Subject: [Trans] Working group last call, draft-ietf-trans-gossip

From: Melinda Shore <[email-masked]>
Date: Wed, 11 Jan 2017 05:55:49 -0900

Hi, all:

Many apologies for the previous thinko.  The gossip draft
is obviously not up for adoption, but for working group last
call.  Please give it a serious read and let us know whether or
not you feel it is ready to be moved along to the IESG for
review and ultimately for publication.

Working group last call will close on Wednesday, 1 February.
The URL for the draft is:
https://datatracker.ietf.org/doc/draft-ietf-trans-gossip/

Melinda & Paul

---

From: Linus Nordberg <[email-masked]>
Date: Tue, 24 Jan 2017 22:32:46 +0100

Melinda Shore <[email-masked]> wrote

> Working group last call will close on Wednesday, 1 February.

Seems to me like none of the browser vendors have any plans on
implementing CT Gossip as specified in this draft. Therefore I suggest
we cancel last call for gossip and try to change the draft into
something that at least one browser vendor is willing to support.

Please don't hesitate to comment on the contents of the draft though.
The authors are still interested in specifying something useful for
catching misbehaving CT logs.

---

From: Ryan Sleevi <[email-masked]>
Date: Tue, 24 Jan 2017 14:23:10 -0800

> catching misbehaving CT logs.

I think it's more a question of whether we expect we can have running code
to implement that draft, so that we can build rough consensus. It's not
that Chrome is opposed to the Gossip draft - merely, that we haven't even
begun to plan to implement/experiment with it, so can't really comment on.

To be fair, we're sort of in this same issue with RFC 6962-bis, in my
opinion - the economics of the Web PKI make it hard to get the "running
code" part that allows us to build the "rough consensus" - so it's hard to
know whether or not it's ready to maturate past WGLC. In other spaces, such
as TLS WG, we're in a much better place to implement and iterate in a
virtuous cycle.

I mention this because I don't want you to feel that we (browsers) are
either rejecting the Gossip draft or holding it hostage - just that there
are enough moving parts or in-fight activities that we've not had a chance
yet to fully explore this space in a way that can lead to good feedback.
However, I do think Gossip is an important part of CT's future, and want to
get to a place where we can really explore the draft, implement, and
provide feedback.

Unfortunately, I don't know if the IETF really has a good way of "This is
good and important work, has what seems like a lot of good and important
ideas, but let's keep this on the burner until more implementations exist"
:(

---

From: Melinda Shore <[email-masked]>
Date: Tue, 24 Jan 2017 13:30:52 -0900

On 1/24/17 1:23 PM, Ryan Sleevi wrote:
> Unfortunately, I don't know if the IETF really has a good way of "This
> is good and important work, has what seems like a lot of good and
> important ideas, but let's keep this on the burner until more
> implementations exist" :(

We really don't, but that's in part why we have an Experimental
track.  Hatless, I would tend to argue in favor of continuing to
progress this towards publication as an experimental standard and
then revving it in the future based on implementation experience.

Melinda

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 25 Jan 2017 00:05:38 +0000

> Hatless, I would tend to argue in favor of continuing to progress this towards
> publication as an experimental standard and then revving it in the future
> based on implementation experience.

Works for me!

---

From: Richard Barnes <[email-masked]>
Date: Tue, 24 Jan 2017 21:47:50 -0500

Without commenting on the substance of the document, process-wise I would
be OK with this as Experimental, if the WG thinks it's worth capturing
state.

On Tue, Jan 24, 2017 at 7:05 PM, Salz, Rich <[email-masked]> wrote:

> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans
>

---

From: Bill Frantz <[email-masked]>
Date: Tue, 24 Jan 2017 23:40:00 -0800

Given there are no implementations, Experimental seems right to 
me, and a good way to capture the progress so far.

Cheers - Bill

>>>based on implementation experience.

-----------------------------------------------------------------------
Bill Frantz        | Concurrency is hard. 12 out  | Periwinkle
(408)356-8506      | 10 programmers get it wrong. | 16345 
Englewood Ave
www.pwpconsult.com |                - Jeff Frantz | Los Gatos, 
CA 95032

---

From: Eran Messeri <[email-masked]>
Date: Mon, 30 Jan 2017 17:04:04 +0000

I'm also in favour of progressing towards publication as an experimental
RFC.
In particular, the SCT Feedback mechanism and Trusted Auditor Relationship
seem like useful protocol descriptions that be useful in the short term.

The document also does a good job of capturing many of the privacy/security
aspects of different gossip mechanisms (and the implications on the CT
system as a whole), another good reason IMHO to progress towards
publication.

On Wed, Jan 25, 2017 at 7:40 AM, Bill Frantz <[email-masked]> wrote:

> Given there are no implementations, Experimental seems right to me, and a
> good way to capture the progress so far.
>
> Cheers - Bill
>
>> Hatless, I would tend to argue in favor of continuing to progress this
>>>>
>>> towards
>>>
> (408)356-8506      | 10 programmers get it wrong. | 16345 Englewood Ave
> www.pwpconsult.com |                - Jeff Frantz | Los Gatos, CA 95032
>
>

---

From: Andrew Ayer <[email-masked]>
Date: Mon, 30 Jan 2017 10:13:40 -0800

On Mon, 30 Jan 2017 17:04:04 +0000
Eran Messeri <[email-masked]> wrote:

> I'm also in favour of progressing towards publication as an
> experimental RFC.
> In particular, the SCT Feedback mechanism and Trusted Auditor
> Relationship seem like useful protocol descriptions that be useful in
> the short term.

I'll add that I am adding support for STH Pollination to Cert Spotter,
and hope to create an ecosystem of monitors sharing STHs, so +1 for
publication.

Regards,
Andrew