Re: [hrpc] When are HRPCs normative in an IETF protocol?

Over the past few days, this thread has turned technical. The tech status
is here
https://mailarchive.ietf.org/arch/msg/hrpc/VhroNqqmg9SuqXlsOWieijuobCI/ and
I hope this discussion will continue to consensus on the GNAP list
txauth@ietf.org

What should be the next steps to try and answer the two questions below?

- Adrian

On Sun, Nov 27, 2022 at 3:27 PM Adrian Gropper <agropper@healthurl.com>
wrote:

> It's premature to consider authority.
>
> What's on the table is HRPC's ability to document, educate, and suggest
> how mitigations relate to normative language in GNAP.
>
> More specifically,
>
> 1 - Is the right to choose an AS separately from an RS a human right per
> HRPC?
>
> and then,
>
> 2 - Depending on 1, when both the RO (data subject) and the RS (resource
> server) have a legitimate interest in choosing the AS, should GNAP give
> normative priority to RO choice and treat RS choice as a security
> mitigation rather than the current GNAP framing?
>
> - Adrian
>
> On Sun, Nov 27, 2022 at 2:43 PM Eric Rescorla <ekr@rtfm.com> wrote:
>
>>
>>
>> On Sun, Nov 27, 2022 at 7:20 AM Stephen Farrell <
>> stephen.farrell@cs.tcd.ie> wrote:
>>
>>>
>>> Hiya,
>>>
>>> On 26/11/2022 20:00, Adrian Gropper wrote:
>>> > IETF GNAP is a new delegated authorization protocol intended to replace
>>> > OAuth in many use-cases, including Alice-to-Bob cases. In the HRPC
>>> context,
>>> > delegated authorization presents the risk of forced association as a
>>> > violation of human rights.
>>>
>>> I had a quick look at the google doc and the description
>>> seems a bit abstract if you want to convince people that
>>> the flaw you're calling out exists. (I'm unclear if it
>>> does or not myself fwiw.)
>>>
>>> Could you provide a much more specific example, e.g. in
>>> the context of medical devices, of how the problem
>>> manifests itself?
>>>
>>> Thanks,
>>> S.
>>>
>>> PS: I dropped the gnap list for now, my guess is that it'd
>>> be better to bring the discussion back there after the
>>> problem description has been made more crisp.
>>>
>>
>> Well, certainly if you want to have any change made to the protocol,
>> given that HRPC has no authority to require WGs to do anything.
>>
>> -Ekr
>>
>>
>>> _______________________________________________
>>> hrpc mailing list
>>> hrpc@irtf.org
>>> https://www.irtf.org/mailman/listinfo/hrpc
>>>
>>