DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
 h=mime-version:date:message-id:subject:from:to:cc:content-type;
 b=tMsMPUkEB0i71kpWnHwYVrXDpyYgy/JuvZwe2DBSnxVqjIeoe0OX2B6a0R6R47wQgH
 qTUb8VGcAChDjHB/I1fdg82U4SCd6ok+TkIrR8EzbD1cMKYac/NStHwi5NhtkwT1sW8+
 Pfr6mjELnwrGYBJFjwjqHStJ749c2NGaHQeTs=
MIME-Version: 1.0
Date: Fri, 6 Feb 2009 11:04:45 -0800
Message-ID: <ca722a9e0902061104l3314073bvc6f3e27863e8779d@mail.gmail.com>
From: Lisa Dusseault <lisa.dusseault@gmail.com>
To: oauth@ietf.org
Content-Type: multipart/alternative; boundary=000e0cd14e7cb15301046244b11e
Cc: gregory.ietf@gmail.com
Subject: [oauth] Comment on charter
Precedence: list

--000e0cd14e7cb15301046244b11e
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Here's a comment on the charter, Greg told me this in person but I asked him
to follow up on the list.  He's not on the list, so please keep him on the
cc' for this discussion:

Oauth team,
I think the work you are doing is meaningful and I hope to see it transition
to WG soon.

Here is a comment to your charter that I made from the mic at the last BoF,
and which I hope to see included in the next version of the charter.

>From the charter:

"The Working Group will produce one or more documents suitable
for
consideration as Proposed Standard, based upon the OAuth I-D, that will:
  * Align OAuth with the Internet and Web architectures, best
practices and
terminology
  * Assure good security practice, or document gaps in its
capabilities
  * Promote interoperability"

Change second bullet to:
"* Assure good security practice, or document gaps in its
capabilities, and propose a path forward for addressing the gap."

The reason:  we have experienced in other places in IETF where
documents with less-than-perfect security get hung up in Security Area
review, and for good reason. We want secure protocols that use modern,
best-practice secruity mechanisms. However, sometimes getting from today
to that state of best-practice security mechanism is non-trivial, and
will take standard and implementation work. We are learning over time
that (1) documenting security gaps, combined with (2) a clear path to
addressing gaps, and (3) work in progress to addressing gaps goes a long
way to making less-than-best-security-practice specifications more
acceptable.

I.e. The charter change I propose is geared toward helping Oauth see the
light of day more quickly, and have an incremental path toward
best-practice security.

Let me know what you think,
Gregorry.

--000e0cd14e7cb15301046244b11e
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Here&#39;s a comment on the charter, Greg told me this in person but I aske=
d him to follow up on the list.&nbsp; He&#39;s not on the list, so please k=
eep him on the cc&#39; for this discussion:<br><div style=3D"margin-left: 4=
0px;">
<br>Oauth team,<br>
I think the work you are doing is meaningful and I hope to see it
transition to WG soon. <br><br>
Here is a comment to your charter that I made from the mic at the last
BoF, and which I hope to see included in the next version of the
charter.<br><br>
 From the charter:<br><br>&quot;The Working Group will produce one or more =
documents suitable<br>for<br>consideration as Proposed Standard, based upon=
 the OAuth I-D, that will:<br>&nbsp; * Align OAuth with the Internet and We=
b architectures, best<br>

practices and<br>terminology<br>&nbsp; * Assure good security practice, or =
document gaps in its<br>capabilities<br>&nbsp; * Promote interoperability&q=
uot;<br><br>Change second bullet to:<br>&quot;* Assure good security practi=
ce, or document gaps in its<br>

capabilities, and propose a path forward for addressing the gap.&quot;<br><=
br>The reason:&nbsp; we have experienced in other places in IETF where<br>d=
ocuments with less-than-perfect security get hung up in Security Area<br>re=
view, and for good reason. We want secure protocols that use modern,<br>

best-practice secruity mechanisms. However, sometimes getting from today<br=
>to that state of best-practice security mechanism is non-trivial, and<br>w=
ill take standard and implementation work. We are learning over time<br>

that (1) documenting security gaps, combined with (2) a clear path to<br>ad=
dressing gaps, and (3) work in progress to addressing gaps goes a long<br>w=
ay to making less-than-best-security-practice specifications more<br>accept=
able. <br>

<br>I.e. The charter change I propose is geared toward helping Oauth see th=
e<br>light of day more quickly, and have an incremental path toward<br>best=
-practice security.<br><br>Let me know what you think,<br>Gregorry.<br>

</div>
<pre><br><br><br></pre>

--000e0cd14e7cb15301046244b11e--