Re: [Add] [Ext] Updated charter proposal for ADD

I understand the interest in a statement such as this, but I don't
really see a need for it: We have established needs for Security
Considerations, we have Security ADs who will be checking for proper
coverage, and we're most likely to include an assigned technical
advisor from the Security Area when we establish the working group.

So, while some sort of discussion in the charter might not be harmful,
it doesn't seem necessary and seems sure to cause a lot of angst in
getting agreement on the wording.

Barry

On Wed, Jan 15, 2020 at 11:19 AM Ted Lemon <mellon@fugue.com> wrote:
>
> On Jan 15, 2020, at 10:54 AM, Dave Lawrence <tale@dd.org> wrote:
> > That's where I am on this.  I like the proposal as a whole and just
> > think this little bit on the security properties needs tweaking.  I've
> > got to run at the moment though and apologize for not having a
> > concrete proposal for the tweak.
>
> In case it’s not obvious, this is what I was proposing for a tweak:
>
> Any specification must include a clear and thorough discussion of the privacy and security implications of using the method or methods it describes.  Methods where a mechanism that cannot be cryptographically validated for integrity or which do not provide a cryptographically validatable trust establishment mechanism will clearly describe the use case(s) in which such an override is thought to be needed, should have a clear applicability statement limiting the scope of the specification to those use case(s), and should clearly describe the risks and benefits of such a choice.
>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add