Re: [hrpc] from “Security Considerations” to “Threat Model Considerations”?

Hi Cory, 

I am not a big fan of adding “mandatory” considerations sections to drafts. The reason is simple: If the considerations are valuable enough then authors will add them anyway.

Hence, I would focus on writing meaningful guidance instead of spending time to make them mandatory. 

As Ekr said, it is also quite difficult to get an agreement. I still think it was the right decision to not make the privacy consideration section mandatory.

Ciao

Hannes

From: hrpc <hrpc-bounces@irtf.org> On Behalf Of Eric Rescorla
Sent: Montag, 6. November 2023 13:18
To: Cory Francis Myers <cfm@acm.org>
Cc: hrpc@irtf.org
Subject: Re: [hrpc] from “Security Considerations” to “Threat Model Considerations”?

On Mon, Nov 6, 2023 at 3:46 AM Cory Francis Myers <cfm@acm.org <mailto:cfm@acm.org> > wrote:

The requirement for a “Security Considerations” section originates in 
RFC 2223 “Requirements to RFC Authors”.  The RFC 7322 style guide adds 
sections for IANA and internationalization considerations.

draft-irtf-hrpc-guidelines (how to think about human-rights 
considerations) is not quite like RFC 3552 (how to write “Security 
Considerations” sections)—because the *need* to think about as well as 
articulate the latter is taken for granted.  What would it take to:

1. Add a “Human Rights Considerations” section?

2. Add a “Privacy Considerations” *and* a “Safety Considerations” 
section (per Stephanie Mikkelson‘s slide today on safety, privacy, 
security by design[1])?

3. Broaden “Security Considerations” into “Threat Model 
Considerations”?[2]

I’m oversimplifying on purpose!  My goal in asking this question is to 
understand the obstacles to establishing the parity of these criteria 
with security considerations.

It would require a Standards Track RFC, which is to say that the work

would need to happen in IETF, not in HRPC.

With that said, I don't think it's very likely that the IETF will require either

of these. When RFC 6793 was written there was an explicit decision not

to require Privacy Considerations in RFCs and I suspect that a Human Rights

Considerations Section would be even more difficult to come to consensus

on.

-Ekr

If I’m retreading old or fraught ground, as I suspect I may be, I’d 
welcome pointers into the archives.

Sincerely,

Cory Myers.

[1]: 
https://datatracker.ietf.org/meeting/118/materials/slides-118-hrpc-unfpa-gbv-tech-guidance-00.pdf 
(slide 15)

[2]: Although this risks framing all of these considerations as strictly 
meliorative of harms, rather than affirmative protections of affirmative 
rights.

_______________________________________________
hrpc mailing list
hrpc@irtf.org <mailto:hrpc@irtf.org> 
https://mailman.irtf.org/mailman/listinfo/hrpc