Re: [Model-t] What are we trying to protect

[Bret Jordan <[e-mail]>]

A few comments inline… Sorry, I try not to do that. 

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Aug 4, 2019, at 3:23 PM, Stephen Farrell <[e-mail]> wrote:
> 
> 
> Partly agreeing, partly quibbling:-)
> 
> On 04/08/2019 17:37, Bret Jordan wrote:
>> We need to ensure everyone here in the IETF understands the bigger
>> problem, 
> 
> It is certain that not every IETF participant will care about
> understanding every detail of every possible threat. They do
> have other things do be doing:-)

I fully agree.  We need to make sure the documentation we come up with is super easy to understand, is easily digestible, but yet covers enough of the problem space, that it is really meaningful. 



> 
>> the larger risk, and larger attack surface.  When we design
>> protocols and only consider a small handful of threats, then we
>> inevitably hurt the market.
> 
> IMO we ought not only think in terms of "the market" - I'd
> hope rather that everyone sometimes thinks of more than commerce
> as the Internet impacts on people in other ways that are
> relevant in this discussion.

Sorry bad word choice.  =~s/market/industry/g;  When I refer to “the market” I am not talking about the vendor space, commercial space, or the sell stuff over the web space.  I am simply referring to the way end users, organizations, enterprises, and governments need to use the connectedness of computers and IP address ranges to do what ever it is they are doing. So I should have said “industry” or if you have a better term, let me know.  



> 
>> The more of these things we can document and the more we can bring
>> them to light, the better everything will be in the end.
> Yes, but it's important to document things in a way that can
> lead up to then winnowing things down to something that ends
> up useful to that population of IETFers who are not security
> or privacy specialists.

Once again, I fully agree.  But we need to start somewhere.  The Stanford D-School has a great set of classes on how to effectively brainstorm.  And I think that is what we are trying to do now.  We are trying to get the discussion going and get everything out there, so we can start to better understand how big the elephant is that we need to work on. 

Bret


> 
> Cheers,
> S.
> <0x5AB2FAF17B172BEA.asc>