Re: [http-auth] Barry Leiba's Discuss on draft-ietf-httpauth-hoba-09: (with DISCUSS and COMMENT)

[Stephen Farrell <[e-mail]>]

Thanks for updating the ballot. I'll process your comments separately
so this is just on the remaining DISCUSS point.

On 06/01/15 03:36, Barry Leiba wrote:
>>>>> >>>> -- Section 8.2 --
>>>>> >>>>
>>>>> >>>> I don't think you need to say "a la LinkedIn," and I think it's a
>>>>> >>>> bad idea to have us link a company's name to a password
>>>>> >>>> compromise forever in an RFC.  Especially when it's not
>>>>> >>>> necessary.
>>>> >>>
>>>> >>> Is that really DISCUSS worthy? I don't think it is. Which of the
>>>> >>> DISCUSS criteria relate to that. Seems like a stylistic thing to
>>>> >>> me.
>>> >>
>>> >> I think it is: I think it's a very bad thing to disparage specific
>>> >> companies in our RFCs.
>> >
>> > Its a statement of fact though. That is very different.
>> >
>>> >> That said, if you'd actually discuss
>> >
>> > Rhetorical fail alert:-) That last use of "discuss" != DISCUSS-worthy.
>> > You're ignoring a) that this is a style issue and explicitly not
>> > DISCUSS-worthy and b) that I am in fact happy to discus your
>> > non-blocking comments.
>> >
>> > I think it's entirely fair to establish if a point does or does not
>> > warrant being blocking before disposing of the detail. (And hey,
>> > when did an author not want to demote a DISCUSS to a COMMENT if that
>> > is fair-game? Not often.:-)
>> >
>>> >> this with me (why you think it's
>>> >> important to leave it there), then the discussion will have happened,
>>> >> and we can move ahead.

Yet here we still are? :-)

>> >
>> > Facts are much more convincing than abstractions. We could risk a
>> > Streisand effect by not naming one of the major breaches of this
>> > kind. That one was the most topical at the time that text was first
>> > written. A naive reader following up on that will find a plethora
>> > of other examples, of real associated costs and of lessons learned
>> > none of which would be anywhere near as easily found starting (as
>> > a naive reader) from an example.com abstraction (at least afaik
>> > example.com have not had a significant password breach so far,
>> > maybe we ought engineer one:-).
>> >
>> > That enough?
> The fact that there's a plethora of examples really speaks to not
> calling out one company on this, 

I re-iterate: At the time of writing this was the poster-child
example. It still remains one, and a good one for RFC readers.

> as well as that it's not necessary to
> do so.  We could just say "the many password exposures that have been
> well documented in the media," for example.

That may be a reasonable comment, but I continue to maintain that
it is not DISCUSS-worthy. And I think being so shy about this is
a bad plan actually and we ought if anything be more direct about
it.

> (On the DISCUSS criteria, "This cannot be an exhaustive list, but this
> set should be taken as exemplary of the common causes for DISCUSSes
> seen by the IESG in the past."  This is a rare situation, so, of
> course, it's not explicitly listed.  I can only say again that I think
> it's a bad idea to call out specific companies unless there's a strong
> need to.)

"bad idea" does not mean DISCUSS-worthy, and extending the DISCUSS
criteria in that way seems very wrong to me.

The DISCUSS non-criteria also exists though, quoting, I think this falls
squarely under two of those:

"
- Pedantic corrections to non-normative text. Oftentimes, poor phrasing
or misunderstandings in descriptive text are corrected during IESG
review. However, if these corrections are not essential to the
implementation of the specification, these should not be blocking
comments.

- Stylistic issues of any kind. The IESG are welcome to copy-edit as a
non-blocking comment, but this should not obstruct document processing.
"

I think in a case like this it is entirely correct to reference well
publicised security incidents in the most natural fashion via the name
of the organisation that experienced the incident. In this case, I
re-iterate that that incident was I think the most commonly cited one
at the time of writing. (I can buy that adding a citation for more
detail would be a good addition though.)

Cheers,
S.




>