Subject: [GNAP] Concerns with the lack of progression of GNAP after 20 months of work

From: Denis <[email-masked]>
Date: Tue, 1 Mar 2022 12:48:47 +0100

Hello everybody,

GNAP has four main components : users, clients, ASs and RSs.

GNAP is supposed to describe a protocol. A protocol is a set of rules 
that control the way data is exchanged between computers.
A reader would expect to find the description of the data sent by a 
client to a RS (which are indeed described in ietf-wg-gnap/core-protocol),
but also find how that data *shall be handled by a RS* which is supposed 
to be described in draft-ietf-gnap-resource-servers. Unfortunately,
this is not the case.

The focus has been placed on the "core" protocol, leaving aside the the RS.

The core document (ietf-wg-gnap/core-protocol) has now got more than 400 
issues !

Besides the editors (and the chair), very few members are active and at 
this time it is unlikely that more members will participate
since *the main driving line for the construction of GNAP has been los**t*.

The recent message called "embedding GNAP" got no reply from the WG, 
except one from a co-editor.
IMO, this demonstrates that *GNAP is still a **moving target* *after 20 
months of work.*

Does this mean that all the WG members agree with the very few emails 
that are exchanged or that the WG members are
no longer really able to participate to the discussion since such 
participation would involve a lot of days to get "up to speed" again ?
I would guess that the right answer is the latter.

The core document has still *no security model *and hence its security 
is more than questionable.

The core document is AS centric and hence *the **privacy concerns of the 
users cannot be addressed*. Is this deliberate ?
When the work started, privacy was supposed to be a major concern to be 
taken into consideration, but in practice, this is not the case.

The core document still does not address the general use case.

There are so many options that *interoperability will not be possible*.

*draft-ietf-gnap-resource-servers-01**expired on 13 January 2022*.  We 
are now close to an IETF meeting and no draft is available.

The milestones are outdated and, anyway, are not observed 
(seehttps://datatracker.ietf.org/doc/charter-ietf-gnap/writeup/)

Milestones:

   Jul 2021 - Core delegation protocol in WGLC

   Oct 2021 - Key presentation mechanism binding to the core protocol, TLS, to WGLC

   Oct 2021 - Key presentation mechanism binding to the core protocol, detached HTTP signatures, to WGLC

   Oct 2021 - Key presentation mechanism binding to the core protocol, embedded HTTP signature, to WGLC

   Dec 2021 - Guidelines for use of protocol extension points to WGLC

   Feb 2022 - Guidelines on migration paths, implementation, and operations to WGLC

At the next IETF meeting, rather than addressing, /as usual,/ the last 
technical issues that no one or very few people will be able to follow 
or understand,
I would suggest that the editors address the following topics: 
*interoperability*, *privacy *and *security *at a level that will allow 
everybody to understand
the real issues behind these three words and by presenting *a balanced 
view*.

Denis

PS: If we were working within ISO, this WG would already have been closed.

---

From: Fabien Imbault <[email-masked]>
Date: Tue, 1 Mar 2022 13:48:42 +0100

Dear Denis,

Sorry I have to say this, but repeating your misconceptions don't make them
true. That's currently not helping anyone going forward.

The editors and chairs welcome anyone with helpful contribution.
Already the spec had many great improvements, from many outstanding
individuals cited in the text. Including on security and privacy.

We are now stabilizing the core draft and focusing on real world
implementations to demonstrate the value and interoperability.

Best regards,
Fabien (speaking only in my own name)

On Tue, 1 Mar 2022, 12:49 Denis, <[email-masked]> wrote:

> A reader would expect to find the description of the data sent by a client
> to a RS (which are indeed described in ietf-wg-gnap/core-protocol),
> Does this mean that all the WG members agree with the very few emails that
> are exchanged or that the WG members are
> The core document has still *no security model *and hence its security is
> more than questionable.
>
> *draft-ietf-gnap-resource-servers-01** expired on 13 January 2022*.  We
> The milestones are outdated and, anyway, are not observed (see
> https://datatracker.ietf.org/doc/charter-ietf-gnap/writeup/)
>
> Milestones:
>
> At the next IETF meeting, rather than addressing, *as usual,* the last
> technical issues that no one or very few people will be able to follow or
> understand,
> --
> TXAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth
>

---

From: Denis <[email-masked]>
Date: Tue, 1 Mar 2022 14:30:27 +0100

Fabien,

It is not useful to send flames.

It would be much better that you spend time to respond to the issues 
raised on draft-ietf-gnap-resource-servers-01
and publish a new draft that addresses these issues and in the mean time 
provide a summary of the way these issues have
been addressed (including the issues you don't agree with).

