Re: [Model-t] What are we trying to protect

[Stephen Farrell <[e-mail]>]

Hiya,

On 04/08/2019 23:38, Bret Jordan wrote:
> A few comments inline… Sorry, I try not to do that.

Why not? It's fine. (And easier to follow in mail I believe.)

>>> the larger risk, and larger attack surface.  When we design 
>>> protocols and only consider a small handful of threats, then we 
>>> inevitably hurt the market.
>> 
>> IMO we ought not only think in terms of "the market" - I'd hope
>> rather that everyone sometimes thinks of more than commerce as the
>> Internet impacts on people in other ways that are relevant in this
>> discussion.
> 
> Sorry bad word choice.  =~s/market/industry/g;  When I refer to “the
> market” I am not talking about the vendor space, commercial space, or
> the sell stuff over the web space.  I am simply referring to the way
> end users, organizations, enterprises, and governments need to use
> the connectedness of computers and IP address ranges to do what ever
> it is they are doing. So I should have said “industry” or if you have
> a better term, let me know.

I suspect this is one where we're better to recognise that
nobody's fav term is correct;-) It's entirely legit to consider
how security/privacy analyses affect the market, and how they
affect society, and how they affect specific communities, and how
they affect the set of people who use or care about the Internet.
Those are all valid, as would be other sets of interested parties,
and I suspect we'd never reach consensus as to the relative
importance of each. I think if we each accept that other folks
rate those differently for reasons that are possibly as valid as
our own, that might be good enough.

>>> The more of these things we can document and the more we can
>>> bring them to light, the better everything will be in the end.
>> Yes, but it's important to document things in a way that can lead
>> up to then winnowing things down to something that ends up useful
>> to that population of IETFers who are not security or privacy
>> specialists.
> 
> Once again, I fully agree.  But we need to start somewhere.  The
> Stanford D-School has a great set of classes on how to effectively
> brainstorm.  And I think that is what we are trying to do now.  We
> are trying to get the discussion going and get everything out there,
> so we can start to better understand how big the elephant is that we
> need to work on

The elephant metaphor isn't my favourite. Even if we're each
scrambling around in the dark, there might not be exactly one
elephant. In this case, I think there definitely is more than
one. For example, we have the enterprise n/w vs big-I security
differences, and we also have the commercial/govt surveillance
vs. human rights/freedom differences. It may be my lack of
imagination but I can't see how those are part of one elephant.
(And I think that's true regardless of one's opinions as to any
of the locally-perceived potential elephant parts:-)

Cheers,
S.


> 
> Bret
> 
> 
>> 
>> Cheers, S. <0x5AB2FAF17B172BEA.asc>
> 
> 
>