Subject: [Uta] How can we help app developers and operators FIND the UTA go-to security guides?

From: Dan York <[email-masked]>
Date: Tue, 18 Feb 2014 22:01:43 +0000

On 2/10/14 3:49 AM, "Orit Levin (LCA)" <[email-masked]> wrote:

> UTA deliverables are intended to serve as the go-to security guides for applications'
> developers and providers/operators. Navigating through numerous IETF RFCs (and drafts)
> in order to implement a specific protocol or deploy a service can be a very challenging task.

I think this is a key point and one reason I'm personally so pleased to see this UTA working group created.  We definitely need to make it easier for application developers to understand how they can best implement TLS in their applications - and for network operators to best allow customers to use TLS-encrypted apps while still meeting their own operational and security needs.

While the focus of the UTA group and list right NOW needs to be on *creating* these "go-to security guides", I'd like to suggest that there's a second stage that needs to be thought about later in the process... and perhaps it is something that a few of us who are not directly involved in writing the documents can start thinking about now.  This second stage is to answer these questions:

1. How will application developers find these "go-to security guides"?  How will they learn that we've created them?
2. How will network operators / ISPs find these "go-to security guides" that help them understand how they can best work with TLS-encrypted application traffic?

The basic question is - if we write these docs and publish them as RFCs (or BCPs), how can we help people know that these documents are out there to help them?

There's a second aspect, too - how will they know we are in the process of *writing* these documents and that we are seeking feedback?

In thinking about some of the application developers I know, I don't think many of them have a particular connection to the IETF and wouldn't necessarily think of RFCs as a source for documentation like this.  Similarly, I think many network operators (particularly smaller ones) don't have a strong connection to the IETF - or if they do, it may be more with some of the networking parts of the IETF versus something in the applications area.

I know that within the IETF we generally have a vehement allergic reaction to anything that remotely smells of (cough)(cough)"marketing"(cough)(cough) ... but if our end goal is to make activity over the Internet more secure through the widespread use of TLS, I think we *do* need to think about how we promote the fact that we (IETF) will have these "go-to security guides" available.

What do others think?   Are there people on the list now interested in talking a bit more about this?  Either on the list or sometime in London? (Perhaps outside of the main UTA meeting so as not to distract from a focus on getting the documents done?)

I have one way that I can personally help with this second stage of work.  The team I work on within the Internet Society operates the Deploy360 website ( http://www.internetsociety.org/deploy360/ ) and our task is to find, create and publicize materials to help accelerate the deployment of Internet technologies like IPv6 and DNSSEC.  Most recently we opened up a topic area on "Securing BGP" to help promote best practices and technologies that make BGP more secure.  Our focus is on finding (or creating if we can't find) high-quality materials with real-world deployment info and then sharing that out through social media, specialized conferences, speaking at events, online interaction, etc.

In talking about how we could help with this work here, it occurred to us that we could open up a new topic on the Deploy360 site about "TLS in Applications" and help promote the work this group is doing and do what we can to encourage developers and network operators to read the current drafts, provide feedback and get engaged with the process.  As the UTA documents get published we can then help promote the documents.  We can also promote other documents, tutorials, videos, etc. that people have created that would complement the guidance being written in these documents... and work with anyone interested from the list to make all this happen.

Some of you know of our work... does this seem like a reasonable way we (Deploy360) could help?

If so I'm glad to help in that way... but I'd also note that anything we can do on Deploy360 is just a part of what I see as the broader need to help people find these documents.  Our efforts will help, but there needs to be more done by more people than just us.

Thoughts? Comments?  Feedback?   (Including telling me why I'm wrong about any or all of this...)

Thanks,
Dan

--
Dan York
Senior Content Strategist, Internet Society
[email-masked] <mailto:[email-masked]>   +1-802-735-1624
Jabber: [email-masked] <mailto:[email-masked]>
Skype: danyork   http://twitter.com/danyork

http://www.internetsociety.org/deploy360/

---

From: "Orit Levin (LCA)" <[email-masked]>
Date: Fri, 21 Feb 2014 00:37:06 +0000

Dan,

I do think that it would be helpful to include UTA in "Deploy360" to help spread the word and bring additional knowledgeable parties to the table.

What do people think? Your feedback and suggestions will be helpful.

Thanks,

Orit.

From: Uta [mailto:[email-masked]] On Behalf Of Dan York
Sent: Tuesday, February 18, 2014 2:02 PM
To: [email-masked]
Subject: [Uta] How can we help app developers and operators FIND the UTA go-to security guides?

Thanks,
Dan

--
Dan York
Senior Content Strategist, Internet Society
[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>   +1-802-735-1624
Jabber: [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>
Skype: danyork   http://twitter.com/danyork

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 21 Feb 2014 10:27:10 +0000

> On 21 Feb 2014, at 00:37, "Orit Levin (LCA)" <[email-masked]> wrote:
> 
> Dan,

Sounds like a good idea to me.

> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta

---

From: Matt Miller <[email-masked]>
Date: Fri, 21 Feb 2014 07:48:02 -0700

On 2/21/14, 3:27 AM, Alexey Melnikov wrote:
> 
> On 21 Feb 2014, at 00:37, "Orit Levin (LCA)" <[email-masked] 
> <mailto:[email-masked]>> wrote:
> 
>> Dan,
>> 
>> I do think that it would be helpful to include UTA in "Deploy360"
>> to help spread the word and bring additional knowledgeable
>> parties to the table.
>> 
> 

+100

- -- 
- - m&m

Matt Miller < [email-masked] >
Cisco Systems, Inc.

---

From: Dan York <[email-masked]>
Date: Mon, 24 Feb 2014 16:01:13 +0000

Orit, Matt and Alexey,

On 2/21/14 9:48 AM, "Matt Miller" <[email-masked]> wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA512
>

Thanks for the positive feedback... I'll make this happen in the next day
or so in order to get some advance publicity out there so that we can
maybe have more people joining the lists and/or tuning in to the UTA
session remotely.

I'd note again that while we can certainly help get the word out through
the Deploy360 portal and social media properties, I think this is a
broader issue that we as a group do need to think about as we get further
down the path toward publication.  Once we get these go-to security guides
published as RFCs, how can we help people find them?  (In other words, I
think it will take more than just one website promoting them.)  Obviously,
the focus now needs to be on creating the documents and getting the
documents ready for publishing.

See you in London,
Dan

---

From: Watson Ladd <[email-masked]>
Date: Mon, 24 Feb 2014 08:20:29 -0800

> documents ready for publishing.

You mean other than having them live as RFCs? I think at some level
those who care will know, and those who don't care, even if they do
know, won't do it. People respond to incentives: advertising can't
change those incentives, and so it's hard to change behavior that way.
But make PCI compliance require one of them, and watch people jump.

Sincerely,
Watson Ladd

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin