Re: [oauth] Comment on charter

["Tschofenig, Hannes (NSN - FI/Espoo)" <[e-mail]>]

Thank you Greg for your input. I incorporated your comment into the
charter text as it sounds good to me. 
 
Ciao
Hannes

________________________________

	From: [e-mail] [mailto:[e-mail]] On
Behalf Of ext Lisa Dusseault
	Sent: 06 February, 2009 21:05
	To: [e-mail]
	Cc: [e-mail]
	Subject: [oauth] Comment on charter
	
	
	Here's a comment on the charter, Greg told me this in person but
I asked him to follow up on the list.  He's not on the list, so please
keep him on the cc' for this discussion:
	

	Oauth team,
	I think the work you are doing is meaningful and I hope to see
it transition to WG soon. 
	
	Here is a comment to your charter that I made from the mic at
the last BoF, and which I hope to see included in the next version of
the charter.
	
	From the charter:
	
	"The Working Group will produce one or more documents suitable
	for
	consideration as Proposed Standard, based upon the OAuth I-D,
that will:
	  * Align OAuth with the Internet and Web architectures, best
	practices and
	terminology
	  * Assure good security practice, or document gaps in its
	capabilities
	  * Promote interoperability"
	
	Change second bullet to:
	"* Assure good security practice, or document gaps in its
	capabilities, and propose a path forward for addressing the
gap."
	
	The reason:  we have experienced in other places in IETF where
	documents with less-than-perfect security get hung up in
Security Area
	review, and for good reason. We want secure protocols that use
modern,
	best-practice secruity mechanisms. However, sometimes getting
from today
	to that state of best-practice security mechanism is
non-trivial, and
	will take standard and implementation work. We are learning over
time
	that (1) documenting security gaps, combined with (2) a clear
path to
	addressing gaps, and (3) work in progress to addressing gaps
goes a long
	way to making less-than-best-security-practice specifications
more
	acceptable. 
	
	I.e. The charter change I propose is geared toward helping Oauth
see the
	light of day more quickly, and have an incremental path toward
	best-practice security.
	
	Let me know what you think,
	Gregorry.