-users.   We  
are, of course, very open to conversation about advancing these goals  
with any interested IETFer.      And, to be clear we are very  
supportive of the OAuth efforts and hope to see OAuth chartered in the  
IETF.

I echo Dave's original comments that this discussion is interesting  
and useful, and Leslie has provided some additional context in another  
mail.

Best,
Lynn