Re: [Add] meeting hum: should the IETF take up this work?

[Michael Richardson <[e-mail]>]

Eric Rescorla <[e-mail]> wrote:
    > If the extension said what the privacy was, rather than just that
    > Mozilla
    > had vetted it, then perhaps there could be other levels of privacy.

    > It's not quite clear to me what you have in mind here, but one thing I
    > would like to emphasize is that the Mozilla TRR program is more than
    > just a self-assertion about privacy policy, in that we actively manage
    > the list, rather than just trusting people's self-assertions. If people
    > were interested in some other set of privacy policies, then it's not
    > clear to me who would be responsible for running such a program.

I'm not clear either at this point, because we don't have any feedback from
any other entities.  There seems to be significant interest in having TRRs
running internal to enterprises, for the benefit for BOYDs, which would do as
much as possible in that environment.

It might be that some TRR's are unable for local legal reasons to comply
to the exact same criteria as Mozilla would like for a TRR to be used by the
general public.   For instance, enterprises might be required by some other
local law to retain detailed data for 24 hours or something like that, but
not disclose it without judicial review. 

The fact that Mozilla is not just depending upon self-assertions is part of
what is of interest to end users, I think.  While a policy OID might work for
some things, I agree that it is probably a self-assertion.  It could be more
complex:  The CA signing might actively investigating before signing such
a policy OID, or a third party might be providing a separately signed
assertion that goes into a (new?) extension.

I will drop this here, as I think you've answered my query as to the degree
of interest Mozilla has.


-- 
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-