[oauth] Comment on charter

[Lisa Dusseault <[e-mail]>]

Here's a comment on the charter, Greg told me this in person but I asked him
to follow up on the list.  He's not on the list, so please keep him on the
cc' for this discussion:

Oauth team,
I think the work you are doing is meaningful and I hope to see it transition
to WG soon.

Here is a comment to your charter that I made from the mic at the last BoF,
and which I hope to see included in the next version of the charter.

>From the charter:

"The Working Group will produce one or more documents suitable
for
consideration as Proposed Standard, based upon the OAuth I-D, that will:
  * Align OAuth with the Internet and Web architectures, best
practices and
terminology
  * Assure good security practice, or document gaps in its
capabilities
  * Promote interoperability"

Change second bullet to:
"* Assure good security practice, or document gaps in its
capabilities, and propose a path forward for addressing the gap."

The reason:  we have experienced in other places in IETF where
documents with less-than-perfect security get hung up in Security Area
review, and for good reason. We want secure protocols that use modern,
best-practice secruity mechanisms. However, sometimes getting from today
to that state of best-practice security mechanism is non-trivial, and
will take standard and implementation work. We are learning over time
that (1) documenting security gaps, combined with (2) a clear path to
addressing gaps, and (3) work in progress to addressing gaps goes a long
way to making less-than-best-security-practice specifications more
acceptable.

I.e. The charter change I propose is geared toward helping Oauth see the
light of day more quickly, and have an incremental path toward
best-practice security.

Let me know what you think,
Gregorry.