"Stabilizing the core draft" and "focusing on real world 
implementations" without progressing the resource-servers draft
looks like a headlong rush.

Denis

> Dear Denis,
>
> Sorry I have to say this, but repeating your misconceptions don't make 
> them true. That's currently not helping anyone going forward.
>
>     GNAP is supposed to describe a protocol. A protocol is a set of
>     rules that control the way data is exchanged between computers.
>     A reader would expect to find the description of the data sent by
>     a client to a RS (which are indeed described in
>     ietf-wg-gnap/core-protocol),
>     but also find how that data *shall be handled by a RS* which is
>     supposed to be described in draft-ietf-gnap-resource-servers.
>     Unfortunately,
>     this is not the case.
>
>     The core document (ietf-wg-gnap/core-protocol) has now got more
>     than 400 issues !
>
>     Besides the editors (and the chair), very few members are active
>     and at this time it is unlikely that more members will participate
>     The recent message called "embedding GNAP" got no reply from the
>     WG, except one from a co-editor.
>     IMO, this demonstrates that *GNAP is still a **moving target*
>     *after 20 months of work.*
>
>     Does this mean that all the WG members agree with the very few
>     emails that are exchanged or that the WG members are
>     The core document has still *no security model *and hence its
>     security is more than questionable.
>
>     The core document is AS centric and hence *the **privacy concerns
>     of the users cannot be addressed*. Is this deliberate ?
>     When the work started, privacy was supposed to be a major concern
>     to be taken into consideration, but in practice, this is not the case.
>
>     *draft-ietf-gnap-resource-servers-01**expired on 13 January
>     2022*.  We are now close to an IETF meeting and no draft is available.
>
>     At the next IETF meeting, rather than addressing, /as usual,/ the
>     last technical issues that no one or very few people will be able
>     to follow or understand,
>     *interoperability*, *privacy *and *security *at a level that will
>     allow everybody to understand
>     the real issues behind these three words and by presenting *a
>     balanced view*.
>
>     Denis
>

---

From: Fabien Imbault <[email-masked]>
Date: Tue, 1 Mar 2022 14:46:20 +0100

Denis,

The RS draft is important, but the priority has been put into resolving the
open items of the main draft. As seen in the related PRs.

Please list the GitHub issues related to the RS draft that you'd like us to
focus on next.

Best regards,
Fabien

On Tue, 1 Mar 2022, 14:30 Denis, <[email-masked]> wrote:

> "Stabilizing the core draft" and "focusing on real world implementations"
> without progressing the resource-servers draft

---

From: Leif Johansson <[email-masked]>
Date: Tue, 1 Mar 2022 17:36:09 +0100

Denis,

As chair I am wary of unsubstantiated comments in WG discussions. This is one such
case: Fabien was not "sending flames" by any reasonable definition of the term.

As a chair I am also aqutely aware of the fact that while you have written up your
comments as an I-D (as we advised you to do) there have not been any indication
of substantive support from the WG of this work whatsoever.

This means that you are in the rough here. I am not telling you to stop making
contributions but it is pretty clear that the WG does not agree with your views
and you can't force people to agree with you in the IETF.

If you wish to continue talking about your draft I encourage that but the txauth
list is not the place for that. If you want to make contributions to the current
active drafts in txauth that do not assume adoption of your draft or your point
of view then pls continue.

	Best R
	Leif

---

From: Denis <[email-masked]>
Date: Tue, 1 Mar 2022 18:00:28 +0100

Leif,

My initial email from this morning raised numerous issues. Instead of 
replying to them using technical or factual arguments,
they have all been swept by using a single sentence by using the wording 
"repeating your misconceptions" which is an offence
(or taken as such). Using such wording is not constructive.

A message with the topic"embedding GNAP" got no reply from the WG, 
except one from a co-editor.
Do you interpret such response as a support from the WG ?

The key question is whether the model should only be *AS-centric *(as it 
currently is) or should also allow to be *RS-centric*.
The first model is adequate for an enterprise or a closed community 
while the later is adequate for the WWW.
This is an important issue.

Denis

---

From: Fabien Imbault <[email-masked]>
Date: Tue, 1 Mar 2022 18:51:37 +0100

Denis,

All of your issues on the core draft already got their answers, in full and
extensive details both in writing and during public calls. The "repeating"
part is a fact visible in the tracking issues.

I agree that there is remaining work on the RS draft and can commit working
on that.

Best regards
Fabien

On Tue, 1 Mar 2022, 18:00 Denis, <[email-masked]> wrote:

> A message with the topic"embedding GNAP" got no reply from the WG, except
> one from a co-editor.
> The first model is adequate for an enterprise or a closed community while
> the later is adequate for the WWW.