[dns-privacy] Correcting some misstatements made in the session

[Phillip Hallam-Baker <[e-mail]>]

Some of the attacks made on one of the speakers seemed overly aggressive to
me. And as sometimes happens, the people making the statements were simply
misinformed.

The use of machine readable legal terms is not just possible, it is the way
most international trade takes place. When I first joined VeriSign, I
worked in the practices group where one of our projects was developing that
technology in a collaboration with the ICC.

That project was probably premature, back in 1997 we had barely started
SSL. But INCOTERMS are the basis for most international trade.

https://www.export.gov/article?id=Incoterms-Overview

Secondly, we keep having people make blanket statements about what the user
can understand. If we are going to have people make claims based on
'academic studies' I think it behoves them to state which studies they
mean. Because when we recently had this discussion on the Mozilla list, we
were once again shown the same decade old study based on 18 participants
split into three groups of six that found that users don't understand
security signal without training.

Cherry picking results to find the result you want is not science. As with
the EFF claim that there were over 1000 CAs, this is a zombie prejudice.

If people are going to slap down speakers with statements of absolute
certitude and ridicule them, better get it right. In this case the
statements made were wrong. I think an apology is warranted to the speaker.
We are not going to get the best results if people are ridiculed for making
statements that are actually correct.