Re: [cnit] CNIT Charter bashing..

[Eric Burger <[e-mail]>]

On May 25, 2015, at 5:31 PM, Richard Shockey <[e-mail]> wrote:
> 
> From: Mary Barnes <[e-mail] <mailto:[e-mail]>>
> Date: Friday, May 22, 2015 at 12:58 PM
> Attached is what I have at this point. Really, the only thing I'm struggling with is the milestones as I don't think we can request publication of the data object and headers without having defined the trust model.
> 
> 
> RS> Mary I’m not sure about that statement. I can certainly anticipate several deployment models where the trust mechanism (aka signing) does not need to be formally integrated in the solution especially those where the exchange of data is more bi-lateral and the trust mechanism is at lower layers of the stack than the signaling. My initial concern  is what is the header and what is the data object(s) carried in the header. How the CNIT data is created should not be our concern.

I do not buy it. If there are private agreements between service providers, they have private agreements. They can do whatever they want.

Last I looked, this is the Internet Engineering Task Force. Assume untrusted transport across the wide open Internet, and trust no endpoint that cannot cryptographically prove who they are. If it happens two service providers exchange CNIT data over a single, yellow cable, then it is a benefit that no state-sponsored security service can listen in on the cable.

I do not want to take three years to build a protocol and two more years after that for products to be available just to have a system that only works in walled gardens. I do not want to be the person that has to explain to the media why Calling Name Delivery is just as broken as it always was and it will be another five years before the world sees a real solution.

Let us get this right the first time.
[snip]